DEV Community

Anoymask
Anoymask

Posted on

CikaBika: Rust RAT Uses Discord C2; UAC Bypass and Edge DLL Placement Are Attempted

#security #threatintel

1. Basic Information

In addition to a path where an LNK file disguised as a document uses a Nim loader to load a Rust-based RAT, it attempts UAC bypass and DLL dropping into Edge. While successful loading by Edge remains unconfirmed, Discord C2 and data exfiltration via ngrok have been observed.

2. Executive Summary

CikaBika launches PowerShell and a Nim loader from an LNK file inside an IMG, featuring routines to directly load a Rust DLL as well as attempts at UAC bypass and DLL dropping into Edge. Darktrace observed operations via Discord and ZIP file transmission using ngrok. DLL loading by Edge is unconfirmed.

3. Attack Flow

Common loader processing, parallel Edge dropping attempts, and post-RAT-launch behavior are separated below.

Step / Path Actor / Technique Prerequisites Confirmation Scope in Public Information
Common processing and direct Nim loading LNK -> PowerShell -> Nim loader launches Rust DLL via loadLib (or regsvr32.exe on failure) User opens the LNK inside the IMG Implementation confirmed via sample analysis
Parallel UAC bypass and Edge dropping attempt Deployment PowerShell attempts to drop dbghelp.dll into the Edge directory using ms-settings and computerdefaults.exe Windows configuration enabling UAC bypass and write access to protected directories Dropping logic implemented; actual DLL load by Edge unconfirmed
Post-RAT launch C2 and exfiltration Command reception and file retrieval via Discord channels, directory archiving to ZIP, and transmission via ngrok Outbound network access to the Discord API and ngrok Darktrace observed attacker operations, ZIP exfiltration, and file retrieval

Common Processing and Direct Nim Loading

  1. When a user opens an LNK disguised as a DOCX inside an IMG file, a hidden PowerShell script starts and displays a decoy PDF.
  2. PowerShell decrypts an embedded executable using the value 0x20 at offset 239 of the PDF as the XOR key, writes it to %TEMP%\IfyuUapz.txt, and executes it.
  3. The Nim loader decrypts the Rust DLL and the deployment PowerShell script. It loads the DLL via loadLib, falling back to regsvr32.exe if that fails.

Parallel UAC Bypass and Edge Dropping Attempt

  1. The deployment PowerShell script places the DLL at C:\Windows\Temp\dbghelp.tmp and attempts to move it into the protected Edge directory using ms-settings registry keys and computerdefaults.exe.
  2. UAC bypass depends on the target Windows configuration. The target destination is C:\Program Files (x86)\Microsoft\Edge\Application\dbghelp.dll, but no evidence shows Edge actually loaded it.

Post-RAT Launch C2 and Observed Exfiltration

  1. The RAT registers the endpoint with Discord and accepts commands from a dedicated channel.
  2. Darktrace observed the attacker compressing a directory into a ZIP file and exfiltrating it via ngrok, alongside retrieving specific files via Discord. This is not treated as evidence of successful loading via Edge.

4. Attacker Positioning and Execution Location

  • The attacker delivers the disk image and operates the Discord C2. The initial distribution vector is unconfirmed, and it is not proven to be email or messaging.

5. Victim and Administrator Perspective

Victims and Users

  • A French-language PDF explaining how to summarize a text opens, making it difficult to notice the background loader process.

Administrators

  • Appears as LNK/hidden PowerShell execution, UAC bypass registry modifications, computerdefaults.exe activity, suspicious DLLs under the Edge directory, and Discord traffic originating from non-browser processes.

6. Success and Failure Conditions

Success Conditions

  • The user executes the LNK inside the IMG, successfully running PowerShell, the Nim loader, and the Rust DLL.
  • Communication from the RAT to Discord must succeed. ngrok exfiltration also requires outbound connectivity.
  • The Edge deployment path additionally requires a Windows configuration permitting UAC bypass and write access to protected directories. Successful Edge loading is not a prerequisite for general RAT execution.

Failure Conditions and Countermeasures

  • Restrict IMG/LNK execution and enforce archive/disk image policies that preserve Mark-of-the-Web.
  • Inference: Restrict UAC bypass registry entries and write access to the Edge directory, and monitor/control direct DLL loading from Nim. Do not assume blocking the Edge drop entirely cuts off all paths; unauthorized Discord/ngrok traffic must also be controlled.

7. Impact Upon Success

  • Remote commands, screenshots, and file operations are possible under the privileges used to run the RAT. Privilege escalation via UAC bypass depends on the Windows configuration.
  • Public observations include Discord operations and ngrok ZIP exfiltration. The privileges obtained on all victim endpoints and the scope of exfiltrated data remain unpublished.

8. Observable Logs

Below are candidate investigation sources within your organization. Availability depends on products, privileges, log settings, and retention periods; the absence of records does not prove an uncompromised state.

  • Email: Inference: The email delivery vector is unconfirmed. Email and messaging records are candidates when investigating distribution sources.
  • Proxy / SWG / DNS: Inference: Verify non-browser process communication to the Discord API/CDN and ngrok.
  • Endpoint / EDR: Inference: Check for LNK -> PowerShell, %TEMP%\IfyuUapz.txt, computerdefaults.exe, ms-settings registry keys, and Edge\Application\dbghelp.dll.
  • Identity / IdP: Inference: Check for account logins from new locations or devices originating from compromised hosts.
  • SaaS / Cloud: Inference: Verify connections to Discord bots/channels and token usage.
  • Network: Inference: Monitor periodic beaconing to Discord, ngrok tunnels, and external connections following remote commands.

9. Attack Success Determination

Confirmed in Public Information

  • Information Theft or Session Compromise Confirmed: Public Information: Darktrace observed operations via Discord, directory compression to ZIP with ngrok exfiltration, and retrieval of specific files via Discord. Successful DLL loading by Edge and administrator privilege escalation on all endpoints remain unconfirmed. Scope: Attacker actions identified by Darktrace. Total victim scale and ZIP contents are unpublished.

Separate contact, execution, persistence, data access, and exfiltration; do not infer unconfirmed success from a single alert.

10. Investigation Playbook

  • Investigation Starting Point: Start from the IMG/LNK, IfyuUapz.txt, ms-settings registry entries, and Discord API traffic.
  • Initial Verification: Check the delivery source, file hashes, executing user, process tree, and destinations.
  • Endpoint / Server Investigation: Preserve the IMG, PDF, LNK, Nim loader, DLL, registry, and Edge directory.
  • Authentication / Cloud Investigation: Check Discord tokens, Windows accounts, browser sessions, and SaaS logins from compromised hosts.
  • Subsequent Activity: Track remote commands, screenshots, file transfers, ngrok exfiltration, and credential access.
  • Containment: Isolate hosts, block C2, remove malicious files/registry keys, and rotate credentials.
  • Categorization: Separate decoy opening, PowerShell execution, UAC bypass, DLL loading, C2, and data exfiltration.

11. Defense and Detection Ideas

  • Single Event: Detect modifications to ms-settings\shell\open\command immediately prior to computerdefaults.exe execution.
  • Timeline Correlation: Inference: Correlate LNK -> PowerShell -> Nim DLL loading with Discord traffic, and track UAC bypass registry changes -> Edge DLL dropping attempts as a separate path.
  • Threat Hunting: Search for non-Microsoft dbghelp.dll files in the Edge application directory and non-browser Discord API clients.
  • Log Limitations: Because Discord traffic is TLS encrypted, correlating host processes with communication destination metadata is necessary.
  • Priority Countermeasures: Prioritize IMG/LNK restrictions, PowerShell logging, program directory protection, and outbound traffic management for Discord and ngrok.

12. Facts / Inference / Hypothesis

Facts

  • The initial lure files consist of a DOCX-style LNK and a PDF contained within Proposition_Projet.img.
  • The LNK launches a hidden PowerShell script, which decrypts an embedded executable using the value 0x20 at offset 239 of the PDF as the XOR key, writes it to %TEMP%\IfyuUapz.txt, and executes it.
  • The Nim loader contains a Rust DLL and deployment PowerShell, implementing DLL loading via loadLib and a retry fallback calling regsvr32.exe on failure.
  • The deployment PowerShell attempts UAC bypass using HKCU\Software\Classes\ms-settings\shell\open\command and computerdefaults.exe. Success depends on the Windows configuration.
  • The Rust DLL is dropped into C:\Program Files (x86)\Microsoft\Edge\Application\dbghelp.dll, targeting an Edge DLL search-order hijacking condition. Analysis confirmed this path, but evidence of Edge actually loading the DLL in the observation environment was not presented.
  • The RAT uses Discord channels for C2, accepting reconnaissance, command execution, screenshots, and file operations, with functionality to exfiltrate data via ngrok.
  • Darktrace observed directory compression to ZIP sent via ngrok, and retrieving specific files via Discord using !download.

Inference

  • In environments with legitimate Discord usage, it is effective to correlate non-browser process usage of the Discord API with host-level changes rather than relying solely on domain-based controls.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under "Open Questions and Further Investigation."

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1204.002 User Execution: Malicious File high Relies on the user opening a DOCX-style LNK inside an IMG. Source
T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control high Uses the ms-settings handler and computerdefaults.exe. Source
T1574.001 Hijack Execution Flow: DLL medium A path dropping dbghelp.dll into the Edge directory was confirmed; actual loading is unconfirmed. Source
T1102 Web Service high Uses Discord channels for C2. Source

14. Open Questions and Further Investigation

  • The distribution vector, campaign scale, threat actor, victim organizations, successful DLL loading by Edge, specific contents of exfiltrated ZIP files, and total impact volume remain unknown.

15. Impact on SOCs and Organizations

Even if writes to the protected Edge directory are blocked, the direct DLL loading path from Nim remains. Organizations utilizing Discord for business must not permit traffic simply because it targets a common cloud destination; they need to correlate evidence of loaders, DLL loading, registry modifications, and data exfiltration.

16. Summary by Target Audience

  • For SOCs: Correlate LNK -> PowerShell -> computerdefaults.exe, the ms-settings registry key, dbghelp.dll under Edge, and Discord C2.
  • For Administrators: Restrict IMG/LNK execution, and prevent standard users from writing to the Edge program directory and making unauthorized Discord connections.
  • For Users: Do not open unexpected proposal IMG or DOCX-style shortcuts; verify with the legitimate sender via alternative channels.

Top comments (0)