# A close look at the advanced techniques used in a Malaysian-focused APT campaign

APT40-linked phishing lure uses remote template injection and VBA to drop DLLs that side-load a LogiMailApp backdoor, giving Malaysian government targets a persistent in-memory implant.

- Payout: Real-world hack
- Program: Logitech LogiMailApp
- Credited: Samir Bousseaden,Daniel Stepanic,Elastic Security Intelligence & Analytics Team
- Disclosed: 2022-06-22
- Write-up quality: 7/10
- Original: https://www.elastic.co/security-labs/threat-command/advanced-techniques-used-in-malaysian-focused-apt-campaign
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-advanced-techniques-used-in-malaysian-focused-apt-campaign
- Tags: domain:desktop impact:internal-access impact:rce kind:incident platform:threat-intel tech:windows technique:reverse-engineering technique:source-review vuln:misconfiguration vuln:rce

**Target:** Microsoft Word document lure, remote template, DLL side-loading, in-memory implant
**Root cause:** LogiMailApp.exe loads LogiMail.dll from its own directory via DLL search order, letting an attacker-planted DLL execute; the lure abuses remote template injection to run VBA that drops the DLLs.
**Steps:**
1. Deliver `Bubar Parlimen.docx` phishing lure referencing Malaysian political crisis
2. Document fetches remote template `RemoteLoad.dotm` which runs VBA macro
3. VBA base64-decodes and drops `sl1.tmp`/`sl2.tmp` to `C:\Users\Public\`
4. `sl1.tmp` RCT uses `URLDownloadToFileA` to fetch `LogiMailApp.exe` and `LogiMail.dll`
5. `sl2.tmp` RCP uses `WinExec` to run `LogiMailApp.exe`, which side-loads malicious `LogiMail.dll`
6. `DllGetClassObject` downloads AES-encrypted `~liseces1.pcs`, decrypts in memory with SHA256-derived key, deletes file
7. Second stage mapped into memory, OEP called, C2 via `hxxp://tomema.myddns.me/postlogin`
8. Persistence via `HKCU\...\Run\ntkd`
**How found:** Elastic researchers noted rare `LoadLibraryA` loading of `.tmp` DLLs by winword.exe and exceptionally rare `CallWindowProcA` usage, then reverse-engineered the DLL exports (RCT/RCP) and the side-loaded LogiMail.dll to trace the chain.
**Exploitation:** Phishing attachment opens decoy doc while remote template executes VBA; dropped DLLs download and execute a signed-looking LogiMailApp.exe that side-loads the attacker DLL, which decrypts and maps an in-memory backdoor supporting command execution, file exfil, and registry persistence over AES-encrypted C2.
**Escalation:** In-memory second stage bypasses file-system scanning; dynamic DNS C2 and registry Run key provide persistence and remote tasking.
**Insight:** Watch for Office processes loading DLLs from user-writable paths like `C:\Users\Public` with `.tmp` extensions, and for legitimate EXEs (e.g. Logitech camera software) executed from `AppData\Local\Microsoft\Office` — a strong side-loading indicator.