From Phishing to Persistence: A CrySome RAT Infection Chain Analysis

MITRE Techniques

• [T1566.002 ] Phishing: Spearphishing Link – The victim received a logistics-themed lure that directed them to a fake document portal (‘the email impersonated a legitimate freight rate confirmation and directed the recipient to hxxps://signindat[.]com’).
• [T1204.002 ] User Execution: Malicious File – The user was tricked into downloading and running the batch file (‘Clicking Download Rate Confirmation does not deliver a PDF as expected. Instead, the site downloads a batch file’).
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – PowerShell was used with hidden windows, execution-policy bypass, in-memory execution, and payload staging (‘launches a hidden PowerShell process with -ExecutionPolicy Bypass’, ‘executes it in memory using IEX’).
• [T1548.002 ] Abuse Elevation Control Mechanism: Bypass User Account Control – The loader attempted privilege escalation using ICMLuaUtil (‘attempts privilege elevation using the ICMLuaUtil UAC bypass technique’).
• [T1562.001 ] Impair Defenses – The actor patched AMSI, added Defender exclusions, and ran WinDefCtl/AVKiller to weaken endpoint security (‘patches AMSI in memory’, ‘adds Microsoft Defender exclusions’, ‘used to weaken Microsoft Defender’).
• [T1036.005 ] Masquerading: Match Legitimate Name or Location – The attacker renamed update.exe to svchost.exe and ran it from a user-writable temp folder (‘saved as %TEMP%svchost.exe’, ‘execution from %TEMP% is anomalous’).
• [T1105 ] Ingress Tool Transfer – Multiple payloads and the decoy PDF were downloaded from attacker-controlled infrastructure (‘downloads the next-stage payload’, ‘downloads update.exe’, ‘downloads the primary payload’, ‘downloads a legitimate-looking freight rate confirmation PDF’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – Persistence was achieved by creating a recurring scheduled task (‘creates a scheduled task named CrysomeLoader’, ‘execute the current client executable every five minutes’).
• [T1546.012 ] Event Triggered Execution: Image File Execution Options Injection – WinDefCtl used IFEO manipulation as part of Defender interference (‘leverages Image File Execution Options (IFEO) manipulation’).
• [T1055 ] Process Injection – The credential module injected abe_decrypt.dll into browser processes (‘injects abe_decrypt.dll’, ‘into Chromium-based browser processes’).
• [T1555.003 ] Credentials from Password Stores: Credentials from Web Browsers – Stored browser credentials and cookies were extracted (‘retrieving decrypted passwords.json and cookies.json files’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – The malware used HTTP(S) to retrieve staged payloads and connect to infrastructure (‘downloads stage.ps1 from the attacker-controlled infrastructure’, ‘C2 endpoint (193.26.115[.]42:5555)’).
• [T1219 ] Remote Access Software – CrySome RAT provided persistent remote access and operator control (‘features including HVNC, remote command execution, system reconnaissance, and credential theft’).