Copyright Lure to Rhadamanthys Stealer

An endpoint alert fired on a procurement workstation that downloaded and ran something out of a Downloads folder this morning. The trail starts in the web proxy: the user followed a link in a copyright-complaint email that bounced through a shortener before any file arrived. Establish where the file actually came from.

The archive that came down was not opened as a document. The user extracted it and launched a program from inside it. On the surface that program looks completely legitimate. Identify the executable the user ran.

A signed program running on its own is not the compromise. The malice was a second file shipped in the same archive and loaded by that trusted program from the wrong place. Recover the module that was loaded.

For the report, classify the technique that let a malicious module run inside a legitimate signed process by being placed beside it under a system library's name. Map it to its MITRE ATT&CK technique.

Before doing anything noisy on the network, the planted module made sure it would survive a reboot. It registered an autostart entry an ordinary user can write to. Recover the name of the autostart value it created.

Once persistence was set, the payload reached out to attacker infrastructure to take orders and ship the data it collected. Both the beacon and the upload used a single destination. Identify the address you would block to sever the channel.