LevelBlue Details CrySome RAT Infection Chain Involving Phishing and Defender Tampering
Summary
LevelBlue says it contained an intrusion that began with a logistics-themed phishing lure. Its analysis traces staged PowerShell, a UAC bypass, Defender tampering with WinDefCtl, and CrySome RAT persistence and browser-credential theft.
Key points
- LevelBlue reports that a logistics-themed spear-phishing email led the recipient to a fake rate-confirmation portal at signindat[.]com, which delivered a batch file.
- The batch file launched hidden PowerShell with execution-policy bypass, patched AMSI in memory, and downloaded the first-stage loader.
- The loader attempted a UAC bypass through ICMLuaUtil, then retrieved and executed a PowerShell stage in memory.
- The PowerShell stage added Microsoft Defender exclusions and deployed WinDefCtl as svchost.exe from %TEMP%; the utility used IFEO manipulation and kvckiller.sys to interfere with Defender.
- CrySome RAT established persistence with a scheduled task configured to run every five minutes and provided remote access and command-execution capabilities.
- The credential-theft module targeted Chromium-based browsers, injecting abe_decrypt.dll and extracting stored passwords and session cookies for exfiltration.
- LevelBlue recommends monitoring hidden PowerShell execution, Defender configuration and IFEO changes, suspicious executables in temporary directories, scheduled tasks, and browser credential-theft artifacts.
Article Details
- Attack Vectors
- A logistics-themed spear-phishing email directed the recipient to a fake rate-confirmation portal on signindat[.]com.
- The downloaded batch file launched hidden PowerShell with execution-policy bypass, patched AMSI in memory, and retrieved the first-stage loader.
- ElevatorShellCode.exe attempted a UAC bypass using ICMLuaUtil, then downloaded and executed stage.ps1 in memory.
- The second-stage script added Microsoft Defender exclusions and deployed WinDefCtl, which used IFEO changes and kvckiller.sys to interfere with Defender.
- CrySome RAT established persistence with a scheduled task and provided remote command execution and other remote-access capabilities.
- The RAT injected abe_decrypt.dll into Chromium-based browser processes to collect stored passwords and cookies for exfiltration.
- Defensive Notes
- Monitor for hidden PowerShell using -ExecutionPolicy Bypass or in-memory execution, especially when followed by downloads or child-process creation.
- Alert on Microsoft Defender exclusions and configuration changes, including Add-MpPreference, Set-MpPreference, and IFEO registry modifications.
- Investigate executables launched from user-writable temporary directories, especially binaries named svchost.exe, and scheduled tasks that run payloads from those directories.
- Monitor for outbound connections to the reported malicious infrastructure and staged payload downloads.
- Investigate browser process termination followed by abe_decrypt.dll, passwords.json, or cookies.json creation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | signindat[.]com | Attacker-controlled phishing portal and payload-hosting domain used in the CrySome RAT infection chain. |
loadofferstender@gmail[.]com | Sender address used for the logistics-themed phishing lure. | |
| IPV4 | 193[.]26[.]115[.]42 | CrySome RAT command-and-control server; the article reports port 5555. |
| SHA256 | 53f1da8a032115aa682749a114f4cfebcb5ef933400a89b4bbfa84f2057222ff | SHA-256 hash of the first-stage loader ElevatorShellCode.exe. |
| SHA256 | b7ca8fd9ebe0a76f16deea315fac7ee94dcb18e6ac2832b5c4cb562fbc6e0ed3 | SHA-256 hash of update.exe, identified as the WinDefCtl utility used to interfere with Defender. |
| SHA256 | c380268d493e0cba914ce2bc55faa1d7c050c599893c3196fee01fa745e6466a | SHA-256 hash of patch.exe, identified as the CrySome RAT payload. |
| SHA256 | ced4407f4ac7e43c1a3010a394d111d2ad1b50a2e95668b4e9cfe739235e67bd | SHA-256 hash of the second-stage script stage.ps1. |
| SHA256 | ec68666e8f0a3b9870d7177bab684c8dcfb8ca0bc7c8c484a71b2b33ea4e26f4 | SHA-256 hash of the phishing batch file Rate_Confirmation_LD-2026-0847.bat. |
| SHA256 | ff5dbdcf6d7ae5d97b6f3ef412df0b977ba4a844c45b30ca78c0eeb2653d69a8 | SHA-256 hash of kvckiller.sys, the driver used by WinDefCtl to interfere with security processes. |
| URL | hxxps[:]//signindat[.]com/ElevatorShellCode.exe | Attacker-hosted URL used to deliver the first-stage loader. |
| URL | hxxps[:]//signindat[.]com/patch.exe | Attacker-hosted URL used to deliver the CrySome RAT payload. |
| URL | hxxps[:]//signindat[.]com/stage.ps1 | Attacker-hosted URL used to deliver the second-stage PowerShell script. |
| URL | hxxps[:]//signindat[.]com/update.exe | Attacker-hosted URL used to deliver WinDefCtl for Defender interference. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe downloaded update.exe was renamed svchost.exe and executed from the user-writable %TEMP% directory.T1053.005 · Scheduled TaskCrySome RAT created the CrysomeLoader scheduled task to relaunch the client every five minutes.T1055 · Process InjectionThe credential-theft module injected abe_decrypt.dll into Chromium-based browser processes.T1059.001 · PowerShellHidden PowerShell with execution-policy bypass was used to stage, download, and execute payloads, including in memory.T1071.001 · Web ProtocolsHTTP(S) was used to retrieve staged payloads and communicate with the reported C2 endpoint.T1105 · Ingress Tool TransferThe infection chain downloaded ElevatorShellCode.exe, stage.ps1, update.exe, and patch.exe from attacker-controlled infrastructure.T1204.002 · Malicious FileThe recipient was induced to download and run the Rate_Confirmation_LD-2026-0847.bat file.T1219 · Remote Access ToolsCrySome RAT provided persistent remote access, including remote command execution and HVNC capabilities.T1546.012 · Image File Execution Options InjectionWinDefCtl modified IFEO Debugger entries as part of its interference with security software.T1548.002 · Bypass User Account ControlElevatorShellCode.exe attempted privilege elevation through an ICMLuaUtil UAC bypass.T1555.003 · Credentials from Web BrowsersThe RAT extracted stored browser passwords and cookies from Chromium-based browsers.T1562.001 · Disable or Modify ToolsThe chain patched AMSI, added Microsoft Defender exclusions, and used WinDefCtl and the RAT's AVKiller component to weaken defenses.T1566.002 · Spearphishing LinkA logistics-themed spear-phishing email linked the recipient to a fake rate-confirmation portal.
People
Malware
Products
BraveCredential collection is implemented through a dedicated browser credential handler targeting Chromium-based browsers including Chrome, Microsoft Edge, and Brave.Google ChromeCredential collection is implemented through a dedicated browser credential handler targeting Chromium-based browsers including Chrome, Microsoft Edge, and Brave.Microsoft Defender Antimalware PlatformThe second-stage PowerShell script created logs, added Microsoft Defender exclusions, deployed WinDefCtl, and launched the final payload.Microsoft EdgeCredential collection is implemented through a dedicated browser credential handler targeting Chromium-based browsers including Chrome, Microsoft Edge, and Brave.