Full Report
This post is the result of an investigation into a case we worked on, in which we traced a loader chain that ended where we didn't expect.
Analysis Summary
This summary provides an overview of the CNCMachineRMS Remote Access Trojan (RAT) as described in the provided technical investigation.
# Tool/Technique: CNCMachineRMS
## Overview
CNCMachineRMS is an undocumented, highly stealthy Remote Access Trojan (RAT) typically delivered at the end of a complex "BabaDeda" loader chain. It is designed for persistent remote administration, reconnaissance, and the delivery of secondary payloads. It distinguishes itself through its lack of traditional imports, runtime-constructed strings, and a custom scripting language used to drive its operations.
## Technical Details
- **Type:** Malware Family (Remote Access Trojan)
- **Platform:** Windows (x64)
- **Capabilities:** Interactive shell, file management, screen capture, credential/account manipulation, and payload execution.
- **First Seen:** Reported August 2026 (Investigation Date)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link] (ClickFix lures)
- **[TA0002 - Execution]**
- [T1059 - Command and Scripting Interpreter] (Custom scripting language)
- [T1106 - Native API] (Use of `EnumTimeFormatsEx` as a trampoline)
- **[TA0003 - Persistence]**
- [T1136.001 - Create Account: Local Account]
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information] (Stack strings, encrypted config blobs)
- [T1574.002 - Hijack Execution Flow: DLL Side-Loading] (IBM SPSS WinWrapIDE.exe)
- [T1497 - Virtualization/Sandbox Evasion] (Check for `C:\Intel` folder)
- **[TA0009 - Collection]**
- [T1113 - Screen Capture]
## Functionality
### Core Capabilities
- **Remote Shell & File Management:** Provides operators with an interactive command prompt and the ability to manage files on the host.
- **Reconnaissance:** Collects detailed host profiles including Active Directory context (Domain, SID, elevation), hardware serials (BIOS/Motherboard), and security software lists.
- **Payload Delivery:** Features twenty typed commands specifically for downloading and executing follow-on malware stages.
- **Beaconing:** Establishes a regular heartbeat (defaulting to 600 seconds) to its C2 server.
### Advanced Features
- **Custom Scripting Engine:** Uses a proprietary language (with namespaces like `autoruns::` and `runtime::`) to interpret tasks sent by the operator.
- **Trampoline Execution:** Utilizes the `EnumTimeFormatsEx` API to trigger shellcode execution via a callback, bypassing many traditional behavioral triggers.
- **Stealth Construction:** The binary contains no imports and builds every required string on the stack at runtime to evade static analysis.
## Indicators of Compromise
- **File Names:**
- `WinWrapIDE.exe` (Legitimate signed binary used for sideloading)
- `HelperStandardizationApplication.bin` (Obfuscated configuration and payload carrier)
- `CNCMachineRMS` (Internal path string)
- **Registry Keys:** Seven distinct persistence mechanisms are noted (often targeting standard `Run` keys).
- **Network Indicators:** (Defanged)
- C2 traffic travels in custom binary containers.
- **Behavioral Indicators:**
- Creation of a local account added to privileged groups.
- Presence of a folder named `C:\Intel` (used as a "kill switch" for sandbox evasion).
- High-entropy data blobs residing in temporary or application directories.
## Associated Threat Actors
- **BabaDeda:** Known for using the specific loader chain and obfuscation techniques associated with this infection flow.
## Detection Methods
- **Signature-based detection:** While the payload uses random noise to defeat static signatures, the legitimately signed but out-of-context `WinWrapIDE.exe` and associated decoy DLLs can be flagged.
- **Behavioral detection:** Monitor for unusual calls to date-formatting APIs (`EnumTimeFormatsEx`) involving non-standard memory callbacks and the creation of unexpected local administrative accounts.
- **Environmental Hunting:** Scan for the existence of `C:\Intel` folders on systems where they are not natively created by hardware drivers.
## Mitigation Strategies
- **Application Whitelisting:** Prevent the execution of unauthorized binaries, even if signed (like the IBM SPSS IDE), in environments where they are not required.
- **Least Privilege:** Restrict the ability of standard users to create new local accounts or modify administrative groups.
- **Hardening:** Use EDR solutions to monitor for DLL side-loading patterns and unusual COM object registrations.
## Related Tools/Techniques
- **ClickFix:** The social engineering lure used for initial access.
- **BabaDeda Loader:** The primary delivery vehicle for the CNCMachineRMS implant.
- **DLL Side-loading:** The technique used to execute the initial loader via the clean WinWrapIDE binary.