SOC Prime Bias: Medium

10 Feb 2026 17:38
newspaper icon eSentire

Tenant from Hell: Prometei’s Unauthorized Stay in Your Windows Server

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
Tenant from Hell: Prometei’s Unauthorized Stay in Your Windows Server
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

Prometei is a Russia-linked botnet that compromises Windows servers, installs a persistent service, steals credentials, mines Monero, and hardens the host to block competing intruders. It uses custom XOR and RC4 encryption, communicates over clear-web HTTP and Tor, and retrieves extra modules via a staged 7-zip archive. The malware leans on legitimate Windows utilities for collection and persistence.

Investigation

The eSentire Threat Response Unit found the infection on a construction-sector Windows server in January 2026. A malicious command chain created an XOR key file, downloaded a Base64 payload, decrypted it with a rolling XOR routine, and installed the UPlugPlay service. Registry values stored host identifiers and encrypted keys, while outbound HTTP GET traffic carried encrypted system details. Staged downloads also unpacked additional components used for mining.

Mitigation

Enforce strong, unique RDP passwords, enable MFA, disable unnecessary remote services, and apply account lockout policies. Use AppLocker or WDAC to restrict LOLBin abuse and block execution of untrusted tools. Deploy Windows Defender or next-gen AV with tailored signatures, and ensure firewall rules can’t be changed to permit unauthorized inbound access.

Response

Isolate the host, terminate UPlugPlay, remove associated files and registry keys, and reset compromised credentials. Scan for other infected systems, block identified C2 IPs/domains, and monitor for repeat process-creation patterns or suspicious firewall rule changes.

"graph TB %% Class definitions section classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef malware fill:#ff9999 classDef process fill:#ccffcc %% Node definitions initial_access["<b>Action</b> – <b>T1021.001 Remote Services: Remote Desktop Protocol</b><br/>Compromised RDP credentials used to log into Windows Server"] class initial_access action tool_cmd["<b>Tool</b> – <b>Name</b>: cmd.exe<br/><b>Description</b>: Windows Command Shell"] class tool_cmd tool malware_xor_key["<b>Malware</b> – <b>File</b>: C:\Windows\mshlpda32.dll<br/><b>Purpose</b>: Stores XOR key written via cmd"] class malware_xor_key malware tool_powershell["<b>Tool</b> – <b>Name</b>: PowerShell<br/><b>Description</b>: Executes scripts and decodes base64u2011XOR payload"] class tool_powershell tool malware_zsvc["<b>Malware</b> – <b>File</b>: C:\Windows\zsvc.exe<br/><b>Purpose</b>: Decrypted payload written and started"] class malware_zsvc malware malware_sqhost["<b>Malware</b> – <b>File</b>: C:\Windows\sqhost.exe<br/><b>Purpose</b>: Copied payload for service execution"] class malware_sqhost malware service_node["<b>Action</b> – <b>T1569.002 System Services: Service Execution</b><br/>Created Windows service 'UPlugPlay' set to autou2011start"] class service_node action firewall_rule["<b>Action</b> – <b>T1562.004 Impair Defenses: Disable or Modify System Firewall</b><br/>Added inbound rule for sqhost.exe and disabled WinRM"] class firewall_rule action defender_exclusion["<b>Action</b> – <b>T1564.012 Hide Artifacts: File/Path Exclusions</b><br/>Added Microsoft Defender exclusion for C:\Windows\dell"] class defender_exclusion action tool_mimikatz["<b>Tool</b> – <b>Name</b>: Mimikatz (miWalk32/miWalk64)<br/><b>Description</b>: Harvests credentials from LSA Secrets"] class tool_mimikatz tool credential_dump["<b>Action</b> – <b>T1003.004 OS Credential Dumping: LSA Secrets</b><br/>Deployed Mimikatz binaries to steal credentials"] class credential_dump action discovery["<b>Action</b> – <b>T1016 System Network Configuration Discovery</b><br/>Collected host name, domain and IP configuration"] class discovery action archive["<b>Action</b> – <b>T1560.003 Archive via Custom Method</b><br/>Compressed data using LZNT1 before exfiltration"] class archive action obfuscation["<b>Action</b> – <b>T1027.015 Obfuscated Files or Information: Compression</b><br/>Used LZNT1 compression, RC4 encryption and doubleu2011base64"] class obfuscation action c2_web["<b>Action</b> – <b>T1102.002 Web Service: Bidirectional Communication</b><br/>HTTP GET/POST with parameters i r add h enckey answ"] class c2_web action c2_http["<b>Action</b> – <b>T1071.001 Application Layer Protocol: Web Protocols</b><br/>HTTP traffic over clearweb and TOR"] class c2_http action c2_tor_proxy["<b>Action</b> – <b>T1090 Proxy</b><br/>Routed C2 traffic through TOR hidden service"] class c2_tor_proxy action c2_multi_hop["<b>Action</b> – <b>T1090.003 Proxy: Multi-hop Proxy</b><br/>Used TOR network for multiu2011hop anonymity"] class c2_multi_hop action lateral_movement["<b>Action</b> – <b>T1021 Remote Services</b><br/>Downloaded rdpcIip.exe for RDP bruteu2011force protection and potential lateral movement"] class lateral_movement action tool_rdpcIip["<b>Tool</b> – <b>Name</b>: rdpcIip.exe<br/><b>Description</b>: Monitors RDP failures and updates firewall rules"] class tool_rdpcIip tool netdefender["<b>Action</b> – <b>T1562.004 Impair Defenses: Disable or Modify System Firewall</b><br/>Monitors event ID 4625 and adds firewall blocks for bruteu2011force IPs"] class netdefender action %% Connections showing flow initial_access –>|executes| tool_cmd tool_cmd –>|writes| malware_xor_key initial_access –>|executes| tool_powershell tool_powershell –>|downloads_and_decrypts| malware_zsvc malware_zsvc –>|copies_to| malware_sqhost malware_sqhost –>|installs| service_node service_node –>|creates| firewall_rule service_node –>|adds_exclusion| defender_exclusion service_node –>|spawns| credential_dump credential_dump –>|uses| tool_mimikatz credential_dump –>|collects| discovery discovery –>|archives| archive archive –>|obfuscates| obfuscation obfuscation –>|sent_via| c2_web c2_web –>|communicates_via| c2_http c2_http –>|routed_through| c2_tor_proxy c2_tor_proxy –>|provides| c2_multi_hop c2_multi_hop –>|supports| lateral_movement lateral_movement –>|uses| tool_rdpcIip tool_rdpcIip –>|adds| netdefender "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:
    The adversary has gained remote code execution on the victim host and wishes to collect low‑level hardware and OS version details for inventory and future payload tailoring. To stay “living‑off‑the‑land”, the actor uses built‑in Windows utilities that are unlikely to be blocked:

    1. Query OS version – cmd.exe /c ver (classic version string).
    2. Harvest motherboard manufacturer – wmic baseboard get Manufacturer.
    3. Collect computer model – wmic ComputerSystem get Model.

    These commands are executed sequentially in a single PowerShell script to mimic a realistic post‑exploitation module. Each command produces a distinct process‑creation event that matches the Sigma rule’s conditions.

  • Regression Test Script:

    # Prometei‑style system fingerprinting simulation
# ------------------------------------------------
# 1. OS version
cmd.exe /c ver

# 2. Motherboard manufacturer
wmic baseboard get Manufacturer

# 3. Computer model
wmic ComputerSystem get Model

  • Cleanup Commands:

    # Remove generated event logs from the local test machine (optional)
wevtutil cl Microsoft-Windows-Sysmon/Operational
wevtutil cl Security

End of Report

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free