Sandworm: Trojanized KMS Activator to DcRAT

A workstation at Ridna Energo tripped an EDR alert for an unsigned DLL loaded by rundll32 that then beaconed to external infrastructure. You have SIEM, XDR, and perimeter firewall telemetry for the day. Orient yourself before you start pivoting.

The intrusion began with something the user chose to download. Before tracing execution, establish where the initial binary came from.

The downloaded executable was run by the user and kicked off the rest of the chain. Identify it by its cryptographic hash so it can be blocked and hunted across the fleet.

The activator did not act alone. It used a scripting interpreter to write a second-stage loader to disk. Name that loader file.

To survive a reboot, the operator scheduled the implant to relaunch automatically. Identify the scheduled task they registered.

The persistence and C2 both point at one DLL loaded through a trusted Windows binary. Identify that implant by its SHA-256 hash.

The implant established an outbound channel to operator infrastructure that fronts an anonymizing proxy. Identify the domain it beaconed to.

From the beachhead, the operator reached a second host using a credential that should never have been present on a staff workstation. Identify that account.

Before the alert fired, a large volume of data left the beachhead. Determine where it went and how the operator avoided creating a new, more visible channel.

The implant ran through a trusted, signed Windows binary rather than as its own process. Map that execution method to its MITRE ATT&CK identifier.