DenoRAT

The chain then leveraged a likely AI-generated PowerShell stage to install the Deno runtime and launch the next-stage Deno-based loader, DinDoor.

DenoRAT ultimately functioned as a loader for NightshadeC2, receiving a task from the C2 that launched a Python-based in-memory loader to decrypt and execute the NightshadeC2 RAT/infostealer payload.

Once Deno is available, the script runs it with full permissions using deno run -A to fetch and execute the remote launcher.

Before injection, the malware creates a named pipe with CreateNamedPipeW to support inter-process communication with the injected DLL

Before injection, the malware creates a named pipe with CreateNamedPipeW to support inter-process communication with the injected DLL and starts the Chromium-based browser process in a suspended state via CreateProcessW with CREATE_SUSPENDED flag

Persistence is established by fetching DinDoor (launcher-1) from the C2, writing it to disk, and creating a new registry value in the HKCU Run key

It then performs DLL injection [ T1055.001 ] by allocating memory in the target browser process with VirtualAllocEx , writing the DLL with WriteProcessMemory , changing protections to PAGE_EXECUTE_READ via VirtualProtectEx , and starting execution via CreateRemoteThread .

Before injection, the malware creates a named pipe with CreateNamedPipeW to support inter-process communication with the injected DLL and starts the Chromium-based browser process in a suspended state via CreateProcessW with CREATE_SUSPENDED flag

Persistence is established by fetching DinDoor (launcher-1) from the C2, writing it to disk, and creating a new registry value in the HKCU Run key

The DenoRAT stager, also known internally as, "launcher-2" is obfuscated via Obfuscator.io

It then performs DLL injection [ T1055.001 ] by allocating memory in the target browser process with VirtualAllocEx , writing the DLL with WriteProcessMemory , changing protections to PAGE_EXECUTE_READ via VirtualProtectEx , and starting execution via CreateRemoteThread .

This script is simply a stager that decrypts and executes the next stage.

To prepare for injection, it enumerates running processes matching the browser list below using the Windows APIs CreateToolhelp32Snapshot , Process32First , and Process32Next .

sysinfo System information collection and exfiltration to C2, including: username, hostname, domain, os name, os version, os build, installed anti-virus, cpu count, gpu count, installed RAM (MB), running as admin, has admin rights

In the fingerprinting process ( sysinfo task), DenoRAT enumerates over a specific list of directories to identify installed Anti-Virus software.

screenshot Uses user32/gdi32 to capture a screenshot of the victim's desktop, sent to the C2 as a base64 encoded JPEG file

DenoRAT supports both WebSocket and HTTP polling for communication with its C2 server. In this instance, DenoRAT uses HTTP

It is responsible for downloading and executing a Microsoft Installer (MSI) file that begins the infection process, ultimately leading to DinDoor, DenoRAT, and NightshadeC2.

vnc-start Stream the victim's desktop and accept remote mouse, keyboard, and clipboard events.

DenoRAT supports both WebSocket and HTTP polling for communication with its C2 server... /message-event POST Data exfil to C2, e.g. victim host information

Matching processes are then opened and terminated using OpenProcess and TerminateProcess .