{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The Aeternum botnet's decentralized C2 on the Polygon blockchain makes network-based detection extremely difficult; hunting for its unique host-side persistence and auxiliary process patterns provides a resilient detection path for this permanent threat." }, "name": "Aeternum Loader Persistence and Execution", "type": "investigation", "labels": [ "hunt", "attack.t1204.002", "attack.t1547.001", "attack.t1106" ], "series": { "slug": "the-permanent-threat-analyzing-aeternum-s-blockchain-based-c2-operations-and-communications", "index": 1, "title": "The Permanent Threat: Analyzing Aeternum\u2019s Blockchain-Based C2 Operations and Communications", "total": 2 }, "related": [ { "hunt": "aeternum-blockchain-c2-network", "reason": "This hunt focuses on endpoint footprint; network activity to Polygon RPC and Telegram APIs requires a separate network-centric hunt.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single detection rule for the shortcut name is fragile as names can change; this hunt uses the shortcut as a trigger to then baseline all rare binaries in the user's profile and check for a set of related malicious executables. This multi-surface correlation confirms an infection that no single signature could definitively prove.", "coverage": [ { "stage": "aeternum-initial-execution", "steps": [ "stack-rare-appdata-binaries" ], "status": "covered" }, { "stage": "persistence-via-startup-folder", "steps": [ "lead-startup-lnk" ], "status": "covered" }, { "stage": "auxiliary-binary-execution", "steps": [ "check-auxiliary-binaries" ], "status": "covered" }, { "stage": "blockchain-c2-communication", "reason": "Belongs to a network-based sibling hunt for RPC traffic.", "status": "out_of_scope" }, { "stage": "payload-download-and-loading", "reason": "Belongs to a hunt focusing on GitHub and Telegram API traffic.", "status": "out_of_scope" }, { "stage": "data-exfiltration-via-telegram", "reason": "Belongs to a hunt focusing on HTTPS exfiltration patterns.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Aeternum Loader Execution", "slug": "aeternum-initial-execution", "tactic": "execution", "techniques": [ "T1204.002" ], "observables": [ "Build.exe", "UPX-packed binary" ] }, { "name": "Persistence via Startup Folder", "slug": "persistence-via-startup-folder", "tactic": "persistence", "techniques": [ "T1547.001" ], "observables": [ "AppData\\Local", "Wmi_Framework_APIKEY_wmsnet_*.lnk" ] }, { "name": "Auxiliary Binary Execution", "slug": "auxiliary-binary-execution", "tactic": "execution", "techniques": [ "T1106" ], "observables": [ "wmiframework.exe", "ZrvEsJQzWQ.exe", "STAAAAAS.exe" ] }, { "name": "Blockchain-based C2 Communication", "slug": "blockchain-c2-communication", "tactic": "command-and-control", "techniques": [ "T1102.001", "T1071.001" ], "observables": [ "polygon-mumbai-bor-rpc.publicnode.com", "0xb68d1809", "getDomain()" ] }, { "name": "Payload Download from GitHub", "slug": "payload-download-and-loading", "tactic": "command-and-control", "techniques": [ "T1105" ], "observables": [ "github.com", "DotNetZip.dll", "putty.exe" ] }, { "name": "Data Exfiltration via Telegram API", "slug": "data-exfiltration-via-telegram", "tactic": "exfiltration", "techniques": [ "T1567.002", "T1041" ], "observables": [ "api.telegram.org", "SystemInfo Bot/2.0", "screenshot.png", "/sendDocument" ] } ], "summary": "Aeternum is a C++ botnet loader that leverages the Polygon blockchain's smart contracts for decentralized command-and-control infrastructure. The loader establishes persistence via the Windows Startup folder and retrieves instructions through Polygon RPC endpoints before downloading secondary payloads from GitHub and exfiltrating system data via the Telegram API." }, "severity": "high", "rationale": "Scope to Windows systems. The Aeternum loader specifically targets Windows endpoints and utilizes standard user profile paths for its initial footprint.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "The Aeternum loader has established persistence by creating a uniquely named LNK file in the user Startup directory and is executing auxiliary binaries from the local AppData profile.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Hostnames to narrow the search; leave empty to hunt the whole estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "startup_pattern": { "from": { "ref": "unit42-aeternum-c2", "kind": "article", "observed": "2026-08-10" }, "type": "string", "default": "wmi_framework_apikey_wmsnet_%.lnk", "description": "SQL LIKE pattern for the Aeternum persistence shortcut name." }, "auxiliary_binaries": { "from": { "ref": "unit42-aeternum-c2", "kind": "article", "observed": "2026-08-10" }, "type": "list[string]", "default": [ "wmiframework.exe", "zrvesjqzwq.exe", "staaaaas.exe" ], "description": "Supporting binaries executed by the Aeternum loader." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/", "name": "Unit 42 \u2014 The Permanent Threat: Analyzing Aeternum\u2019s Blockchain-Based C2 Operations and Communications" } ], "blind_spots": [ { "id": "missing-file-telemetry", "risk": "The gated hunt may stop at the lead step for an infected host if shortcut creation is not captured.", "stage": "persistence-via-startup-folder", "question": "whether the shortcut was created on hosts where file event logging is limited or disabled", "requires": "hb_file_activity with coverage for user profile Startup paths" }, { "id": "no-endpoint-coverage", "risk": "Persistence might exist, but the hunt will miss the active execution stage on unmanaged hosts.", "stage": "aeternum-initial-execution", "question": "whether the botnet binaries are running on systems without a reporting agent", "requires": "hb_process_activity from an installed agent" } ] }, "name": "Aeternum Loader Persistence and Execution", "description": "This hunt identifies the initial host-based footprint of the Aeternum botnet. It begins by scoping to Windows systems and uses a cheap lead query to find uniquely named persistence shortcuts in user Startup folders. If a shortcut is found, the hunt expands to search for specifically named auxiliary binaries and stacks rare executables running from user-writable paths to confirm the infection. The gated flow ensures expensive fleet-wide analysis only occurs when a high-confidence indicator is present." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "the-permanent-threat-analyzing-aeternum-s-blockchain-based-c2-operations-and-communications", "index": 1, "title": "The Permanent Threat: Analyzing Aeternum\u2019s Blockchain-Based C2 Operations and Communications", "total": 2 }, "coverage": [ { "stage": "aeternum-initial-execution", "steps": [ "stack-rare-appdata-binaries" ], "status": "covered" }, { "stage": "persistence-via-startup-folder", "steps": [ "lead-startup-lnk" ], "status": "covered" }, { "stage": "auxiliary-binary-execution", "steps": [ "check-auxiliary-binaries" ], "status": "covered" }, { "stage": "blockchain-c2-communication", "reason": "Belongs to a network-based sibling hunt for RPC traffic.", "status": "out_of_scope" }, { "stage": "payload-download-and-loading", "reason": "Belongs to a hunt focusing on GitHub and Telegram API traffic.", "status": "out_of_scope" }, { "stage": "data-exfiltration-via-telegram", "reason": "Belongs to a hunt focusing on HTTPS exfiltration patterns.", "status": "out_of_scope" } ], "rationale": "The Aeternum loader has established persistence by creating a uniquely named LNK file in the user Startup directory and is executing auxiliary binaries from the local AppData profile.", "blind_spots": [ { "id": "missing-file-telemetry", "risk": "The gated hunt may stop at the lead step for an infected host if shortcut creation is not captured.", "stage": "persistence-via-startup-folder", "question": "whether the shortcut was created on hosts where file event logging is limited or disabled", "requires": "hb_file_activity with coverage for user profile Startup paths" }, { "id": "no-endpoint-coverage", "risk": "Persistence might exist, but the hunt will miss the active execution stage on unmanaged hosts.", "stage": "aeternum-initial-execution", "question": "whether the botnet binaries are running on systems without a reporting agent", "requires": "hb_process_activity from an installed agent" } ], "scoping_notes": "Scope to Windows systems. The Aeternum loader specifically targets Windows endpoints and utilizes standard user profile paths for its initial footprint.", "beyond_detection": "A single detection rule for the shortcut name is fragile as names can change; this hunt uses the shortcut as a trigger to then baseline all rare binaries in the user's profile and check for a set of related malicious executables. This multi-surface correlation confirms an infection that no single signature could definitively prove." } }, { "id": "scope-windows-hosts", "type": "query", "label": "Scope Windows hosts", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%windows%' OR LOWER(vendor_name) LIKE '%microsoft%'", "surface": "hb_software_inventory", "description": "Identify Windows endpoints where the Aeternum PE loader could execute.", "expected_signal": "A list of hostnames representing the Windows estate. Silence means no Windows software is indexed." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope Windows hosts", "reads": [ "device_hostname", "package_name", "vendor_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%windows%' OR LOWER(vendor_name) LIKE '%microsoft%'", "silence": "not_evidence_of_absence", "expected": "A list of hostnames representing the Windows estate. Silence means no Windows software is indexed.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "lead-startup-lnk", "type": "query", "label": "Lead: Startup shortcut creation", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE LOWER(file_name) LIKE '{{startup_pattern}}' AND (LOWER(file_path) LIKE '%\\\\startup\\\\%' OR LOWER(file_path) LIKE '%\\\\start menu\\\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Find the creation of uniquely named LNK files in user Startup directories used for Aeternum persistence.", "expected_signal": "Rows naming the Aeternum shortcut and the host. Silence means the specific persistence mechanism was not observed." }, "parents": [ { "id": "scope-windows-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Lead: Startup shortcut creation", "reads": [ "device_hostname", "file_name", "file_path", "process_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE LOWER(file_name) LIKE '{{startup_pattern}}' AND (LOWER(file_path) LIKE '%\\\\startup\\\\%' OR LOWER(file_path) LIKE '%\\\\start menu\\\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Rows naming the Aeternum shortcut and the host. Silence means the specific persistence mechanism was not observed.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "evaluate-startup-lead", "type": "analytic", "label": "Evaluate startup lead", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "lead-startup-lnk" ], "objective": "Decide if the file name and path in lead-startup-lnk match the Aeternum persistence pattern and warrant further investigation.", "description": "Determine if the observed file activity represents the Aeternum botnet's persistence behavior.", "max_iterations": 3, "expected_signal": "A per-host verdict on whether the shortcut creation is malicious.", "success_criteria": "A verdict for each host citing the specific shortcut path and naming the creator process." }, "parents": [ { "id": "lead-startup-lnk" } ] }, { "id": "gate-on-startup", "type": "checkpoint", "label": "Gate on startup lead", "config": { "fuzzy": true, "judge": "hunter", "question": "the evaluate-startup-lead verdict is malicious or suspicious for at least one host", "condition": "the evaluate-startup-lead verdict is malicious or suspicious for at least one host", "blind_spot": "missing-file-telemetry", "confidence": "high", "description": "Halt the hunt if no persistence was found, or open expensive queries if the lead is suspicious.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "evaluate-startup-lead" } ] }, { "id": "check-auxiliary-binaries", "type": "query", "label": "Check auxiliary binaries", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, time FROM hb_process_activity WHERE instr(',' || '{{auxiliary_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify execution of supporting binaries that the Aeternum loader drops and runs.", "expected_signal": "Rows naming wmiframework.exe or other auxiliary processes on the affected hosts." }, "parents": [ { "id": "gate-on-startup", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Check auxiliary binaries", "reads": [ "device_hostname", "process_name", "process_path", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, time FROM hb_process_activity WHERE instr(',' || '{{auxiliary_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Rows naming wmiframework.exe or other auxiliary processes on the affected hosts.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "stack-rare-appdata-binaries", "type": "query", "label": "Stack rare AppData binaries", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\\\appdata\\\\local\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_path) HAVING hosts <= 3 ORDER BY hosts, runs", "surface": "hb_process_activity", "description": "Find the primary loader (Build.exe) even if renamed by identifying rare processes in user-writable paths.", "expected_signal": "A small number of rare executables appearing on only 1-3 hosts. Legitimate updaters will be filtered out by fleet-wide counts." }, "parents": [ { "id": "gate-on-startup", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Stack rare AppData binaries", "reads": [ "device_hostname", "process_path", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\\\appdata\\\\local\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_path) HAVING hosts <= 3 ORDER BY hosts, runs", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A small number of rare executables appearing on only 1-3 hosts. Legitimate updaters will be filtered out by fleet-wide counts.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "path" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "triage-infection-context", "type": "analytic", "label": "Triage infection context", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "evaluate-startup-lead", "check-auxiliary-binaries", "stack-rare-appdata-binaries" ], "objective": "Determine if any host shows both the Aeternum persistence shortcut and active execution of the loader or its auxiliary binaries.", "description": "Correlate the persistence shortcut lead with evidence of execution to confirm the Aeternum infection.", "max_iterations": 6, "expected_signal": "A definitive per-host verdict citing file and process rows.", "success_criteria": "A per-host verdict of malicious, suspicious, or benign, citing specific rows and paths." }, "parents": [ { "id": "check-auxiliary-binaries", "kind": "merge" }, { "id": "stack-rare-appdata-binaries", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-infection-context verdict is malicious for at least one host", "condition": "the triage-infection-context verdict is malicious for at least one host", "blind_spot": "no-endpoint-coverage", "confidence": "high", "description": "Direct confirmed infections to containment and others to manual review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-infection-context" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Prevent further botnet activity by isolating the infected endpoint.", "instructions": "Isolate the host and remove the malicious shortcut from the Startup folder.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Manually verify suspicious findings and confirm containment results.", "instructions": "Review the identified process command lines and shortcut paths. Check for network traffic to Polygon RPC nodes if possible." }, "parents": [ { "id": "gate-on-startup", "branch": "default" }, { "id": "gate-on-startup", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Log the negative finding and end the hunt.", "instructions": "Record that no Aeternum persistence or auxiliary execution was detected in the given window." }, "parents": [ { "id": "gate-on-startup", "branch": "on_refutes" } ] } ] }