Build1 publisher2 min readPublished
VectraRAT reaches high integrity by reparenting itself under auto-elevating computerdefaults.exe
SOCRadar's teardown of the $250-a-month service puts the elevation step behind an administrator account and permissive UAC settings, so on a fleet of standard users the rental buys remote access and credential theft and stops there.
The Engineer · Build desk
What happened
- SOCRadar STRU documented VectraRAT as a Go-based management server paired with C++ Windows malware, delivered through ClickFix or Amadey and rented starting at $250 per month.
- Up to one week of C2 logs held 38 actual breach sessions, and SOCRadar confirmed data theft through 21 file transfers across 8 devices.
- Of the victim entries that recorded operating system information, 48 percent were enterprise Windows systems.
- The advertised feature set covers hidden desktop operation, credential harvesting, a SOCKS5 proxy relay and a conditional UAC bypass, with browser credentials collected on first connection.
- The implant speaks a custom TCP protocol to the operator's VectraHub console, and the configurations SOCRadar analysed used TCP port 3308.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint On a fleet where daily accounts are not local administrators, the tenant stays at user integrity and the $250 buys browser credentials and file access.
- exposure The SOCKS5 relay puts the endpoint's egress in scope as well as its disk, because someone else's traffic leaves the network from that machine's address.
- decision Detection teams have to pick between a port rule and a process-lineage rule, and only the lineage rule survives an operator changing the configured port.
- capability With the operator working on a desktop the user never sees, user-reported screen anomalies stop being a usable early signal for this family.
The elevation chain runs four steps.
1. The malware launches `winver.exe` as a debug target, obtains a handle to the debug object, and detaches from it [11]. 2. It reuses that handle to launch the auto-elevating `computerdefaults.exe` as the debug target [12]. 3. Debugging events hand it a handle to the elevated process, and it duplicates that handle [13]. 4. It launches subsequent programs with `computerdefaults.exe` as the parent, and the child inherits a high-integrity-level token [14].
SOCRadar puts conditions on the chain: an administrator account, and UAC settings where auto-elevation can be abused from a non-elevated process [15]. UACME, the public reference collection the writeup cites, has the same limit, assuming administrator accounts at default UAC settings and no elevation for standard users without admin credentials [16].
Both delivery routes need something from the target first. ClickFix mimics an authentication step so the user pastes and runs a command in the Run dialog [7]. The Amadey route needs the host compromised already [24].
The evidence is one hub's traffic over up to a week [4]. The confirmed thefts work out to about 2.6 file transfers per device [25]. For the enterprise-Windows share to describe a given fleet, the victim entries that recorded an OS would have to resemble the ones that did not [6]. Dark Reading's coverage of the same research is headlined "VectraRAT Can Hack Windows Enterprises for $250 per Month" [26].
The indicator list is offered as inference: the `LocalVectra.Client.SingleInstance` mutex, `callback.json` in the temp directory, TCP/3308 connections, and suspicious parent-child relationships involving `computerdefaults.exe` [20]. The implant reads its C2 address from `callback.json` or from embedded configuration [8], and SOCRadar notes that ports can change, so blocking TCP/3308 alone does not guarantee safety [21]. In my view the port rule is the last of the four to write.
One dependency sits on the seller's side. The management server has to operate with a valid license and return a response in the protocol format the malware expects when it connects [22]. SOCRadar's stated mitigation is to operate as a standard user and review UAC settings, which it describes as limiting the abuse of auto-elevation [23].
What to watch
- A longer C2 log window from SOCRadar would tell you whether 38 sessions in a week is typical volume or a slice.
- A variant of the debug-handle chain that elevates from a standard user account would change who on a managed fleet is exposed.
- Whether VectraHub configurations move off TCP/3308 now that the port is published.