UAC-0184 Malware Chain Leverages bitsadmin and HTA Files

Key Takeaways

• The UAC-0184 threat group is deploying a sophisticated malware chain targeting Ukrainian military-related entities.
• The attack leverages legitimate Windows tools, specifically bitsadmin and HTA files, for discreet payload delivery.
• Attackers employ social engineering and conditional payload delivery to evade detection and analysis.
• The campaign uses legitimate, signed software (like PassMark BurnInTest and Visual Studio) to mask malicious command-and-control operations.

A sophisticated new attack chain, attributed to the threat group UAC-0184, is actively compromising systems by exploiting native Windows functionalities. This campaign utilizes the built-in bitsadmin tool and HTA files to deliver malicious payloads, primarily targeting military-affiliated individuals and organizations within Ukraine. A detailed analysis of this activity is available in a comprehensive report from Synaptic Security.

This operation distinguishes itself through its meticulous execution and patience, contrasting sharply with less refined campaigns observed recently. The attackers initiate the compromise through social engineering, enticing victims with themes such as criminal proceedings, combat footage, or personal contact requests, prompting them to open seemingly innocuous yet weaponized documents.

Upon opening a malicious document—disguised as a PDF, Word, or Excel file—the system discreetly employs bitsadmin to retrieve an HTA file from a remote server controlled by the adversary. This HTA file is then executed via mshta.exe, advancing the infection without triggering immediate security alerts.

Gated Payload Delivery and Evasion

Analysts at Synaptic Security highlighted that the payload delivery mechanism is “gated.” This means the malicious software is only served to systems that meet specific criteria, a tactic likely designed to bypass sandboxes and evade detection by security researchers. This conditional delivery significantly complicates malware analysis and allows the attackers to maintain persistence over extended periods without attracting undue attention.

Once executed, the HTA file deploys a hidden PowerShell command that downloads a ZIP archive, named dctrprraclus.zip, from the attacker’s server at IP address 169.40.135.35.

UAC-0184 Malware Chain

The downloaded archive unpacks its contents into a folder within the AppData directory. It then simultaneously launches two files: a music visualizer application named Cluster-Overlay64.exe and a decoy PDF titled Scan_001.pdf. The PDF serves as a distraction for the victim, while the true infection proceeds silently in the background.

The UAC-0184 group demonstrates considerable operational sophistication through its broader toolset. A key element of the final infection stage involves the repurposing of legitimate PassMark BurnInTest network components. These components are used to establish a covert command-and-control (C2) channel, listening on UDP port 31339 for multicast peer discovery traffic. This strategic abuse of a Microsoft-signed software stack provides the attackers with a convincing cover, embedding their malicious activities deep within trusted processes.

While the use of bitsadmin for file downloads is not novel, its combination with HTA file execution is a deliberate choice that enables the attackers to blend their activities with normal Windows background operations. Bitsadmin, a native Windows command-line utility for background file transfers, is frequently abused by threat actors, often escaping detection by both users and many endpoint security solutions.

Upon execution, the HTA file drops a multi-component package into the ApplicationData32 folder. This package includes Cluster-Overlay64.exe, openvr_api.dll, filter.bin, and kernel-diag.lib. The actual malicious code is not contained within the main executable but is instead embedded within DLL files and encoded local blobs. This code is decrypted at runtime through a multi-stage process involving XOR operations and LZNT1 decompression. The ultimate payload is then side-loaded into VSLauncher.exe, a legitimate Microsoft-signed Visual Studio binary, further cloaking the malicious activity under a trusted digital identity.

Signed Software Repurposed as a Cover Identity

A particularly notable aspect of this campaign is the attacker’s aggressive reliance on legitimate, digitally signed software to conceal their malicious actions from defensive measures. PassMark Endpoint, a genuine commercial network testing utility, is leveraged as the final network-facing component. It incorporates capabilities such as process memory dumping via MiniDumpWriteDump and peer data transfer over TCP port 31339, all under the guise of legitimate software.

What You Should Do

• Monitor for Suspicious Process Activity: Look for concurrent usage of bitsadmin.exe and mshta.exe. Pay particular attention to temporary HTA file patterns, such as ~tmp(…).hta, being written to the %TEMP% directory.
• Network Traffic Analysis: Monitor for UDP traffic directed towards 224.0.0.255 on port 31339. This is the PassMark multicast discovery address, which UAC-0184 repurposes for C2 peer discovery. Also, be vigilant for unexpected TCP traffic on port 31339.
• File System Integrity Checks: Investigate any instances of VSLauncher.exe running from unusual locations, especially outside of legitimate Visual Studio installation paths. Immediately investigate unexpected file creation events within the %APPDATA%ApplicationData32 directory.
• User Education: Reinforce training on social engineering tactics, particularly lures involving criminal proceedings, combat videos, or personal contact requests in unsolicited emails or messages.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.