AsyncRAT: Malvertising to Trojanized Installer
An IT admin searching for a remote management tool clicks a paid search advertisement and downloads what appears to be a legitimate installer. The ZIP contains an AutoIt-compiled fake setup executable that drops a PowerShell loader, which fetches AsyncRAT from a staging server. The RAT establishes persistence via a scheduled task and beacons to a C2 server. Correlate web proxy records, Windows event logs, XDR file and process artifacts, and firewall egress traffic to trace the full chain from malvertising lure to active command-and-control.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Trace the sponsored result that started the chain
25An IT admin's workstation is generating unusual outbound traffic. Start at the web proxy to establish how the incident began and identify the download that kicked it off.
Name the fake installer that ran on the endpoint
25The downloaded ZIP contained a fake RMM installer. Use the XDR file artifacts to identify the executable that was extracted from the archive and run by the victim.
Trace the loader chain through the process tree
25The fake installer spawned a hidden PowerShell process that reached out to a staging server. Read the process tree to identify the PowerShell command line and the staging IP it contacted.
Identify how AsyncRAT survives a reboot
25After dropping the RAT binary, the attacker installed a persistence mechanism so the malware runs automatically after each logon. Use the SIEM event logs to identify what was created.
Locate the AsyncRAT command-and-control server
25The RAT binary has been launching and maintaining a persistent connection since the scheduled task first ran it. Use the firewall logs to identify the C2 IP address it is beaconing to.
Map the persistence technique to MITRE ATT&CK
25The attacker chose a specific persistence method. Classify it using the MITRE ATT&CK framework.
Confirm the RAT binary with its hash
25Tie together your findings so far. Provide the SHA-256 hash of the AsyncRAT binary that was written to AppData and is now persisting on the endpoint.
7 tasks · 175 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with XDR concepts
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allDarkGate via Microsoft Teams: External Message Lure
An IT helpdesk coordinator at a logistics firm receives an urgent Teams chat from an external IT support account. The message links to a VBS script disguised as a VPN update. Running it kicks off a silent MSI install that drops a renamed AutoIt3 loader, which decrypts DarkGate in memory, registers a scheduled task for persistence, and begins beaconing to an HTTPS C2 server. Trace the chain from the Teams lure through the loader to the active backdoor.
BazarCall: Callback Phishing to Remote Access
An accounts-payable coordinator received a spoofed subscription invoice with no attachment and no link -- just a phone number to call. The call center talked her into installing a remote-management tool, and from there the operator moved fast: enumeration, a persistence scheduled task, a Cobalt Strike stager, and a pivot attempt toward the domain controller. Reconstruct the chain from the lure email through the RMM session and the second-stage beacon.
LLMNR and NBT-NS Poisoning: NTLM Relay to SMB
A workstation on the Vantara Solutions network mistyped a file server name. DNS had no answer. Windows broadcast the query over LLMNR -- and something on the network answered. Reconstruct the poisoning, the credential capture, and the relay that followed using SIEM events, endpoint telemetry, and a raw packet capture.