Full Report
Think all threat actors are pros? This post reveals how 'unsophisticated' malware and attacker errors help defenders stop attacks before damage is done.
Analysis Summary
# Tool/Technique: Golang Trojan (agent.exe) and Vulnerability Exploitation
## Overview
This report analyzes a series of attacks characterized by "unsophisticated" execution, where threat actors relied on trial-and-error, reacted to security software stimuli, and committed operational errors (typos). The primary goal of the actor was to establish persistence on Windows endpoints via web application exploits to deploy a Golang-based Trojan.
## Technical Details
- **Type:** Malware family (Golang Trojan) / Technique (Web Exploitation)
- **Platform:** Windows (specifically environments running IIS `w3wp.exe`)
- **Capabilities:** Command execution, persistence establishment, remote access.
- **First Seen:** November 6, 2025 (as referenced in the recent incident series).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1190 - Exploit Public-Facing Application (IIS Web Server)
- **TA0002 - Execution**
- T1059.003 - Command and Scripting Interpreter: Windows Command Shell
- **TA0003 - Persistence**
- T1505.003 - Server Software Component: Web Shell (Attempted/Simulated)
- T1053.005 - Scheduled Task/Job: Scheduled Task
- **TA0005 - Defense Evasion**
- T1562.001 - Impair Defenses: Disable or Modify Tools (Reactions to Windows Defender)
- **TA0007 - Discovery**
- T1033 - System Owner/User Discovery (`whoami`)
## Functionality
### Core Capabilities
- **Web-to-Shell Execution:** Leveraging flaws in web application code to execute system commands via the `w3wp.exe` process.
- **Trojan Deployment:** Downloading and executing a Golang-compiled binary (`agent.exe`) for command and control.
- **Environment Reconnaissance:** Basic use of `whoami.exe` to verify privilege levels after initial exploitation.
### Advanced Features
- **Dynamic Adaptation:** The actor demonstrates a "trial-and-error" approach, adjusting commands and tools (like attempting to use Cloudflare tunnels or OpenSSH) when initial persistence mechanisms fail or are blocked by EDR.
- **Golang Cross-Platform Potential:** Use of Go suggests a desire for modularity and easier evasion of simple static signatures.
## Indicators of Compromise
- **File Names:**
- `agent.exe`
- `whoami.exe` (misused in an attack context)
- **Network Indicators:**
- Connections to Cloudflare tunnel infrastructure (used for egress/C2)
- **Behavioral Indicators:**
- `w3wp.exe` spawning `cmd.exe` or `whoami.exe`.
- Repeated failed attempts to install services or scheduled tasks.
- Multiple typos in command-line arguments recorded in Event Logs.
## Associated Threat Actors
- **Warlock Ransomware Group:** Linked via the deployment of Warlock ransomware in similar incidents involving the misuse of the Velociraptor DFIR platform.
## Detection Methods
- **Behavioral Detection:** Monitor for the IIS worker process (`w3wp.exe`) spawning unusual child processes like `cmd.exe`, `powershell.exe`, or reconnaissance tools.
- **Event Log Analysis:** Reviewing Windows Event Logs for "Command Line" entries containing typos or repetitive failure codes, which indicate manual attacker presence.
- **EDR Telemetry:** Detection of Golang-based binaries executing from temporary or web-server-writable directories.
## Mitigation Strategies
- **Vulnerability Management:** Prioritize patching of web applications and IIS server components to prevent command injection.
- **Least Privilege:** Restrict the service account permissions for `w3wp.exe` to prevent it from executing system-level discovery tools or writing to sensitive directories.
- **Endpoint Hardening:** Enable Attack Surface Reduction (ASR) rules to block process creations from Office communication apps or web servers.
## Related Tools/Techniques
- **Velociraptor (Misused):** Used by the same or similar actors for persistence and lateral movement.
- **Cloudflare Tunnels:** Used to bypass firewall restrictions and establish C2.
- **OpenSSH:** Attempted for use as a persistent backdoor.