Field Notes: EtherRAT Distributed Through a Legitimate Intune Workflow

What it is

A DFIR case where EtherRAT, a Node.js backdoor, reached four endpoints through a customer's own Intune app deployment. The customer had imported a malicious MSI posing as Advanced IP Scanner (version 7.5.12.0) and assigned it to managed devices. Intune was not compromised. The deployment was authorized, and the installer was the problem.

How it works

The MSI was deployed over about a month. On the endpoints, msiexec.exe ran under MDMAppInstaller.exe and omadmclient.exe with silent switches. The chain then ran:

• An obfuscated PowerShell script in a randomized %LOCALAPPDATA% directory (e.g. ...\WwajyG9wqS3U\aWhXKGlA.ps1) checked for Node.js and downloaded it from the official site if missing.
• Node ran DdkExG1tIy.ini as its script. The extension is cosmetic; it is obfuscated JavaScript.
• The runtime was renamed FbtRYX8x.exe.
• The malware beaconed over TCP/443 to public Ethereum RPC providers. EtherRAT uses a smart contract as a dead drop for its C2 configuration.
• Post-compromise it collected locale, AV products, GPU, domain membership, Machine GUID and disks, and ran net session and net use.
• On one endpoint a PowerShell script captured the primary screen and wrote it as Base64 to %LOCALAPPDATA%\Temp\ss_<digits>.txt. This triggered the original Defender alert.

Likely entry point: on the earliest endpoint, Chromium history showed a Bing search for "advanced ip scanner msi" and a visit to https://github.com/AdvancedIPScanner/download five days before the first Intune install.

What to do

Trace the Intune link. Match the endpoint's MSI ProductCode against Intune's app inventory. The installed display name and publisher were randomized (9FAj2kCcNs, nAQUEdLa), so the name won't match. The ProductCode will.

Connect-MgGraph -Scopes "DeviceManagementApps.Read.All"
Get-MgDeviceAppManagementMobileApp -All |
    Where-Object {
        $_.AdditionalProperties['@odata.type'] -eq
        '#microsoft.graph.windowsMobileMSI'
    } |
    Select-Object DisplayName, @{
        Name = 'ProductCode'
        Expression = { $_.AdditionalProperties['productCode'] }
    }, @{
        Name = 'Version'
        Expression = { $_.AdditionalProperties['productVersion'] }
    }

The malicious entry appeared as Advanced IP Scanner, ProductCode {6FB2BB4F-67D5-4B13-8829-001C1E5E05DF}, version 7.5.12.0.

Hunt on behavior, not hashes. Three hosts had a downloaded Node copy, but the fourth copied C:\Program Files\nodejs\node.exe to C:\Program Files\nodejs\FbtRYX8x.exe, giving a different hash. A hash search for the renamed runtime would have missed it. Pivot instead on:

• msiexec.exe spawned by MDMAppInstaller.exe / omadmclient.exe
• a renamed node.exe running a .ini file
• the payload filename
• connections to the Ethereum RPC hosts

Network indicators (TCP/443): eth.merkle[.]io, rpc.mevblocker[.]io, eth-mainnet.public.blastapi[.]io, eth.drpc[.]org, mainnet.gateway.tenderly[.]co, ethereum-rpc.publicnode[.]com, rpc.flashbots[.]net.

Second lure. A second GitHub repo offered Advanced_IP_Scanner_2.5.4594.1.msi, SHA-256 48ce8681167128a8cd84b6befd98b94d97c00a4f4868a3dbdfc01c44d887e49f. The same account hosted other repos impersonating utilities.

Caveats

• The repo was gone, so the original download could not be tied to the package deployed via Intune. The link is a plausible sequence, not proven.
• Ethereum RPC traffic alone did not identify the malware family. Public RPC endpoints are also used by legitimate software.
• The other repos under the second account were not checked for malicious content.
• Attribution to EtherRAT rests on similarity to Atos, DFIR Report and Malwarebytes write-ups, not on a family-specific indicator.