11 minhigh
CNCMachineRMS: The Undocumented RAT At the End of a BabaDeda Chain
An investigation traced a loader chain beginning with a ClickFix lure through a legitimately signed IBM SPSS IDE binary used for DLL sideloading, four decoy DLLs, and EnumTimeFormatsEx callback abuse for shellcode execution. The final payload is CNCMachineRMS, a 1.14 MB x64 remote administration implant with no static imports, stack-built strings, a custom binary container format for config and C2, and a custom scripting language. The implant provides an interactive shell, file manager, screen capture, local account backdoor, seven persistence mechanisms, and twenty commands for staging additional payloads. C2 communication uses DNS over HTTPS to bypass internal DNS monitoring and beacons every 600 seconds to notepadreleased.com or 85.158.110.78 over TCP/443.
Sens:▲ 24h
Showing defanged values
- domainnotepadreleased[.]comPrimary C2 domain for CNCMachineRMS implant, contacted over TCP/443 with beacon interval of 600 seconds
- filename%LOCALAPPDATA%\SProject\sp.binState database file containing hostname, port, and two flags, padded with random data between 512 KiB and 16 MiB, hash changes roughly every 200 seconds
- filename%TEMP%\CNCMachineRMS\tasks\*\task_payload.binTask payload storage path used by CNCMachineRMS for staging and running additional payloads
- ip85[.]158[.]110[.]78Fallback C2 IP address for CNCMachineRMS implant, contacted over TCP/443
- registry_keyHKCU\Software\Microsoft\Windows\CurrentVersion\Run\IBMSPSSWinWrapBasicIDERun key persistence mechanism for CNCMachineRMS implant, value name IBM SPSS WinWrap Basic IDE
- sha2560562c588997fa9961d55c6ab1db2656344324bca8db9ea7b64fe309132b2399fWinWrapIDE.exe, legitimately signed IBM SPSS IDE binary abused for DLL sideloading
- sha2562922837a8d049bf0b51f0f9b27340a377b27dd1912675e2cd82056db83ec7a19Hash of HelperStandardizationApplication.bin, the config file carrying both the DSL orchestration script and the 1.14 MB embedded CNCMachineRMS payload under two obfuscation layers
- sha2563466c3524f13cb3b7c87819e619bdb482ec9034a57bcdbe0240af6a9a530b02aComPDFKit.Viewer.dll, decoy DLL in the sideloading chain
- sha2563b9b86feb3b789dda9cdfe5425ccb7e1feae9fde2cc158ff962991218a98f53fmodel.dat, 1.2 MB raw shellcode file loaded by the last decoy DLL for BabaDeda stage execution
- sha2563d4e7187f74de912f9d52f5ba6a95bd41868348b16583d72957d732c0ed8f0e7ClLoca.dll, decoy DLL loaded through normal import resolution in the sideloading chain
- sha2565b71b49bad415643ff3e291ee3ba550e5edfd584eb913859dadb81634450e7e7Hash of wwide9.dll, the malicious sideloaded DLL activated through COM scripting engine of WinWrapIDE.exe
- sha256744b8165b6161cbd1d5ecc423ecfdb8306485afdc80262000ab3c6908881ef9eHash of BabaDeda shellcode stage extracted from model.dat, never touches disk, listed for memory carving
- sha256b804b9dd2726e69fb4f496a6872f90edf9146ad8044c6d3a592040ce1074a5d0Xceed.Wpf.DataGrid.dll, decoy DLL that allocates buffer with random noise and writes shellcode for EnumTimeFormatsEx callback execution
- sha256bb81786286be437b3ec6d562055767097c9277054e1d09172caa96376451481cHash of CNCMachineRMS payload embedded in config file, never touches disk, listed for memory carving
Detection / Hunteropenrouter
What Happened
A previously unknown remote access tool called CNCMachineRMS was discovered at the end of a multi-stage attack chain. The attack starts with a fake verification prompt (called ClickFix) that tricks a user into running malicious code. The chain then uses a legitimate, digitally signed IBM software program as a disguise to load malicious components without raising suspicion. The final malware gives the attacker full remote control of the computer, including the ability to create hidden user accounts, install persistent backdoors, capture screenshots, and download additional malicious software. The malware communicates with its control servers using encrypted channels that blend in with normal web traffic, making it hard to detect with standard network monitoring. Organizations should search their systems for the specific files, network addresses, and behavioral indicators described in the report, and treat any discovery as evidence of active hands-on attacker access.
Key Takeaways
- CNCMachineRMS is an undocumented x64 RAT with 20 commands, 7 persistence mechanisms, a local account backdoor, and a custom scripting language, delivered via a ClickFix lure through a BabaDeda loader chain
- The loader chain abuses a legitimately signed IBM SPSS IDE (WinWrapIDE.exe) for DLL sideloading, followed by four decoy DLLs that load through normal import resolution with no suspicious API calls
- Shellcode execution is achieved via EnumTimeFormatsEx callback abuse, where the last decoy DLL allocates a buffer filled with random noise and writes shellcode into the middle to defeat signatures
- The implant uses DNS over HTTPS through dns.google, cloudflare-dns.com, and dns.quad9.net for C2 resolution, making internal DNS resolver logs ineffective
- The malware's behavior is driven by a custom scripting language stored in the config file with namespaces like delayer::, runtime::, autoruns::, and communicator::, allowing per-campaign changes without recompilation
Affected Systems
- Windows x64 systems
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: ClickFix lure delivers the initial loader payload to the victim
- Execution: Legitimately signed WinWrapIDE.exe is launched and activates its COM scripting engine, pointed at dropped wwide9.dll
- Defense Evasion: Four decoy DLLs load through normal import resolution with no suspicious API calls; the last decoy allocates a buffer filled with random noise and writes shellcode into the middle
- Execution: Shellcode is executed via EnumTimeFormatsEx callback abuse, invoking the BabaDeda stage without directly calling the entry point
- Configuration: BabaDeda loads HelperStandardizationApplication.bin, a config tree under two obfuscation layers containing a DSL script and the 1.14 MB CNCMachineRMS payload
- C2 and Persistence: CNCMachineRMS beacons every 600 seconds to notepadreleased.com or 85.158.110.78 over TCP/443, using DoH for DNS resolution, and establishes persistence via Run key and scheduled tasks
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article references a full technical PDF writeup that includes the config format, a working decoder, the complete command set, and reverse engineering details. No YARA, Sigma, Snort, Suricata, KQL, SPL, or EQL rules are provided in the article text itself.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The sideloading chain uses a legitimately signed binary which may not trigger application whitelisting. However, the EnumTimeFormatsEx callback with executable memory allocation, local account creation via NetUserAdd, and scheduled task creation with ONLOGON as SYSTEM are behaviors that EDR products can capture if configured to log API callbacks and process telemetry. |
| Network Visibility | Low | The implant uses DNS over HTTPS through public resolvers, so internal DNS logs will show nothing. C2 traffic uses TCP/443 with a custom binary container format that blends with normal HTTPS traffic. NetFlow or proxy logs may show the beacon pattern of every 600 seconds but the content is not standard HTTP. |
| Detection Difficulty | Hard | Multiple evasion layers including signed binary abuse, callback-based shellcode execution, random noise padding in shellcode buffers, DoH for DNS resolution, custom binary C2 protocol, and stack-built strings with no static imports make signature-based detection ineffective. Behavioral detection requires correlating multiple low-level signals across process, memory, and network telemetry. |
Required Log Sources
- Sysmon Event ID 1 (Process Creation)
- Sysmon Event ID 7 (Image Loaded)
- Sysmon Event ID 8 (CreateRemoteThread)
- Sysmon Event ID 10 (ProcessAccess)
- Sysmon Event ID 11 (FileCreate)
- Windows Security Event ID 4720 (User Account Creation)
- Windows Security Event ID 4732 (Member Added to Security-Enabled Local Group)
- Scheduled Task operational logs (Microsoft-Windows-TaskScheduler/Operational)
- EDR API call telemetry including EnumTimeFormatsEx invocations
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for WinWrapIDE.exe executing from non-standard directories or spawning from unusual parent processes, as this signed binary is being abused for DLL sideloading (T1574.001). | Sysmon Event ID 1 (process creation) and Event ID 7 (image loaded), EDR process telemetry | Execution | Medium - WinWrapIDE.exe may legitimately exist on systems with IBM SPSS installed; focus on execution path and parent process context. |
| Consider hunting for processes that allocate executable memory and then invoke EnumTimeFormatsEx with a callback parameter pointing into that newly allocated region, as this is an API abuse pattern for shellcode execution (T1055). | EDR API call telemetry, Sysmon Event ID 8, memory allocation monitoring | Execution | Low - EnumTimeFormatsEx with callback into executable memory is an unusual pattern not typically seen in legitimate software. |
| Consider hunting for creation of local user accounts followed by addition to privileged groups, particularly when performed by processes not associated with account management utilities (T1136.001, T1098). | Windows Security Event IDs 4720 and 4732, EDR process telemetry | Persistence | Medium - Account creation can be legitimate in environments with automated provisioning; correlate with process context. |
| Consider hunting for scheduled tasks configured with ONLOGON trigger running as SYSTEM with HIGHEST privileges, especially those with names referencing IBM SPSS or WinWrap (T1053.005). | Microsoft-Windows-TaskScheduler/Operational logs, EDR process telemetry | Persistence | Low to Medium - ONLOGON tasks running as SYSTEM exist in enterprise environments but the specific naming pattern is distinctive. |
| Consider hunting for processes making DNS-over-HTTPS requests to known DoH providers followed by outbound TCP/443 connections on a regular beacon interval, as the implant uses DoH to bypass internal DNS monitoring (T1071.001). | Network proxy logs, firewall logs, EDR network telemetry, TLS metadata | Command and Control | High - DoH usage is increasingly common in legitimate applications and browsers; focus on beacon timing patterns and destination IP reputation. |
Control Gaps
- Internal DNS resolver logs will not capture C2 domain resolution due to DoH usage through public resolvers
- Traditional signature-based AV may miss the payload due to random noise padding in shellcode buffers and stack-built strings with no static imports
- DLL sideloading via legitimately signed binary may bypass application whitelisting controls that trust signed executables
- Custom binary C2 protocol over TCP/443 may not be detected by network signature-based IDS or standard HTTPS inspection
- The implant finds its own embedded config by scanning memory forward from a dummy function address, leaving no hardcoded offset or magic value to grep for
Key Behavioral Indicators
- WinWrapIDE.exe executing from non-standard directories or with unusual parent process ancestry
- EnumTimeFormatsEx API called with callback parameter pointing to newly allocated executable memory region
- Creation of C:\Intel directory by non-Intel software or installer processes
- Presence of %LOCALAPPDATA%\SProject\sp.bin file with high entropy and variable size between 512 KiB and 16 MiB
- Scheduled task named 'IBM SPSS WinWrap Basic IDE' with ONLOGON trigger running as SYSTEM
- Local account creation followed by addition to privileged groups within a short time window
- Multiple DLLs loaded from the same directory as WinWrapIDE.exe including wwide9.dll, ClLoca.dll, Xceed.Wpf.DataGrid.dll, and ComPDFKit.Viewer.dll
- Regular outbound TCP/443 connections every 600 seconds with 60 second retry on failure
False Positive Assessment
Medium - Individual indicators such as the C:\Intel directory or scheduled task names could appear in legitimate contexts. However, the combination of WinWrapIDE.exe executing from non-standard locations, EnumTimeFormatsEx callback into executable memory, local account creation, and the specific file artifacts creates a distinctive detection pattern with reduced false positive risk when correlated.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. If CNCMachineRMS is identified on a host, consider isolating the system immediately and treating follow-on payloads as the primary incident scope, as the implant provides hands-on keyboard access.
- Consider searching endpoint telemetry and file repositories for the provided SHA256 hashes, particularly wwide9.dll and HelperStandardizationApplication.bin, to identify additional compromised hosts.
- If your EDR supports host isolation, consider isolating affected hosts to prevent C2 communication while investigation proceeds.
- Consider reviewing Windows Security Event IDs 4720 and 4732 for local account creation and privilege group additions that may indicate the local account backdoor mechanism.
Infrastructure Hardening
- Evaluate whether blocking the C2 domain notepadreleased.com and IP 85.158.110.78 at network perimeter controls would be feasible without business disruption.
- Consider implementing DNS filtering or proxy-based controls to monitor or restrict DNS-over-HTTPS traffic to known DoH providers if this aligns with your network security posture.
- Evaluate whether application control solutions can detect DLL sideloading scenarios involving legitimately signed binaries like WinWrapIDE.exe loading DLLs from unexpected directories.
- Consider deploying network behavioral analytics to detect regular beacon patterns on TCP/443 with 600-second intervals.
User Protection
- Consider deploying endpoint detection rules for EnumTimeFormatsEx callback abuse, where the callback parameter points to newly allocated executable memory regions.
- If supported by your EDR, consider enabling behavioral detection for local account creation by processes not associated with standard account management utilities.
- Evaluate whether your endpoint logging captures scheduled task creation with ONLOGON triggers running as SYSTEM with HIGHEST privileges.
- Consider monitoring for creation of C:\Intel directory by non-Intel processes as a potential VM check bypass indicator.
Security Awareness
- Consider reinforcing awareness training around ClickFix social engineering lures, which prompt users to execute commands or scripts under the guise of verification or captcha completion.
- If applicable to your awareness program, consider highlighting the risk of executing seemingly legitimate signed binaries from untrusted or unexpected locations.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping15 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Discovery
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- File Hashes:
0562c588997fa9961d55c6ab1db2656344324bca8db9ea7b64fe309132b2399f(SHA256) - WinWrapIDE.exe, legitimately signed IBM SPSS IDE binary abused for DLL sideloading3d4e7187f74de912f9d52f5ba6a95bd41868348b16583d72957d732c0ed8f0e7(SHA256) - ClLoca.dll, decoy DLL loaded through normal import resolution in the sideloading chainb804b9dd2726e69fb4f496a6872f90edf9146ad8044c6d3a592040ce1074a5d0(SHA256) - Xceed.Wpf.DataGrid.dll, decoy DLL that allocates buffer with random noise and writes shellcode for EnumTimeFormatsEx callback execution3466c3524f13cb3b7c87819e619bdb482ec9034a57bcdbe0240af6a9a530b02a(SHA256) - ComPDFKit.Viewer.dll, decoy DLL in the sideloading chain3b9b86feb3b789dda9cdfe5425ccb7e1feae9fde2cc158ff962991218a98f53f(SHA256) - model.dat, 1.2 MB raw shellcode file loaded by the last decoy DLL for BabaDeda stage execution
- Registry Keys:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IBM SPSS WinWrap Basic IDE- Run key persistence mechanism for CNCMachineRMS implant, value name IBM SPSS WinWrap Basic IDE
- File Paths:
%TEMP%\CNCMachineRMS\tasks\*\task_payload.bin- Task payload storage path used by CNCMachineRMS for staging and running additional payloads%LOCALAPPDATA%\SProject\sp.bin- State database file containing hostname, port, and two flags, padded with random data between 512 KiB and 16 MiB, hash changes roughly every 200 seconds
- Command Lines:
- Purpose: Persistence via scheduled task creation on user logon running as SYSTEM with highest privileges | Tools:
schtasks.exe| Stage: Persistence |schtasks /create /SC ONLOGON /RU SYSTEM /F /RL HIGHEST
- Purpose: Persistence via scheduled task creation on user logon running as SYSTEM with highest privileges | Tools: