--- analysis: "This is a hunt because it pivots between four distinct surfaces\u2014script\ \ activity, registry keys, process command lines, and binary prevalence\u2014to\ \ reconstruct a chain that evades single-surface detection rules." blind_spots: - id: incomplete-telemetry question: Whether the script execution was missed on hosts with legacy logging. requires: full hb_script_activity and hb_registry_activity coverage risk: If script block logging is not enabled, the primary evidence for the registration stage is lost, leaving only the process execution. - id: encrypted-profiling-logic question: Which specific applications were targeted on this host? requires: binary analysis risk: The list of 329 targeted applications is hex-encoded inside the VB6 DLL; we can detect the logic's side effects (the log) but not the profiling itself in telemetry. stage: application-discovery-gate coverage: - stage: scripted-com-hijacking status: covered steps: - scripted-registration - stage: rundll32-com-loader status: covered steps: - rundll32-sta-loader - stage: application-discovery-gate status: covered steps: - rare-componentsfolder-binaries - stage: registry-run-persistence status: covered steps: - persistence-mechanisms - reason: 'Belongs to another part of the ''DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer'' series.' stage: phishing-pif-delivery status: out_of_scope - reason: 'Belongs to another part of the ''DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer'' series.' stage: remote-msi-execution status: out_of_scope - reason: 'Belongs to another part of the ''DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer'' series.' stage: cabinet-file-staging status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: DarkMe is an APT-linked infostealer that uses non-standard execution paths like rundll32 /sta to bypass EDR; a negative result over the estate ensures this stealthy persistence is not active. methodology: model-assisted trigger: intel-report hypothesis: An intruder has established persistence and stealthy execution by hijacking a COM object via script and launching it with Rundll32's /sta flag, followed by a broad profiling of local financial and security applications. labels: - hunt - attack.t1059.005 - attack.t1546.015 - attack.t1218.011 - attack.t1555 - attack.t1547.001 name: 'DarkMe RAT: COM Hijacking and Application Profiling' parameters: lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: 'Optional: List of hostnames to restrict behavior queries; if empty, the entire estate is checked.' type: list[string] target_clsid: default: '{CFDC57BA-1705-45AF-BA10-EFC3D592982B}' description: The CLSID used by DarkMe for COM hijacking. from: kind: article observed: '2024-09-22' ref: huntress type: string provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.huntress.com/blog/darkme-rat-abandons-exploits gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Initial scoping focuses on hosts with the specific exemsi wrapper version; broaden the hunt to all workstations if the first stage finds no hits, as the wrapper may have been updated. references: - name: "Huntress \u2014 DarkMe RAT Abandons Exploits" url: https://www.huntress.com/blog/darkme-rat-abandons-exploits related: - hunt: darkme-initial-delivery-pif-msi reason: This hunt focuses on the loader and post-exploitation profiling, while the sibling hunt focuses on the initial phishing delivery. relation: out-of-scope-alternative scenario: stages: - name: Social Engineering PIF Delivery observables: - https://readonline365.com/view/image.png - image.pif slug: phishing-pif-delivery tactic: initial-access techniques: - T1566 - name: Remote MSI Proxy Execution observables: - msiexec /i https://onlineview365.com/propi.msi /quiet /norestart - propi.msi - exemsi version 11.0.53.0 slug: remote-msi-execution tactic: execution techniques: - T1218 - name: Cabinet File Extraction observables: - EXPAND.EXE -R files.cab - '%AppData%\ComponentsFolder\' - files.cab slug: cabinet-file-staging tactic: execution techniques: - T1059 - name: Scripted COM Object Registration observables: - prnfig.wsf - wScript.exe - reg.exe import filetext2.txt - HKCU\Software\Classes\CLSID\{CFDC57BA-1705-45AF-BA10-EFC3D592982B} - ProgID Coconout.Primary slug: scripted-com-hijacking tactic: persistence techniques: - T1059.005 - T1546.015 - name: Rundll32 COM Entry Loader observables: - rundll32.exe /sta {CFDC57BA-1705-45AF-BA10-EFC3D592982B} - Coconout.dll - Use.dll - Finalized.dll slug: rundll32-com-loader tactic: stealth techniques: - T1218.011 - name: Broad Application Discovery Gate observables: - metamask.exe - keepass.exe - pokerstars.exe - mullvad-deamon.exe - razersynapse.exe slug: application-discovery-gate tactic: credential-access techniques: - T1555 - name: Registry Run-Key Persistence observables: - HKCU\Software\Microsoft\Windows\CurrentVersion\Run - HKCU\Software\Classes\Locked\shell\open\command - '%TEMP%\Zeta_Component.log' slug: registry-run-persistence tactic: persistence techniques: - T1547.001 summary: Water Hydra (EvilNum) has transitioned from zero-day exploits to social engineering campaigns, delivering the DarkMe RAT via a spoofed .pif executable. The intrusion leverages a remote-hosted MSI installer to stage a multi-layered VB6 loader that utilizes COM hijacking and a massive application-discovery gate before establishing persistence via the Windows Registry. series: index: 2 slug: darkme-rat-a-vb6-apt-trojan-turned-conventional-infostealer title: 'DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # DarkMe RAT: COM Hijacking and Application Profiling This hunt identifies the sophisticated multi-stage VB6 loader mechanics used by DarkMe (Water Hydra). It follows the chain from scripted COM registration to the use of the obscure rundll32 /sta command line to bypass traditional detection. The hunt then pivots to find evidence of the second stage, which profiles over 300 target applications—including crypto wallets, trading platforms, and VPN clients—and establishes persistence through custom protocol handlers. By stack-counting rare binaries in user-writable components folders, we find the core malware modules that evade standard file-based alerts. ## scope-msi-wrapper Find hosts that have software installed using the specific exemsi MSI Wrapper (v11.0.53.0) observed in DarkMe campaigns. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hosts that installed software via the specific wrapper version. This narrows the hunt to the most likely beachheads. reads: - device_hostname - package_name - package_version - vendor_name silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-09-23' ~~~ SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE package_version = '11.0.53.0' AND LOWER(vendor_name) LIKE '%exemsi%' ``` ## parallel-early parallel: - → scripted-registration - → rundll32-sta-loader join: → early-triage ## scripted-registration Find the execution of Windows Script Host (.wsf) that imports registry keys to hijack a COM object. ```sqlite target=endpoint role=enrichment params=(target_clsid=target_clsid, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: A script block containing the target CLSID and references to registry imports. This confirms the persistence mechanism was staged. reads: - device_hostname - script_path - script_content - time silence: not_evidence_of_absence source: hb_script_activity verified: dry-run verified_at: '2026-09-23' ~~~ SELECT device_hostname, script_path, script_content, time FROM hb_script_activity WHERE (instr(LOWER(script_content), LOWER('{{target_clsid}}')) > 0 OR LOWER(script_content) LIKE '%coconout.primary%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## rundll32-sta-loader Identify the use of rundll32.exe with the /sta flag to load the hijacked COM server, a signature evasion technique. ```sqlite target=endpoint role=detection-candidate params=(target_clsid=target_clsid, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: A rundll32 process command line containing /sta and the hijacked CLSID. This is the primary indicator of execution. reads: - device_hostname - process_cmd_line - user_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-23' ~~~ SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE LOWER(process_cmd_line) LIKE '%/sta%' AND instr(LOWER(process_cmd_line), LOWER('{{target_clsid}}')) > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## early-triage ```agent target=hunter cite: required context: - scripted-registration - rundll32-sta-loader max_iterations: 4 objective: Confirm the presence of DarkMe loader stages 1 and 2 on the identified hosts. success_criteria: A per-host verdict of malicious, suspicious, or benign with cited process and script rows. tools: - endpoint ``` ## parallel-late parallel: - → persistence-mechanisms - → rare-componentsfolder-binaries join: → late-triage ## persistence-mechanisms Find the secondary persistence mechanisms: standard Run keys and the unusual Locked protocol registration. ```sqlite target=endpoint role=enrichment params=(target_clsid=target_clsid, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Registry entries pointing to the rundll32 /sta command line, particularly under the 'Locked' protocol handler. reads: - device_hostname - reg_target - reg_value_data - time silence: not_evidence_of_absence source: hb_registry_activity verified: dry-run verified_at: '2026-09-23' ~~~ SELECT device_hostname, reg_target, reg_value_data, time FROM hb_registry_activity WHERE (LOWER(reg_target) LIKE '%\currentversion\run%' OR LOWER(reg_target) LIKE '%\classes\locked\shell\open\command%') AND instr(LOWER(reg_value_data), LOWER('{{target_clsid}}')) > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## rare-componentsfolder-binaries Stack-count processes running from the AppData ComponentsFolder to identify the rare DarkMe modules across the fleet. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A list of binaries present on only one or two hosts. Genuine software rarely installs into a folder with this specific name. prevalence: by: device_hostname key: - path rare_below: 3 reads: - process_path - device_hostname - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-23' ~~~ SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS launch_count, MIN(time) AS first_seen FROM hb_process_activity WHERE LOWER(process_path) LIKE '%\appdata\componentsfolder\%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path HAVING host_count <= 2 ORDER BY host_count ASC ``` ## late-triage ```agent target=hunter cite: required context: - early-triage - persistence-mechanisms - rare-componentsfolder-binaries max_iterations: 4 objective: Identify hosts where DarkMe has successfully established persistence and is likely profiling local applications. success_criteria: A consolidated verdict citing the loader execution, the persistence keys, and the rare binaries. tools: - endpoint ``` ## route if~: "the late-triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: incomplete-telemetry) else: → close-out ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host and preserve the %AppData%\ComponentsFolder\ and %AppData%\Microsoft\ folders for forensic collection. ``` → analyst-review ## analyst-review ```manual target=analyst Check the %TEMP%\Zeta_Component.log for debug output. Review the rare binaries identified in the prevalence step and confirm if they correspond to the DarkMe VB6 loaders (Coconout.dll, Use.dll, Finalized.dll). ``` → close-out ## close-out ```manual target=analyst Record the affected hosts and users. If the rundll32 /sta execution was high-confidence, promote the associated query to a permanent detection rule. ``` → end