CNCMachineRMS — an undocumented remote-access trojan delivered through a four-stage BabaDeda loader chain that smuggles shellcode via a benign Windows date-formatting API
LevelBlue SpiderLabs documents CNCMachineRMS, a previously undocumented 1.14 MB x64 remote-access trojan delivered through a four-stage BabaDeda loader chain. A ClickFix-style lure launches a legitimately signed IBM SPSS IDE executable (WinWrapIDE.exe), abusing its scripting engine to load a malicious DLL: "a ClickFix lure launches a legitimately signed IBM SPSS IDE executable, whose scripting engine is abused to load a malicious DLL" (LevelBlue SpiderLabs, 2026-08-10). Four decoy DLLs then load in sequence through standard Windows DLL import resolution before the final stage smuggles its shellcode into execution via EnumTimeFormatsEx, a benign date-formatting Windows API: "the final stage smuggles shellcode into execution via EnumTimeFormatsEx, a benign date-formatting API" (LevelBlue SpiderLabs, 2026-08-10) — a technique that hides the injection point from analysts looking for conventional process-injection APIs.
The final implant has no import table and resolves its APIs by hash at runtime, builds its strings on the stack rather than storing them statically, uses a custom C2 protocol, takes a screenshot on first contact, beacons roughly every 600 seconds, and installs seven distinct persistence mechanisms: "it takes a screenshot on first contact, then beacons every 600 seconds, with seven persistence mechanisms" (LevelBlue SpiderLabs, 2026-08-10). Capabilities include interactive shell access, file management, screen capture and local account backdoors. BabaDeda-chain ClickFix lures are a recurring initial-access vector across the sectors this pipeline tracks, making the delivery mechanism as relevant as the payload itself.
Triage: the API-hashing and stack-built-strings design defeats static string-based detection, so behavioural signals carry the weight here — a legitimately signed application (IBM SPSS or any similarly abused signed binary) spawning a scripting-engine child process that loads an unsigned DLL is the first anomaly, and a process invoking EnumTimeFormatsEx immediately followed by execution flow transferring into memory it just wrote (rather than into a legitimate formatting routine) is the discriminator against the API's ordinary, benign use — no legitimate application calls this function as a prelude to code execution elsewhere in its own address space.
A ClickFix lure launches a legitimately signed IBM SPSS IDE executable, whose scripting engine is abused to load a malicious DLL.
The final stage smuggles shellcode into execution via EnumTimeFormatsEx, a benign date-formatting API.
It takes a screenshot on first contact, then beacons every 600 seconds, with seven persistence mechanisms.
ATT&CK mapping
5 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Execution TA0002
T1204.002User Execution: Malicious File
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
Persistence TA0003
T1547Boot or Logon Autostart Execution
Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.
Privilege Escalation TA0004
T1055Process Injection
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
T1547Boot or Logon Autostart Execution
Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.
Stealth TA0005
T1027Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
T1055Process Injection
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.