Multi-Stage PowerShell Loader Abusing Vercel Infrastructure: XOR/Base64 Obfuscation Chain Delivers Grape.exe & Trojanized draw.io — OTX Detection Pack

---
title: Multi-Stage PowerShell Loader Downloading Archive from Vercel Infrastructure
description: Detects PowerShell processes initiating network connections or download cradles targeting Vercel-hosted staging infrastructure, consistent with the dorenzaa.com / 203.188.171.166 multi-stage loader campaign.
id: 7f3a1c2e-9b4d-4e1a-a8c5-2d6f0b9e3a71
status: experimental
author: Security Arsenal Threat Intelligence
references:
    - https://malwr-analysis.com/2026/08/08/investigating-a-multi-stage-powershell-loader/
date: 2026/08/10
logsource:
    category: network_connection
    product: windows
detection:
    selection_process:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_domain:
        DestinationHostname|contains:
            - '.vercel.app'
            - 'dorenzaa.com'
    selection_ip:
        DestinationIp: '203.188.171.166'
    condition: selection_process and (selection_domain or selection_ip)
falsepositives:
    - Developer workstations legitimately deploying to Vercel via PowerShell CLIs
level: high
tags:
    - attack.command_and_control
    - attack.t1105
    - attack.t1059.001
---
title: Suspicious PowerShell Download Cradle with Base64 and XOR Obfuscation Indicators
description: Detects PowerShell command lines combining encoded/obfuscated content with download and archive extraction behaviors seen in the multi-stage loader chain.
id: 8a2b4d6f-1c3e-4f5b-b9d7-3e1a0c8f2b64
status: experimental
author: Security Arsenal Threat Intelligence
references:
    - https://malwr-analysis.com/2026/08/08/investigating-a-multi-stage-powershell-loader/
date: 2026/08/10
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_download:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - 'DownloadFile'
            - 'DownloadString'
            - 'Net.WebClient'
            - 'curl'
            - 'wget'
    selection_obfuscation:
        CommandLine|contains:
            - 'FromBase64String'
            - '-enc'
            - '-ec'
            - '-bxor'
            - 'bxor'
            - 'Expand-Archive'
            - 'System.IO.Compression'
    selection_hidden:
        CommandLine|contains:
            - '-w hidden'
            - '-WindowStyle Hidden'
            - '-NoProfile'
            - '-noni'
    condition: selection_image and selection_download and (selection_obfuscation or selection_hidden)
falsepositives:
    - Administrative automation scripts with encoded parameters
    - Software deployment tooling using hidden windows
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1027
    - attack.t1140
---
title: Execution of Masqueraded Payload Binaries from User-Writable Paths
description: Detects execution of the loader's dropped payloads (Grape.exe, UltraToolliteSetup.exe, draw.io.exe) from user-writable directories following archive extraction, where the parent is a script interpreter or archive utility.
id: 3c9e7a15-6d2f-4b8c-c1e4-5a0b2d7f9e38
status: experimental
author: Security Arsenal Threat Intelligence
references:
    - https://malwr-analysis.com/2026/08/08/investigating-a-multi-stage-powershell-loader/
date: 2026/08/10
logsource:
    category: process_creation
    product: windows
detection:
    selection_name:
        Image|endswith:
            - '\Grape.exe'
            - '\UltraToolliteSetup.exe'
            - '\draw.io.exe'
    selection_path:
        Image|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\Downloads\'
            - '\Users\Public\'
    selection_parent:
        ParentImage|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\explorer.exe'
    condition: selection_name and (selection_path or selection_parent)
falsepositives:
    - Legitimate user-initiated draw.io installation (validate signer: draw.io is signed by JGraph Ltd)
level: critical
tags:
    - attack.execution
    - attack.t1036
    - attack.t1204.002

// Hunt: Multi-Stage PowerShell Loader — Vercel staging, obfuscation, and masqueraded payloads
// Microsoft Sentinel / Defender for Endpoint
let Lookback = 14d;
let SuspiciousHosts = dynamic(["dorenzaa.com", "vercel.app"]);
let LoaderHashes = dynamic([
  "d8620f4df9e0159a8db675868b4ed9a205638c847439f52cf1c88541d0655a64",
  "3eaf786bfb4ae5688b347511f98d74c948b7dc0749558acbdc6bbe33dcfa3a61",
  "b385111d6599a30210b7be8f7674a163",
  "0cd022f31b436d6c83ddc1b5c14d47dc",
  "5efe9666ca501077aefc818dae7be59f",
  "b02d6b80c14bc5556bd7eaa6f1bc502b59818f90",
  "2fdc615e948222bec395f988bebcea4da854756d"]);
let NetEvents =
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemoteUrl has_any (SuspiciousHosts) or RemoteIP == "203.188.171.166"
    | where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
    | project NetTime = Timestamp, DeviceName, DeviceId, RemoteUrl, RemoteIP,
              InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId;
let ProcEvents =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("Grape.exe", "UltraToolliteSetup.exe", "draw.io.exe")
       or ProcessCommandLine has_any ("FromBase64String", "-bxor", "Expand-Archive", "DownloadFile", "Invoke-WebRequest")
    | project ProcTime = Timestamp, DeviceName, DeviceId, FileName, ProcessCommandLine,
              FolderPath, SHA256, MD5, InitiatingProcessFileName;
let HashHits =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where SHA256 in~ (LoaderHashes) or MD5 in~ (LoaderHashes)
    | project HashTime = Timestamp, DeviceName, DeviceId, FileName, SHA256, MD5, FolderPath;
union NetEvents, ProcEvents, HashHits
| sort by DeviceName, NetTime desc

<#
.SYNOPSIS
  Hunt script: Multi-Stage PowerShell Loader (dorenzaa.com / Vercel staging)
.DESCRIPTION
  Checks a Windows endpoint for artifacts associated with the OTX-reported
  multi-stage PowerShell loader campaign: network beacons, masqueraded payload
  files, known hashes, and common persistence mechanisms.
#>

$ErrorActionPreference = 'SilentlyContinue'
$Findings = @()

Write-Host "[*] Security Arsenal — Multi-Stage PowerShell Loader IOC Hunt" -ForegroundColor Cyan

# --- 1. Known payload hashes ---
$KnownHashes = @(
    'd8620f4df9e0159a8db675868b4ed9a205638c847439f52cf1c88541d0655a64',
    '3eaf786bfb4ae5688b347511f98d74c948b7dc0749558acbdc6bbe33dcfa3a61',
    'b385111d6599a30210b7be8f7674a163',
    '0cd022f31b436d6c83ddc1b5c14d47dc',
    '5efe9666ca501077aefc818dae7be59f'
)

# --- 2. Masqueraded payload filenames in user-writable paths ---
$PayloadNames = @('Grape.exe','UltraToolliteSetup.exe','draw.io.exe')
$SearchPaths  = @("$env:TEMP", "$env:LOCALAPPDATA", "$env:APPDATA", "$env:USERPROFILE\Downloads", 'C:\Users\Public')

Write-Host "[*] Checking for masqueraded payloads and matching hashes..." -ForegroundColor Cyan
foreach ($Path in $SearchPaths) {
    foreach ($Name in $PayloadNames) {
        Get-ChildItem -Path $Path -Filter $Name -Recurse -Force -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
            $Md5  = (Get-FileHash $_.FullName -Algorithm MD5).Hash.ToLower()
            $Match = ($KnownHashes -contains $Hash) -or ($KnownHashes -contains $Md5)
            $Findings += [PSCustomObject]@{
                Type = 'PayloadFile'; Path = $_.FullName; SHA256 = $Hash
                KnownBad = $Match; LastWrite = $_.LastWriteTime
            }
        }
    }
}

# --- 3. Active / recent network connections to C2 or staging ---
Write-Host "[*] Checking network connections for dorenzaa.com / 203.188.171.166 / *.vercel.app..." -ForegroundColor Cyan
$BadIP = '203.188.171.166'
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq $BadIP } | ForEach-Object {
    $Proc = Get-Process -Id $_.OwningProcess
    $Findings += [PSCustomObject]@{
        Type = 'NetworkConnection'; Path = "$($Proc.ProcessName) (PID $($_.OwningProcess)) -> $($_.RemoteAddress):$($_.RemotePort)"
        SHA256 = ''; KnownBad = $true; LastWrite = ''
    }
}

# --- 4. DNS cache check for malicious domain / vercel subdomains ---
Get-DnsClientCache | Where-Object { $_.Entry -match 'dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa|dorenzaa' } | Out-Null
Get-DnsClientCache | Where-Object { $_.Entry -match 'dorenzaa\.com|vercel\.app' } | ForEach-Object {
    $Findings += [PSCustomObject]@{
        Type = 'DNSCache'; Path = $_.Entry; SHA256 = ''; KnownBad = ($_.Entry -match 'dorenzaa\.com'); LastWrite = ''
    }
}

# --- 5. Persistence checks: Run keys, scheduled tasks referencing payloads ---
Write-Host "[*] Checking persistence mechanisms..." -ForegroundColor Cyan
$RunKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($Key in $RunKeys) {
    (Get-ItemProperty $Key).PSObject.Properties | Where-Object {
        $_.Value -match 'Grape\.exe|UltraToollite|draw\.io|powershell.*-enc|FromBase64String'
    } | ForEach-Object {
        $Findings += [PSCustomObject]@{
            Type = 'RunKey'; Path = "$Key :: $($_.Name) = $($_.Value)"; SHA256 = ''; KnownBad = $true; LastWrite = ''
        }
    }
}
Get-ScheduledTask | Where-Object {
    ($_.Actions.Execute -match 'powershell|pwsh') -and
    (($_.Actions.Arguments -match '-enc|-bxor|vercel|dorenzaa|DownloadFile|Expand-Archive'))
} | ForEach-Object {
    $Findings += [PSCustomObject]@{
        Type = 'ScheduledTask'; Path = "$($_.TaskName) :: $($_.Actions.Execute) $($_.Actions.Arguments)"
        SHA256 = ''; KnownBad = $true; LastWrite = ''
    }
}

# --- Report ---
Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Yellow
if ($Findings.Count -eq 0) {
    Write-Host "[+] No indicators found. Endpoint appears clean for this campaign." -ForegroundColor Green
} else {
    $Findings | Format-Table -AutoSize
    $Findings | Export-Csv -Path ".\Loader_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "[!] $($Findings.Count) finding(s) — results exported to CSV. Escalate to IR." -ForegroundColor Red
}