LausivLoader Weaponizes Environment Variables to Break Staged Analysis

A malware sample dubbed LausivLoader, detected in late August 2025 in a malspam attachment with a .r01 extension, showcases an anti-analysis technique that exploits a routine operating-system mechanism: the inheritance of environment variables from parent to child processes. According to analysis published September 17, 2025 by the SANS Internet Storm Center, the malware uses this data-passing chain — orchestrated through conhost.exe — to make piecemeal analysis of individual infection stages impractical.

The Invisible Handoff Between JavaScript and PowerShell

The core of the infection chain lies in a data pass that the SANS ISC analyst explicitly describes as non-replicable in isolated sandboxes. The initial JavaScript file — 613 KB, of which roughly 205 KB is actual code after stripping 450 lines of obfuscating comments — creates a randomly named temporary directory based on a base-36 timestamp inside %TEMP%. Inside it writes two files with names ending respectively in 'a' and 'b'.

The next step shifts the analysis paradigm: the JavaScript sets two environment variables, Kv7408 and Kv562, assigning them the absolute paths of the two temporary files. These variables are never written to disk or transmitted over the network; they persist exclusively in the process memory space. When the JavaScript launches conhost.exe as an intermediate process, which in turn executes PowerShell, the shell inherits the parent's full environment.

"Since child processes normally inherit their parent's environment, this allows the paths to reach the PowerShell code through the intermediate 'conhost.exe' process." — SANS ISC Analyst

PowerShell then retrieves the paths via $env:Kv7408 and $env:Kv562, combines the contents of the two files, applies the cryptographic transformations and decompression, and only then are the temporary files deleted. The order is intentional: the original data disappears before the payload is exposed in the clear, rendering any post-hoc capture attempt futile.

Why Staged Analysis Fails on This Sample

The operational consequence of this design is documented precisely in the original analysis. If an analyst extracts the decoded PowerShell command and pastes it into an independent shell, the environment-variable references resolve to nothing: the paths point to files already deleted or, worse, to paths that never existed in that session. The infection chain is bound to process genealogy, not to the static content of individual artifacts.

This structural constraint renders ineffective sandbox approaches that execute stages in isolation or that save intermediate files without preserving the complete execution environment. The environment variable, a legitimate and ubiquitous mechanism in Windows systems, becomes here an invisible inter-process communication channel for tools that do not track environmental inheritance across multiple process generations.

The Cryptographic Chain and the Double .NET Loader

After the environmental handoff, the payload transforms through a series of operations documented in detail. The combined content of the two temporary files undergoes decoding, decryption with AES-128-CBC in CBC mode with PKCS#7 padding, and decompression via GZipStream. The result is a 315,904-byte 64-bit .NET executable, loaded in memory without touching disk via reflection.

This first .NET loader already implements evasion techniques: it resolves Windows APIs dynamically and patches AmsiScanBuffer and AmsiScanString to bypass Microsoft's Anti-Malware Scan Interface. From its interior it then extracts a second stage by applying selective subsampling — every fifth byte — from an embedded 299,520-byte array, followed by RC4 decryption. The resulting second .NET loader occupies 59,904 bytes.

This final component connects to hxxps://yapw[.]life/phpt/stego_zrgaixkku8.png to download the final payload. The URL was no longer active at the time of analysis, and the final payload was not retrieved.

The Genuine PNG Steganography and Two Execution Paths

An element the SANS ISC analyst calls surprising is the nature of the downloaded file: not an executable with a fake extension, but an authentic PNG. The loader parses the PNG structure searching for an iTXt chunk, where the payload is concealed with a specific binary marker — the hexadecimal sequence 'FF 89 AD 4A' — followed by the payload length, XOR decryption, and DEFLATE decompression.

The second loader's architecture supports two execution modes for the final payload: managed .NET assembly loading via reflection, or process hollowing for native executables. The dossier does not specify which of the two paths was active in the analyzed sample, nor the malware family of the unretrieved final payload.

Persistence Masquerading as a Microsoft System Task

Beyond the injection chain, the sample implements persistence with a masking operation that exploits familiarity with system names. The JavaScript copies itself to %LOCALAPPDATA%\Microsoft\PhotoEngine\PhotoStudio.js — a directory that does not exist in standard Windows installations — and registers a scheduled task named '\MicrosoftEdgeUpdateTaskCore'. The trigger is user logon, the action executes wscript.exe with parameters '//B //Nologo' that suppress banners and visual errors.

The task name mimics legitimate Microsoft Edge update tasks, a detail designed to evade manual review and overly rigid heuristic rules. The analyst does not specify whether the task also creates additional registry entries or modifies hiding attributes.

Why This Matters

The dossier does not document specific mitigations or detailed operational recommendations from the source. It does not emerge whether the analyst proposed additional indicators of compromise beyond the task name and JavaScript file path. The source does not specify the nature of data exposed or exfiltrated, nor the specific recipient or target of the attack.

What the LausivLoader sample documents clearly is instead a shift in the cost-benefit ratio of automated malware analysis. Tools that execute JavaScript and PowerShell in separate sandboxes, or that extract commands without tracking environment-variable inheritance, produce incomplete artifacts. The analyst states this explicitly: "It is also one of the reasons why looking only at the decoded command would leave us with an incomplete picture."

The mechanism requires no zero-day vulnerabilities or elevated privileges: it exploits a documented and necessary behavior of Windows operating systems. Its anti-forensic effectiveness stems precisely from this banality, making it compatible with a wide range of target environments and difficult to flag as an anomaly without process-genealogy context.

Frequently Asked Questions

Why isn't analyzing the PowerShell command alone enough?

Because the command references environment variables inherited from the parent JavaScript process via conhost.exe. In an independent shell those variables do not exist, the temporary files are already deleted, and the decoded command cannot reconstruct the payload.

Is the downloaded PNG file malicious by itself?

According to the source, it is a genuine PNG with a payload hidden in the iTXt chunk via steganography. The file is not a direct executable: it requires the loader to extract, decrypt, and decompress the concealed content.

What makes the persistence task particularly insidious?

The name '\MicrosoftEdgeUpdateTaskCore' mimics that of a legitimate Microsoft system component. The copy of the JavaScript into a fictitious directory under Microsoft\PhotoEngine completes the camouflage within the %LOCALAPPDATA% structure.

Information is based on SANS ISC analysis and current as of publication.

Sources

• https://isc.sans.edu/diary/rss/33348
• https://www.virustotal.com/gui/file/408b2df6e81824fa5bdf4f0fbd185a7e6db06e2be98fbeebce416f66954b9fa9