CNCMachineRMS: The Undocumented RAT At the End of a BabaDeda Chain

MITRE Techniques

• [T1218.009 ] Signed Binary Proxy Execution: WinRAR/Self-Extracting Archives – Abusing a legitimately signed IBM SPSS IDE binary to activate the attack chain (‘a legitimately signed IBM SPSS IDE, WinWrapIDE.exe, is launched’).
• [T1055 ] Process Injection – Shellcode is written into memory and executed in-process through a benign callback path (‘writes shellcode into the middle of it, and marks it executable’).
• [T1202 ] Indirect Command Execution – The malware is triggered through EnumTimeFormatsEx instead of a direct malicious call path (‘Windows calls the malware on the attacker’s behalf’).
• [T1027 ] Obfuscated Files or Information – The config, state database, and payload use layered obfuscation and high-entropy random-looking data (‘looks like an encrypted blob’, ‘under two layers of obfuscation’).
• [T1027.002 ] Software Packing – The embedded payload and config are concealed in packed/serialized containers rather than plain binary structures (‘the config and its command and control (C2) traffic travel in the same custom binary container’).
• [T1059 ] Command and Scripting Interpreter – The implant runs behavior through its own custom scripting language (‘driven by a custom scripting language the author wrote’).
• [T1105 ] Ingress Tool Transfer – The operator can stage and run additional payloads through typed commands (‘twenty typed commands for pulling down and running further payloads’).
• [T1068 ] Exploitation for Privilege Escalation – The implant creates local accounts and adds them to privileged groups (‘It creates local accounts and adds them to privileged groups’).
• [T1547.001 ] Registry Run Keys / Startup Folder – Persistence via a Run key is explicitly described (‘A Run key or scheduled task named IBM SPSS WinWrap Basic IDE’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – Persistence is also established with scheduled tasks (‘Scheduled tasks created with /SC ONLOGON /RU SYSTEM /F /RL HIGHEST’).
• [T1010 ] Application Window Discovery – A screenshot is taken on first contact, indicating host interaction and reconnaissance (‘It takes a screenshot on first contact’).
• [T1087.001 ] Account Discovery: Local Account – The host profile and backdoor actions involve local account context (‘Domain, SID, and elevation status’, ‘Creates local accounts’).