ClickFix to MaaS: Inside a Modular Windows RAT and Its Control Panel

Summary

Netskope Threat Labs observed a ClickFix campaign delivering a custom Windows RAT built on Node.js via malicious MSI installers. The payload keeps key modules in memory and uses gRPC streaming over Tor for C2. An OPSEC mistake exposed the admin-panel protocol, pointing to a malware-as-a-service model with wallet tracking. Persistence is set via a user-level HKCU Run value.

Investigation

Researchers captured the MSI, decoded the PowerShell bootstrap, and traced dynamic loading of Node.js modules. They extracted and decrypted the configuration blob to recover a .onion C2 address. A leaked admin.proto file revealed MaaS functions such as multi-operator management and wallet monitoring, and analysts noted a self-healing watchdog plus Tor usage for anonymized traffic.

Mitigation

Block unsigned MSI execution from untrusted sources and monitor HKCU…\Run for new, suspicious entries. Detect PowerShell that downloads MSI payloads from domains like cloud-verificate.com. Alert on conhost.exe or node.exe launched with hidden arguments and on tor.exe appearing on endpoints that do not require it.

Response

Isolate affected hosts, collect memory for in-memory module analysis, and remove the HKCU Run persistence. Review %LOCALAPPDATA%\LogicOptimizer for staging artifacts and any scheduled tor.exe activity, then block the onion endpoint and related domains/IPs. Hunt enterprise-wide for the same installer artifacts and process chains.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Objective: The attacker wants to bootstrap a malicious Node.js payload (bootstrap.js) without raising suspicion.
  2. Method: Use a signed Windows binary (conhost.exe) as a proxy to launch node.exe in headless mode, passing the bootstrap script as an argument.
  3. Steps:
     • Drop a malicious bootstrap.js into a writable directory (e.g., %TEMP%).
     • Invoke conhost.exe with the exact argument string that the rule watches for.
     • The command runs under the context of the current user, mimicking a legitimate process spawn.

  # 1. Drop malicious bootstrap.js (simulated harmless content for test)
  $bootstrapPath = "$env:TEMPbootstrap.js"
  Set-Content -Path $bootstrapPath -Value "// malicious bootstrap placeholder"
  
  # 2. Execute conhost.exe to spawn node.exe with the required flags
  $conhost = "$env:windirsystem32conhost.exe"
  $args = '--headless "node.exe" "bootstrap.js"'
  Start-Process -FilePath $conhost -ArgumentList $args -WorkingDirectory $env:TEMP

• Regression Test Script:

  # -------------------------------------------------
  # Regression Test: Trigger Conhost → Node Bootstrap
  # -------------------------------------------------
  # Ensure Sysmon is running and logging ProcessCreate events.
  
  # Drop a dummy bootstrap script
  $bootstrap = "$env:TEMPbootstrap.js"
  Set-Content -Path $bootstrap -Value "// test bootstrap content"
  
  # Define the exact command line the detection rule looks for
  $conhostPath = "$env:windirsystem32conhost.exe"
  $cmdLine = '--headless "node.exe" "bootstrap.js"'
  
  # Launch conhost with the malicious‑looking arguments
  Start-Process -FilePath $conhostPath -ArgumentList $cmdLine -WorkingDirectory $env:TEMP
  
  Write-Host "Simulation completed – check SIEM for alert."

• Cleanup Commands:

  # Stop any lingering node or conhost processes launched by the test
  Get-Process -Name node, conhost -ErrorAction SilentlyContinue | Stop-Process -Force
  
  # Remove the temporary bootstrap script
  Remove-Item -Path "$env:TEMPbootstrap.js" -Force -ErrorAction SilentlyContinue
  
  Write-Host "Cleanup finished."