m6699.exe

ShellCode_Loader uses the Python ctypes library for accessing the Windows API to load the shellcode in memory and start a new thread that executes the shellcode.

The main purpose of m6699.exe is to execute a first-stage shellcode that implements a loader for a second-stage shellcode.

“allocat[es] executable… heap memory… places the first-stage shellcode… and executes it.” / “ctypes… load the shellcode in memory and start a new thread”

The Golang malware m6699.exe uses the Yaegi framework to interpret at runtime encoded Golang source code stored within the compiled binary, executing the code as if compiled. This is a technique for hindering static analysis and evading detection by static analysis mechanisms.

“allocat[es] executable… heap memory… places the first-stage shellcode… and executes it.” / “ctypes… load the shellcode in memory and start a new thread”

“The malware first Base-64 decodes and then decrypts the shellcode.” / “decodes before passing… for execution.”

m6699.exe then evaluates the source code in the context of the Yaegi interpreter and uses Golang reflection to execute the run.Main function.

The first-stage shellcode implements a shellcode loader. The shellcode connects to a C2 server using the Windows Sockets 2 library and receives a 4-byte big value... The first-stage shellcode then receives from the C2 server the second-stage shellcode and executes it.

After gaining access to environments, the threat actor conducted a variety of malicious activities, such as lateral movement, privilege escalation, and deployment of malware and tools hosted at attacker-controlled infrastructure.