An employee plugged in an unvetted USB drive. Windows AutoRun executed a dropper that planted a Remote Access Trojan disguised as a system process, which spawned encoded PowerShell, established dual persistence (registry + scheduled task), and called out to a Telegram-based C2 server — the entire chain completing in under 20 seconds. EDR caught the PowerShell-plus-outbound-C2 pattern in under 60 seconds. I led the host isolation, memory forensics, and org-wide threat hunt that confirmed no lateral spread.
- Root cause was policy, not detection failure — AutoRun/AutoPlay remained enabled with no USB device whitelisting
- The malware used disguise (svchost32.exe) plus dual persistence mechanisms — registry Run key and a scheduled task — anticipating single-point remediation
- Behavioral EDR correlation (PowerShell parent-child chain + outbound connection to a non-whitelisted IP) caught this in under 60 seconds, faster than signature-based detection would have
- Full org-wide threat hunt for matching IOCs found zero lateral movement — the isolation-before-remediation sequence prevented spread
The Problem
At 11:42:03 an employee inserted an unknown USB drive. AutoRun triggered autorun.inf, which executed a dropper that planted a payload disguised as a legitimate Windows process — C:\Users\Public\svchost32.exe — within two seconds. The malware immediately spawned an encoded, hidden PowerShell process and, within twelve seconds, had written a registry Run key for persistence. By the twenty-second mark it had established a live callback to a Telegram-based command-and-control server on a non-standard port, with keylogging, screenshot capture, and file exfiltration capabilities active.
The Approach
This was a behavioral-detection case, not a signature-match case — the malware sample was novel enough that traditional AV would likely have missed it. My response followed the standard L1 → L2 escalation model:
- Alert correlation — the EDR/SIEM alert fired on a specific behavioral pattern: an
explorer.exe → powershell.exeparent-process chain combined with an outbound connection to a non-whitelisted IP, corroborated against Windows Event IDs 4688 (process creation), 7045 (service installed), and 2003 (USB insertion) - Isolation without alerting the attacker — the host was isolated via EDR network containment rather than immediately killing the process, preserving the live infection for forensic capture
- Memory acquisition — captured a full memory dump with Magnet RAM Capture before any remediation touched the host, preserving volatile evidence of the C2 session and injected process memory
- Static and dynamic analysis — confirmed RAT capabilities from the memory dump and submitted file hashes to VirusTotal for IOC enrichment
Killing the process immediately would have destroyed the live C2 session in memory — the single richest source of evidence for understanding attacker capability and intent. Network isolation cuts the C2 channel while preserving forensic state.
Technical Analysis — Infection Chain
11:42:05 Dropper executes → plants C:\Users\Public\svchost32.exe
11:42:07 Encoded PowerShell spawned (-EncodedCommand -WindowStyle Hidden)
11:42:12 Registry persistence: HKCU\...\Run\SystemHost
11:42:20 C2 callback → 91.108.4.33:4444 (Telegram-based infra)
11:43:01 EDR/SIEM alert fires (< 60s detection lag)
11:44 L1 triage begins
11:50 Host isolated via EDR (network containment, no kill)
12:05 Memory dump acquired (Magnet RAM Capture)
12:30 Malware + persistence removed, host cleaned
13:00 Org-wide threat hunt launched
14:30 Host reimaged — incident declared contained
Challenges
Preserving evidence while containing the threat. The malware maintained an active C2 session — network isolation had to happen before any local remediation to avoid tipping off the attacker while the memory dump was captured.
Confirming no lateral spread. With dual persistence mechanisms already established on the source host, the org-wide threat hunt needed to search for both the registry key pattern and the scheduled task name across every endpoint, not just the file hash — the attacker could have varied the dropped filename on a second host.
netstat capture — active connections to remote hosts during the live infection window
| Type | Indicator | Description |
|---|---|---|
| File | C:\Users\Public\svchost32.exe | RAT payload disguised as a Windows system process |
| C2 IP | 91.108.4.33:4444 | Telegram-based C2 infrastructure, reverse-shell channel |
| Registry | HKCU\...\Run\SystemHost | Primary persistence mechanism |
| Task | \Microsoft\Windows\SystemMaintenance\HostUpdate | Secondary persistence via Task Scheduler |
| Behavior | powershell.exe -EncodedCommand -WindowStyle Hidden | Evasion via encoded, hidden execution |
Results
- Behavioral detection caught the infection in under 60 seconds — before keylogging or exfiltration capabilities were exercised
- Full memory forensics confirmed RAT capability and attacker infrastructure without destroying evidence
- Org-wide threat hunt for matching IOCs (file hash, registry key, scheduled task, C2 IP/port) confirmed zero lateral movement
- Host reimaged as a precaution; full containment closed within 2 hours 48 minutes including reimage
Lessons Learned
The single highest-leverage control missing here was policy, not tooling — AutoRun/AutoPlay should never be enabled organization-wide in 2026. The EDR behavioral detection worked exactly as designed, but it's a safety net for a preventable failure. I now treat "why was this preventable" as a mandatory question in every post-incident review, not just "how was it detected."
What I'd Improve
- Push USB device whitelisting via GPO/DLP as a standing recommendation on every endpoint security review, not just after an incident forces it
- Add automated memory acquisition to the EDR isolation playbook so evidence capture doesn't depend on manual analyst timing
- Build a correlation rule specifically for the registry-key + scheduled-task persistence pattern pair, since attackers frequently vary one but not both
References
- MITRE ATT&CK — T1091 Replication Through Removable Media
- MITRE ATT&CK — T1071 Application Layer Protocol
- Full repository — github.com/Cyber-Nate/SOC-USB-Malware-RAT-Analysis