Press play to start listening
Securonix researchers have detailed a new Windows backdoor campaign tracked as TASK#STOMP, which was discovered on a compromised Windows system stealing business documents and maintaining remote access.
The research, shared with Hackread.com, found that the malware uses Windows Script Host, PowerShell and Task Scheduler to set up several ways to keep running on the machine.
Multiple Ways to Stay on an Infected System
The attack begins with a VBScript installer that creates a folder named WinDefendSvc (that resembles a legitimate Windows service) under the user’s LocalAppData directory. The script then creates four scheduled tasks using system-like names and places another script in the Windows Startup folder.
This provides redundant persistence through four scheduled tasks and a Startup-folder script, allowing the malware to run again after the user logs in. If one method is removed, the other can help restore the infection.
Moreover, the malware performs timestomping (changing file timestamps to hide activity) by terminating existing copies of its loaders and changing the modification dates of five files to January 15, 2024. This timestomping can mislead basic file-timeline analysis by making the files appear considerably older than they actually are.
PowerShell Payload Targets Business Files
TASK#STOMP launches two hidden PowerShell scripts, sys_loader.ps1 and win_conn.ps1, which decode the Base64-encoded payloads stored in diag_pack.dat and win_conn_cfg.dat and execute the resulting code in memory.
The primary payload, diag_pack.dat, searches fixed drives for documents and archives, including Word files, PDFs, spreadsheets, presentations, and compressed files. It uploads matching files to attacker-controlled infrastructure and monitors for newly created or modified documents.
The backdoor is highly capable. It can steal saved Wi-Fi passwords, capture screenshots, collect clipboard contents, and execute arbitrary PowerShell commands. Its second payload provides another command-and-control (C2) channel with overlapping capabilities.
The two PowerShell branches are also designed to monitor each other and restart the other component if it stops running, adding another layer of redundancy to the infection.
After gaining access, an attacker could continue collecting company information and use remote commands to carry out additional activity on the compromised computer.
Why the Activity May Be Difficult to Spot
Securonix has not attributed TASK#STOMP to a known threat group or identified how the malware initially reached the compromised system. The identity and industry of the affected organization were also not disclosed.
The malware uses legitimate Windows components instead of relying entirely on a separate executable. It also uses PowerShell to compile a small C# helper at runtime that bypasses TLS certificate validation, allowing communication with its C2 servers even when certificates are invalid, self-signed or mismatched.
Securonix identified two C2 domains, corecloudfileshare(.)xyz and attachmentsharingdrive. The installer also opens a webpage on (.)xyzirantenders, although its purpose could not be confirmed.(.)com
Securonix recommends looking for combinations of suspicious activity rather than relying on individual indicators. Unexpected VBScript or PowerShell activity from user-writable folders, new scheduled tasks, and PowerShell spawning the .NET C# compiler can all warrant investigation.
Securonix also points to PowerShell Script Block Logging, AMSI telemetry and scheduled-task data as useful sources for tracing the activity.
