A ClickFix prompt can end in a remote-access foothold. CNCMachineRMS, an undocumented x64 RAT deployed at the end of a BabaDeda loader chain that turns a user-driven execution event into persistent hands-on-keyboard access.
Rather than behaving like a conventional commodity stealer, the 1.14 MB implant is an access platform and second-stage delivery mechanism: its operational impact depends on the payloads its controller chooses to deploy after compromise.
The chain begins with a signed IBM SPSS WinWrap Basic IDE, WinWrapIDE.exe. The signed binary is not malicious; attackers abuse its COM-enabled scripting engine to activate a dropped DLL.
Four decoy DLLs then load through standard import resolution, including Import Address Table redirection, avoiding runtime library-loading patterns security products prioritize.
The final decoy reads shellcode from model.dat, hides it inside a noise-filled buffer, and invokes it through the EnumTimeFormatsEx callback.
In effect, Windows’ date-format enumeration machinery enters the shellcode, leaving no direct malware call to the payload entry point.
That shellcode is the BabaDeda stage, which may appear inert when detonated without its configuration file.
HelperStandardizationApplication.bin contains two obfuscation layers over a serialized property tree, not encryption, despite near-maximum entropy. Its decoded blobs include a task script and the embedded CNCMachineRMS payload.
This separation is a sandboxing trap: a loader without its storage artifact produces a message box and idles, masking the implant.
CNCMachineRMS RAT
LevelBlue Researchers said that, CNCMachineRMS is designed to minimize detection opportunities. It exposes no import table, resolves APIs by hash, and builds strings on the stack at runtime.
The RAT also uses the same custom “Storage” container for on-disk configuration, its memory-resident configuration, local state, and command-and-control messages.
That design frustrates indicators and enables a single parser to represent both configuration and operator tasking.
Its feature set makes an affected endpoint an incident-response priority. Recovered strings map to an interactive shell, file management, screen capture, local-account creation and privileged-group modification, seven persistence options, and 20 typed commands for staging and executing additional content.
The implant profiles domain membership, SID, privilege state, motherboard and BIOS serials, and installed antivirus before it begins C2 activity.
It beacons every 600 seconds to notepadreleased.com or 85.158.110.78 over TCP/443, resolving domains through DoH providers; the raw TCP channel can fall back to WinHTTP.
Operators can also direct the RAT to establish Run-key, scheduled-task, or Startup-folder persistence, and its local-account capability creates an alternate recovery path into the environment.
Defenders should treat CNCMachineRMS as a live-access framework, not a self-contained collection payload. Hunt for the signed IDE executing from an unusual directory, the CNCMachineRMS\tasks workspace, and %LOCALAPPDATA%\SProject\sp.bin.
The latter is padded with random data and changes size and hash on each write; detection should instead validate the documented Storage-header arithmetic.
Useful telemetry includes DoH followed by periodic TCP/443 connections, suspicious “IBM SPSS WinWrap Basic IDE” Run keys or SYSTEM logon tasks, and events 4720 and 4732 indicating local-account creation and privileged-group additions.
IOCs
| Category | Indicator / Artifact | Details |
|---|---|---|
| Network C2 | notepadreleased[.]com:443/TCP | Suspected command-and-control endpoint |
| Network C2 | 85[.]158.110.78:443/TCP | Suspected command-and-control IP address |
| Beaconing | 600 seconds | Beacon interval of 10 minutes |
| Retry behavior | 60 seconds | Retry interval after a failed C2 connection |
| DNS evasion | dns.google | DNS-over-HTTPS resolver; queries may bypass internal DNS logging |
| DNS evasion | cloudflare-dns.com | DNS-over-HTTPS resolver; queries may bypass internal DNS logging |
| DNS evasion | dns.quad9.net | DNS-over-HTTPS resolver; queries may bypass internal DNS logging |
| Host artifact | %TEMP%\CNCMachineRMS\tasks\*\task_payload.bin | Task-associated payload binary; * represents one or more task-specific subdirectories/files |
| Host artifact | %LOCALAPPDATA%\SProject\sp.bin | Multi-megabyte binary with an apparently random or variable file size |
| Persistence | Run key named IBM SPSS WinWrap Basic IDE | Registry Run-key persistence masquerading as IBM SPSS/WinWrap Basic software |
| Persistence | Scheduled task named IBM SPSS WinWrap Basic IDE | Possible scheduled-task persistence using the same masquerading name |
| Filesystem artifact | C:\Intel | Empty, unexplained directory; potentially created as a staging or camouflage location |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now
