TASK#STOMP PowerShell Backdoor Steals Documents and Enables Remote Access
Summary
Securonix researchers analyzed TASK#STOMP, a Windows backdoor using VBS, scheduled tasks, and hidden PowerShell to persist, steal documents and credentials, capture screenshots and clipboard data, and execute remote commands through redundant C2 servers.
Key points
- A VBScript installer creates four XML-based scheduled tasks and a Startup-folder launcher for redundant persistence.
- The malware stages files under a service-like AppData directory, backdates artifacts, and runs two hidden PowerShell modules.
- Decoded payloads scan fixed drives for recent business documents, upload them, and monitor for new or changed files.
- The backdoor can steal saved Wi-Fi passwords and clipboard contents, capture screenshots, collect system information, and execute arbitrary PowerShell commands.
- Two token-authenticated C2 domains provide failover; the modules compile C# helpers at runtime to disable TLS certificate validation.
- The initial access vector remains unknown; investigators would need endpoint, browser, email, and file-origin evidence to determine delivery.
- Securonix recommends correlating script-hosted task creation, hidden PowerShell, Base64 decoding, compiler activity, timestomping, and C2 traffic.
Article Details
- Attack Vectors
- The observed chain begins with a randomly named VBScript, but the article does not establish how it reached the endpoint or whether the user executed it directly.
- The VBScript creates four XML-defined scheduled tasks and places msdiag.vbs in the current user's Startup folder for redundant persistence.
- Hidden PowerShell scripts decode Base64 payloads from local .dat files, execute the decoded scripts in memory, and compile C# helpers at runtime.
- The backdoor collects business documents, monitors fixed drives for new or modified files, and uploads matching files to its C2 servers.
- The backdoor polls its C2 servers for commands and can execute arbitrary PowerShell commands, capture screenshots, steal Wi-Fi passwords, and collect clipboard contents.
- Defensive Notes
- Correlate script-hosted scheduled-task creation from user-writable paths with hidden PowerShell execution, Base64 decoding, runtime compilation, timestamp changes, and repeated Startup-folder execution.
- Recover and preserve the scheduled-task XML files, staged scripts and data files, purge.bat, relevant PowerShell logs, AMSI telemetry, and compiler artifacts during investigation.
- Monitor for PowerShell reading diag_pack.dat or win_conn_cfg.dat, spawning csc.exe, setting LastWriteTime, or using netsh to reveal saved Wi-Fi keys.
- Monitor and block the confirmed C2 domains; correlate network requests with the X-Auth-Token header and the reported API paths.
- Remove the Startup-folder copy, scheduled tasks, staged files, and active script processes together, then verify after reboot that the components do not return.
- The Chrome URL is described as an investigative indicator, but the article does not establish that the page or parent domain is malicious.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | attachmentsharingdrive[.]xyz | Backup attacker-controlled C2 domain used for failover by both decoded modules. |
| DOMAIN | corecloudfileshare[.]xyz | Primary attacker-controlled C2 domain used by both decoded modules. |
| SHA256 | 02ba7c982b68ec8f5a1cb47c6f3969f3f2f38ea9b4ebb8833d1b8b0ba2ab1407 | Hash listed for diag_pack.dat, the decoded document-theft and backdoor payload. |
| SHA256 | 103b4d4a666bc0a89c10c9df55f54f4be5fa111e8429c37ae14fa8f16cb50fe8 | Hash listed for the analyzed sys_loader.ps1 payload loader. |
| SHA256 | 335d19f4e757e0c36c9ef1cb4638e151aac041b7814e3eb8bda6f78ff7011f32 | Hash listed for the analyzed task4.xml persistence artifact. |
| SHA256 | 41231e7f5db49055dbe4246462e60077a67b1845696df3947eb1121fe392947f | Hash listed for win_conn_cfg.dat, the decoded secondary C2 payload. |
| SHA256 | 5251098838fab2f3192307cac99ad2d3a71b55ba1f256412d43a9dfb3b93ac58 | Hash listed for the analyzed 95c9050t66.vbs and msdiag.vbs artifacts. |
| SHA256 | 7a9e7b4c2f75f7de03838f5c9589148cdbefb76200ea3cf2d6f1a2288c302493 | Hash listed for the analyzed task.xml persistence artifact. |
| SHA256 | 8f448080cec5cba2f0ba6a960bc3425a2d99a6767464f581d13476985eaa4a2e | Hash listed for the analyzed win_conn.ps1 payload loader. |
| SHA256 | bd200756b4e996a6e7cc63036aa760f9585f252c55a60cab12f29e389b96e0ef | Hash listed for the analyzed purge.bat artifact in the malware execution chain. |
| SHA256 | e46111264ebd91e80bbad85141d254930354faa0f15d3bbfaf4826adf5a53c8d | Hash listed for the analyzed task3.xml persistence artifact. |
| SHA256 | ff12c194128d0733434ce1580691bfde5896f14ba9f360c0f6c3a622eed24312 | Hash listed for the analyzed task2.xml persistence artifact. |
MITRE ATT&CK
T1005 · Data from Local SystemThe payload collects files with targeted document and archive extensions from local fixed drives.T1016 · System Network Configuration DiscoveryThe payload obtains public and local IP information and reports network details during victim registration.T1027.004 · Compile After DeliveryPowerShell uses Add-Type to compile C# helpers at runtime through csc.exe and cvtres.exe.T1036.005 · Match Legitimate Resource Name or LocationThe WinDefendSvc staging-folder name and rotating service-like task names imitate trusted Windows components.T1041 · Exfiltration Over C2 ChannelThe backdoor uploads collected documents to the same C2 servers over its command-and-control channel.T1053.005 · Scheduled TaskThe installer creates four XML-defined scheduled tasks for persistence.T1057 · Process DiscoveryPowerShell queries Win32_Process and inspects command lines for existing sys_loader or win_conn instances.T1059.001 · PowerShellHidden PowerShell commands and the sys_loader.ps1 and win_conn.ps1 modules execute the payloads and remote commands.T1059.003 · Windows Command Shellcmd.exe launches purge.bat after the PowerShell payload branches start.T1059.005 · Visual Basicwscript.exe executes the desktop VBScript and the persistent msdiag.vbs script.T1070.006 · TimestompPowerShell sets LastWriteTime on five staged artifacts to 2024-01-15 08:30:00.T1071.001 · Web ProtocolsThe modules use HTTP(S) polling, status checks, and heartbeats to communicate with the two C2 domains.T1082 · System Information DiscoveryThe sysinfo command reports operating-system, CPU, RAM, disk, and uptime details.T1113 · Screen CaptureThe backdoor captures the primary display on command and uploads the screenshot.T1115 · Clipboard DataThe backdoor reads clipboard text, uploads it, and clears the clipboard.T1119 · Automated Collectiondiag_pack.dat automatically scans fixed drives for selected documents and archives for collection and upload.T1547.001 · Registry Run Keys / Startup FolderThe installer places msdiag.vbs in the current user's Startup folder.T1552.001 · Credentials In FilesThe payload runs netsh wlan commands with key=clear to retrieve saved Wi-Fi passwords.
People
Malware
Products
.NET FrameworkEach PowerShell branch invokes the legitimate .NET Framework C# compiler, which subsequently launches cvtres.exe to process temporary resource files:Google ChromeThe initial VBS launches Google Chrome in a maximized window and supplies a single URL as an argument:Microsoft WindowsSecuronix Threat Research analyzed a script-driven Windows execution chain that begins with a desktop VBScript and deploys a redundant persistence framework under %LOCALAPPDATA%\WinDefendSvc.PowerShellVBS-PowerShell Backdoor Using Rotating Scheduled Tasks, Timestomping, and Runtime C# Compilation for Document Theft and Remote Access: