Rapid7 Details ModeloRAT Intrusion Using Teams Lure and CVE-2023-36036
Summary
Rapid7 traces an enterprise intrusion from a fake Teams IT-support message through ModeloRAT deployment and exploitation of CVE-2023-36036. Attackers harvested domain credentials; memory-dump exfiltration was considered likely, not confirmed.
Key points
- Attackers used Microsoft Teams external access and a newly created tenant to impersonate IT support and message a targeted employee.
- A PowerShell stager retrieved a ZIP archive from dropbox[.]com and launched portable Python payloads; the primary C2 agent’s behavior matched ModeloRAT, previously associated with KongTuke-related activity.
- The attackers used reconnaissance modules and WebDAV authentication attempts to test credential reuse; successful logons appeared across more than 100 internal systems.
- A custom exploit for CVE-2023-36036, a heap-based buffer overflow in Windows cldflt.sys, elevated a process to SYSTEM. The attackers then set up a scheduled task and used WinRM and RDP for further access.
- Additional modules provided reverse-shell, tunneling, and SOCKS5 proxy capabilities. A fake Windows lock screen captured a user’s domain password.
- DumpIt was run on a second host to capture physical memory. Based on timing and network activity, Rapid7 assessed that the dump was likely exfiltrated via uploadnow[.]io.
Article Details
- Attack Vectors
- The intrusion began with an external Microsoft Teams message from a newly created tenant impersonating IT Support.
- A hidden PowerShell stager downloaded a ZIP archive from Dropbox and launched portable Python modules, including the ModeloRAT agent.
- The attacker used CVE-2023-36036 against cldflt.sys to elevate privileges to SYSTEM, then established persistence with a SYSTEM-level scheduled task.
- Post-compromise activity included WebDAV credential validation, Active Directory enumeration, and lateral movement using WinRM and RDP.
- A fake Windows lock screen captured a user's domain password; the article says a subsequent memory dump was likely exfiltrated using uploadnow.io.
- Defensive Notes
- Review Microsoft Teams external-access settings and investigate external tenants impersonating IT support.
- Hunt for hidden PowerShell activity, portable Python environments, unexpected ZIP extraction and deletion, and the named intrusion-related scheduled task TempLogA.
- Verify that systems are patched for CVE-2023-36036 and investigate unusual Cloud Files sync-provider registration or activity involving cldflt.sys.
- Monitor unexpected WebDAV authentication attempts and lateral authentication over WinRM and RDP.
- Investigate suspicious lock-screen-like prompts, credential-harvesting DLLs, and DumpIt execution; the reported memory-dump exfiltration via uploadnow.io was assessed as likely, not confirmed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ucicasociacion[.]onmicrosoft[.]com | Newly created attacker-controlled Microsoft 365 tenant used to impersonate IT Support in the Teams message. |
| IPV4 | 104[.]194[.]152[.]246 | SOCKS5 proxy endpoint used by PCDr6967.py to route attacker tools through the victim. |
| IPV4 | 140[.]82[.]6[.]45 | Hardcoded ModeloRAT command-and-control server used for its HTTP beacon. |
| IPV4 | 144[.]172[.]111[.]49 | SOCKS5 proxy endpoint used by PCDr6967.py to route attacker tools through the victim. |
| IPV4 | 144[.]172[.]88[.]18 | Hardcoded endpoint for the malware's TCP reverse shell and file-transfer sockets. |
| IPV4 | 144[.]172[.]99[.]68 | Hardcoded ModeloRAT command-and-control server used for its HTTP beacon. |
| IPV4 | 149[.]248[.]78[.]202 | HTTP control-channel endpoint used by internal.py and Microsoft5237.py. |
| IPV4 | 149[.]28[.]96[.]170 | Endpoint used by Dell508.py for a reverse TCP tunnel. |
| IPV4 | 207[.]246[.]114[.]50 | Endpoint used by Dell508.py for a reverse TCP tunnel. |
| IPV4 | 45[.]59[.]122[.]231 | Hardcoded endpoint for the malware's TCP reverse shell and file-transfer sockets. |
| IPV4 | 45[.]76[.]241[.]51 | Hardcoded ModeloRAT command-and-control server used for its HTTP beacon. |
| IPV4 | 46[.]225[.]231[.]170 | Hardcoded ModeloRAT command-and-control server used for its HTTP beacon. |
| IPV4 | 64[.]190[.]113[.]187 | Hardcoded endpoint for the malware's TCP reverse shell and file-transfer sockets. |
| IPV4 | 64[.]94[.]85[.]158 | Hardcoded ModeloRAT command-and-control server used for its HTTP beacon. |
| IPV4 | 87[.]120[.]186[.]229 | HTTP control-channel endpoint used by internal.py and Microsoft5237.py. |
| IPV4 | 96[.]9[.]125[.]29 | SOCKS5 proxy endpoint used by PCDr6967.py to route attacker tools through the victim. |
| SHA256 | 30e5a6c982396cdf3157195b540f75096869baa8570f66fab88c07c161be27f0 | SHA-256 of com6848.dll, which decrypted and loaded the credential-harvesting lock-screen payload. |
| SHA256 | 930263c0843744e269b615fb2ec79f83d7bd8b2cbf75e31fd5ea6c1aaa4e48fd | SHA-256 of the backdoor identified as both internal.py and Microsoft5237.py. |
| SHA256 | b00c1cbcfb98d2618a5c2ccb311da94f3c57709a397be6c8de29839f4e943976 | SHA-256 of ssss.dll, the reflective loader used to execute the privilege-escalation payload. |
| SHA256 | d84245f3a374dd5eff8ecfdfad39077d76331fde799e5306430d0fc788db7f1d | SHA-256 of testdllLPE.dll, the custom CVE-2023-36036 privilege-escalation exploit. |
| SHA256 | f5b2dbd8ec9671c0261f093ebc5f3d35920b592458a3b800cc946265111e67d0 | SHA-256 of stage2.dll, the DLL that displayed the fake Windows lock screen and captured the user's password. |
MITRE ATT&CK
T1003.001 · LSASS MemoryDumpIt was run to capture physical RAM, including LSASS memory that could contain credentials and tickets.T1021.001 · Remote Desktop ProtocolThe attacker used harvested credentials to access another workstation over RDP.T1021.006 · Windows Remote ManagementThe compromised account established a remote PowerShell session to a second host using WinRM.T1053.005 · Scheduled TaskThe attacker created the SYSTEM-level scheduled task TempLogA to run internal.py daily.T1056.002 · GUI Input CaptureA fake Windows lock screen captured the user's password when entered.T1059.001 · PowerShellHidden PowerShell sessions staged the payload and were used for reconnaissance, persistence, and remote command handling.T1059.006 · PythonPortable Python launched collector.py, Pmanager.py, and additional malware modules.T1068 · Exploitation for Privilege EscalationA custom exploit for CVE-2023-36036 targeted cldflt.sys and elevated execution to SYSTEM.T1071.001 · Web ProtocolsThe malware used HTTP over port 80 for beaconing and a control channel.T1105 · Ingress Tool TransferA PowerShell stager retrieved a ZIP payload from Dropbox, and additional Python modules were deployed to compromised hosts.T1218.011 · Rundll32The attacker used rundll32.exe to execute ssss.dll and com6848.dll.T1558.003 · KerberoastingThe attacker requested Kerberos tickets for service accounts in an attempt to expand access.T1566.003 · Spearphishing via ServiceThe attacker used an external Microsoft Teams message from a newly created tenant to impersonate IT Support and contact a targeted employee.T1567.002 · Exfiltration to Cloud StorageThe article assesses that the memory dump was likely exfiltrated through uploadnow.io after the attacker visited the service.T1620 · Reflective Code LoadingThe article describes DLL loaders reflectively loading decrypted payloads, including stage2.dll.
CVE
CVE-2021-31969Vendor / Product unavailableSTAR Labs documented a similar chain in their analysis of CVE-2021-31969 also in cldflt.sys.CVE-2023-36036Microsoft · Windows 10 Version 1507; Microsoft · Windows 10 Version 1607; +21 moreSupport” message, then progressed through Dropbox-hosted Python malware, privilege escalation with CVE-2023-36036, credential harvesting, and lateral movement.
Threat Actors
Malware
Vendors
Dropboxintrusion that began with a fake Microsoft Teams “IT Support” message, then progressed through Dropbox-hosted Python malware, privilege escalation with CVE-2023-36036, credential harvesting, and lateralMicrosoftRapid7 investigated a 2026 enterprise intrusion that began with a fake Microsoft Teams “IT Support” message, then progressed through Dropbox-hosted Python malware, privilege escalation with CVE-2023-36036, credential
Products
Microsoft Active DirectoryPost-exploitation activity included scheduled-task persistence, Active Directory enumeration, WinRM/RDP movement, and deployment of additional proxy/tunnel modules.Microsoft TeamsRapid7 investigated a 2026 enterprise intrusion that began with a fake Microsoft Teams “IT Support” message, then progressed through Dropbox-hosted Python malware, privilege escalation with CVE-2023-36036, credentialMicrosoft WindowsA fake Windows lock screen was used to harvest the user’s domain password, enabling further access and likely memory dump exfiltration.
Tools
Comae toolkitThe following morning, the attacker returned to the second host via RDP and used Microsoft Edge to download the Comae toolkit, including DumpIt, a legitimate memory acquisition tool.DumpIt[T1003.001] OS Credential Dumping: LSASS Memory – DumpIt was used to capture RAM that may contain LSASS credentials (‘DumpIt captures physical RAM, including LSASS process memory’).NmapRoutes attacker’s tools (RDP, browsers, Nmap) through victim into internal network.PowerShellA PowerShell stager downloaded a Dropbox-hosted ZIP archive that launched portable Python payloads in the background.