LausivLoader Uses Inherited Environment Variables as Unusual…

The LausivLoader malware exploits ordinary process environment inheritance to pass file paths between JavaScript and PowerShell stages, rendering isolated stage analysis ineffective. Detected in late August 2025 malspam .r01 attachments, the loader splits its final .NET payload across two temporary files, decrypts it in memory via AES-128-CBC and GZipStream, and achieves persistence through a scheduled task masquerading as a Microsoft Edge update.

Methodological note: All analysis below is based on a single SANS Internet Storm Center report, published September 17, 2025, under the generic byline "Handler on Duty." No independent source has confirmed the sample's technical details. The report breaks off abruptly during the description of the final .NET payload.

A malware sample documented by SANS ISC under the name LausivLoader exploits an unusual data-passing mechanism between execution stages: environment variables inherited from the parent process. Detected in .r01 attachments from a late August 2025 malspam campaign, the loader demonstrates how samples with moderate detection rates can incorporate logic that defeats isolated single-stage analysis.

Key Takeaways

All analysis rests on a single SANS ISC report, not independently confirmed.
JavaScript sets the Kv7408 and Kv562 environment variables in its own process, inherited by conhost.exe and PowerShell to transmit temporary file paths.
The final payload is split into two files with 'a' and 'b' suffixes, decoded via AES-128-CBC and GZipStream into a 315,904-byte 64-bit .NET executable.
Persistence is achieved through a scheduled task named \MicrosoftEdgeUpdateTaskCore that runs wscript.exe with a copy of the script at %LOCALAPPDATA%\Microsoft\PhotoEngine\PhotoStudio.js.
The SANS report breaks off mid-sentence with "Its reachable code re"; the operational purpose of the .NET payload is undocumented.

How the Data Passing Works

The initial file is a 613 KB JavaScript, 450 lines of which are obfuscating comments. After cleanup, the script reduces to roughly 205 KB. This primary stage generates a temporary directory in %TEMP% with a name built from a random number and a base36 timestamp, then writes two files with 'a' and 'b' suffixes containing portions of the encoded payload.

The technical interest emerges in the transfer of information to the next stage. The JavaScript script sets two environment variables in its WScript process: Kv7408 and Kv562, which hold the full paths of the two temporary files. When the script launches PowerShell with parameters -NoP -NonI -W Hidden -EncodedCommand, the new process inherits the environment through conhost.exe. The PowerShell code then retrieves the paths via [Environment]::GetEnvironmentVariable('Kv7408','Process') and [Environment]::GetEnvironmentVariable('Kv562','Process').

"It is 'just' an ordinary environment inheritance used to pass information between different stages of an execution chain… Which is nevertheless an interesting approach from a technical standpoint"
— SANS ISC Analyst, "Handler on Duty"

Why Partial Analysis Fails

Verified facts: The documented mechanism has a concrete consequence for analysis techniques. The SANS ISC analyst observes that copying the decoded PowerShell command into an unrelated shell fails to reconstruct the original inputs because the contextual environment variables are missing. Piecemeal analysis of the infection chain becomes impractical.

Editorial analysis: This mechanism hits a widespread blind spot in malware analysis practices. Researchers tend to focus on the most accessible stage — often the decoded PowerShell script — overlooking the execution context inherited from the parent process. The .NET Process environment variable returns variables associated with the current process, including inherited ones; without tracing the full process tree, the analyst loses references to temporary files deleted before decryption.

The SANS analyst highlights a further aspect: "It is also one of the reasons why looking only at the decoded command would leave us with an incomplete picture." The intentional fragmentation of the payload across two temporary files, combined with metadata passing via inherited environment, forces the analyst to reconstruct the entire process chain to obtain a complete picture.

From Decoding to In-Memory Execution

The two temporary files contain Base64-encoded data that, when combined and decrypted, produce the final payload. Decryption uses AES-128-CBC with PKCS#7 padding, with a hardcoded key and IV in the PowerShell code: the key is the byte array 0xC9,0xE0,0xBF,0x98,0xDC,0x0E,0xC6,0x9C,0x8D,0x66,0x15,0x17,0x45,0x0E,0xC6,0xC9 and the IV is 0x4A,0x58,0x21,0xE3,0x29,0x41,0xDF,0xE5,0x19,0x8F,0xCE,0x68,0xEC,0x8A,0x06,0x2C.

After decryption, the data passes through GZipStream for decompression. The result is a 315,904-byte 64-bit .NET executable, loaded in memory without disk writes and invoked directly at its entry point. The two temporary files are removed before the payload executes, eliminating filesystem traces.

The SANS analysis text breaks off abruptly during the description of the final .NET payload's reachable code, with the incomplete sentence "Its reachable code re." The operational destination of the payload — C2 communication, data theft, or other actions — is not documented in the source.

Detection and Sample Context

The analyzed sample registered a 28/55 detection on VirusTotal at the time of analysis. The SANS source indicates that "several engines providing information about the malware family" associated the sample with the LausivLoader family, without specifying how many engines actually recognized the family or with what confidence.

Persistence is achieved through a scheduled task named \MicrosoftEdgeUpdateTaskCore that runs wscript.exe with a copy of the script at %LOCALAPPDATA%\Microsoft\PhotoEngine\PhotoStudio.js. The source documents this path as the one used by the analyzed sample, without asserting whether the PhotoEngine directory is legitimate or not.

Actionable Guidance

The SANS analysis brief does not specify recommended detection measures or technical countermeasures. The only actionable indication derivable from the documented facts is that dynamic analysis must capture the entire process tree — including environment variable inheritance — to reconstruct the values of Kv7408 and Kv562 before their deletion.

Known Limitations and Methodological Transparency

This article carries significant limitations imposed by the primary source. The SANS ISC report is the sole source with direct technical analysis of the sample; no independent confirmation exists. The author is identified only as "Handler on Duty," without a personal name. The exact sample detection date is given generically as "end of August" without a specific day.

The report breaks off abruptly during analysis of the final .NET payload, with the incomplete sentence "Its reachable code re." Consequently, the operational destination of the payload — C2 communication, data theft, ransomware, or other actions — is undocumented. It is not possible to establish whether LausivLoader is a previously known malware family or whether this sample represents a specific evolution.

No information is available on prior or subsequent campaigns, geographic origin, attack attribution, or number of victims and affected entities.

Information is based on the cited source and current as of publication.

Sources

Sources and references

Get DeafLetter