The report describes a multi-stage Windows intrusion chain that combines a concealed batch script, a PowerShell-based loader, and Donut-generated shellcode to stand up a persistent, memory-resident RAT with credential-theft capability. The loader delivers a .NET implant engineered for stealth, featuring strong anti-analysis coverage, process injection, and interactive remote-control features. Stolen data is pushed out through Discord webhooks and Telegram bots, reinforcing a modular design focused on in-memory execution and minimal on-disk footprint.
Analysis identified persistence via a per-user Run registry value that triggers a batch file hidden under %APPDATA% . The batch script contains an embedded Base64 blob that it extracts and decodes into a PowerShell stage. That loader decrypts a Donut shellcode payload and injects it into svchost.exe and explorer.exe , using Windows APIs such as CreateRemoteThread to execute the in-memory implant. The decrypted stage resolves to a heavily obfuscated .NET assembly that includes Pulsar RAT functionality plus a dedicated stealer module. Researchers observed anti-VM and anti-debug checks, safeguards meant to detect analysis or injection monitoring, and command handlers that attempt to weaken local defenses—such as disabling Task Manager and manipulating UAC-related behavior.
Block creation of hidden batch files in user-writable AppData paths and investigate unknown entries added to per-user Run keys. Monitor PowerShell command lines for Base64 decode patterns and signs of remote memory injection activity. Use endpoint tooling capable of recognizing Donut shellcode traits, detecting in-memory .NET assemblies, and flagging C2 traffic to Discord and Telegram. Enforce application allow-listing and apply egress controls that restrict outbound access to webhook endpoints and messaging-based C2.
If detected, isolate the endpoint, stop the injected svchost.exe and explorer.exe instances tied to the malicious thread creation, and remove both the hidden batch file and the associated Run-key persistence. Capture memory images to preserve in-memory artifacts, extract and analyze the .NET payload, and hunt across the environment for matching behaviors and indicators. Reset potentially exposed credentials and revoke any compromised Discord/Telegram webhook tokens to prevent continued exfiltration.
Keywords: Windows malware, PowerShell loader, hidden batch file, AppData, Run key, Donut shellcode, CreateRemoteThread, process injection, in-memory .NET, Pulsar RAT, credential theft, Discord webhooks, Telegram bot, anti-VM, anti-debug.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands:
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
