MimiCRAT — ClickFix → Lua Loader → Meterpreter → C++ RAT
A multi-stage intrusion chain (Elastic Security Labs) that starts with a ClickFix social-engineering lure, runs an obfuscated PowerShell downloader, bypasses ETW/AMSI, then uses a Lua-based in-memory loader to stage Meterpreter-style shellcode and a native C++ remote-access trojan, MIMICRAT (a.k.a. AstarionRAT) — with token theft, a SOCKS5 proxy, and malleable C2 over HTTPS. Defensive hunt & harden pack — no offensive code.
01
Executive Summary
MimiCRAT (Elastic Security Labs, Feb 2026; also tracked as AstarionRAT) is a five-stage intrusion chain that begins with a ClickFix lure on compromised/typosquatted sites: the victim is tricked into pasting a command (Win+R / a fake "verify you are human" prompt) that launches an obfuscated PowerShell downloader. Stage two patches ETW and AMSI in memory and drops the next payload; stage three is a Lua-based loader (using luaalloc / luacpy / luaexe-style helpers) that maps shellcode entirely in memory; stage four is a Meterpreter-like reflective payload; stage five is the native C++ RAT, MIMICRAT.
MIMICRAT provides hands-on control: Windows access-token theft/impersonation, a built-in SOCKS5 proxy for pivoting, command execution, and file operations. It uses malleable C2 profiles over HTTPS (443) designed to look like ordinary web-analytics traffic. Because the chain is largely fileless and in-memory after the first PowerShell stage, detection centers on the ClickFix execution lineage, the ETW/AMSI-bypass + Lua-loader behavior, and the token-theft / SOCKS5 / malleable-C2 indicators.
⚠ Defender priority: ClickFix is the front door — hunt Q1 (browser/explorer → PowerShell from a RunMRU/clipboard paste) and educate users that "paste this to continue" is an attack. Then hunt Q2 (ETW/AMSI-bypass + Lua-loader artifacts), Q4 (in-memory/Meterpreter behavior), and Q5 (SOCKS5 / malleable-C2 egress). The whole chain runs from one pasted command — break Q1 and the rest never executes.
02
Source Review & Web Hunter Notes
| Tier | Source | Key Finding | Carry |
|---|---|---|---|
| 1 · Vendor research | Elastic Security Labs — MimiCRAT | 5-stage chain; ClickFix; ETW/AMSI bypass; Lua loader; Meterpreter; C++ RAT; token theft/SOCKS5 | yes |
| 2 · Vendor | ClickFix technique reporting (Proofpoint / Microsoft) | ClickFix delivery mechanics: fake CAPTCHA / Win+R paste → PowerShell | yes |
| 2 · Vendor | Meterpreter / malleable-C2 detection literature | Reflective-load + malleable-profile egress patterns | partial |
Decisions: front-door-first (ClickFix lineage is the cheapest, highest-leverage break); behavior-anchored across the fileless chain (ETW/AMSI bypass + Lua loader + in-memory Meterpreter); the Lua-helper names and malleable-C2 give specific hunts; payload hashes are fileless/rotating, so the chain behavior is the durable surface.
03
Hunt Brief & Attack Chain
Working hypothesis: A user is lured by ClickFix into pasting a command that launches obfuscated PowerShell, which bypasses ETW/AMSI, runs a Lua loader, maps Meterpreter shellcode, and deploys MIMICRAT for token theft, SOCKS5 pivoting, and malleable C2.
| Step | Behavior | Telemetry | Hunt Angle |
|---|---|---|---|
| 1 · ClickFix | Fake CAPTCHA / Win+R paste on a compromised site | RunMRU; browser→shell | Q1; N1 |
| 2 · PS downloader | Obfuscated PowerShell pulls the next stage | ProcessRollup2; script-block | Q1 / Q2 |
| 3 · ETW/AMSI bypass + Lua loader | In-memory patch + Lua-based shellcode map | module/file; script-block | Q2 / Q3 |
| 4 · Meterpreter | Reflective shellcode payload | ProcessRollup2; net | Q4; N2 |
| 5 · MIMICRAT | C++ RAT: token theft, SOCKS5, exec, file ops | ProcessRollup2; net | Q4 / Q5 |
| 6 · C2 | Malleable profiles over HTTPS/443 | NetworkConnectIP4; DNS | Q5; N3 |
Affected surface & telemetry
| Surface | Required Telemetry | Priority | Gap Risk |
|---|---|---|---|
| Workstations (users) | Process lineage + RunMRU/clipboard signals | Critical | Low — process telemetry |
| PowerShell | Script-block + module logging | High | Medium — logging gap |
| In-memory loader | AMSI/ETW-tamper + reflective-load signals | High | Medium — needs memory telemetry |
| Egress (C2/SOCKS5) | Proxy/DNS + netflow | Medium | Medium — malleable/HTTPS |
04
Consolidated IOC Table
The chain is largely fileless and C2 is malleable, so payload hashes/domains rotate. The ClickFix lineage, ETW/AMSI-bypass + Lua-loader, and token-theft/SOCKS5 behaviors are durable. Copy-ready blocks in §9.
| Type | Value | Conf | Action | Context |
|---|---|---|---|---|
| Behavior | ClickFix: browser/explorer → PowerShell via RunMRU/clipboard paste | high | detect | Front door — flagship |
| Behavior | Obfuscated PowerShell downloader (IEX / encoded / hidden) | medium | detect | Stage 1 |
| Behavior | ETW/AMSI bypass + Lua loader (luaalloc/luacpy/luaexe-style) | medium | hunt | In-memory map |
| Malware | MIMICRAT / AstarionRAT (token theft, SOCKS5) | medium | hunt | Native C++ RAT |
| Network | Malleable C2 over HTTPS/443 (mimics web analytics); SOCKS5 pivot | medium | hunt | C2 / lateral |
05
ATT&CK Mapping
| Tactic | Technique | Observed Behavior | Query / Control |
|---|---|---|---|
| Initial Access / Execution | T1204.004 / T1059.001 — ClickFix / PowerShell | Pasted command launches PowerShell | Q1; N1 |
| Defense Evasion | T1562.001 / T1620 — Impair defenses / reflective load | ETW/AMSI bypass; Lua in-memory map | Q2, Q3 |
| Execution | T1059 / T1106 — Script / native API | Lua loader + Meterpreter shellcode | Q3, Q4 |
| Privilege Esc / Defense Evasion | T1134 — Access-token manipulation | MIMICRAT token theft/impersonation | Q4 |
| Command & Control | T1090 / T1071.001 — Proxy / web C2 | SOCKS5 pivot; malleable HTTPS C2 | Q5, N3 |
| Collection / Exfil | T1005 / T1041 — Local data / C2 exfil | File ops + exfil over C2 | Q5 |
06
Native Audit-Log Hunts
| Hunt | Source | Logic | Response |
|---|---|---|---|
| N1 · ClickFix paste | Registry (RunMRU) + process | ...\RunMRU entries containing powershell/cmd/mshta; browser→shell lineage | Isolate; user coaching |
| N2 · PowerShell script-block | PowerShell Operational (4104) | Obfuscated/encoded blocks, AMSI/ETW patch strings, download cradles | Triage host; pull payload |
| N3 · Malleable-C2 egress | Proxy / DNS / netflow | HTTPS beacons with analytics-like URIs; SOCKS5 pivot to internal hosts | Block; identify host |
| N4 · Anomalous token use | Security (4624/4672/4648) | Process running under an impersonated token / explicit-cred logons from the host | Reset creds; scope |
07
CrowdStrike LogScale CQL Hunt Queries
Pick your tenant's cloud first — every "Open in Falcon" button below uses this selection.
Field names validated against the Falcon event reference; process hunts include
SyntheticProcessRollup2. The chain is fileless after stage 1 — Q1 (ClickFix) is the cheapest, highest-yield break. Pair the in-memory hunts (Q2-Q4) with PowerShell script-block logging.
Q1 · ClickFix lineage — browser/explorer → PowerShell
CONF HIGHFP LOW-MEDCOST LOW
Looks for: a browser or explorer spawning PowerShell/mshta with download/encoded cradles (the ClickFix paste). Accomplishes: breaks the front door. FP: some admin tooling — flag hidden/encoded/IEX cradles.
// HUNT: ClickFix lineage -> PowerShell download cradle // MITRE: T1204.004, T1059.001 | CONF: high FP: low-med COST: low // FP NOTES: flag browser/explorer parent + encoded/hidden/IEX cradles #event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/ | ParentBaseFileName=/^(chrome|msedge|firefox|brave|explorer|mshta)\.exe$/i | FileName=/^(powershell|pwsh|mshta|cmd)\.exe$/i | CommandLine=/(-enc|-e\s|-w\s?hidden|FromBase64|IEX|Invoke-Expression|DownloadString|curl|Invoke-WebRequest)/i | table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
Q2 · ETW / AMSI bypass indicators
CONF MEDFP MEDCOST LOW
Looks for: command-line patterns that patch AMSI/ETW (amsiInitFailed, EtwEventWrite, VirtualProtect on amsi.dll). FP: some red-team/security tooling — correlate to Q1 on the same host.
// HUNT: ETW/AMSI bypass strings (in-memory defense impair) // MITRE: T1562.001 | CONF: medium FP: medium COST: low // TUNING: pair with PowerShell script-block (4104); correlate to Q1 #event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/ | CommandLine=/(amsiInitFailed|amsi\.dll|AmsiScanBuffer|EtwEventWrite|ETW.{0,12}(patch|disable)|VirtualProtect)/i | table([@timestamp, ComputerName, UserName, FileName, CommandLine], limit=200)
Q3 · Lua-based loader artifacts
CONF MEDFP MEDCOST LOW
Looks for: a standalone Lua interpreter or Lua-loader helper names (luaalloc/luacpy/luaexe) and .lua scripts in user/temp paths. FP: some games/apps embed Lua — flag user-temp + unsigned context; correlate to Q1/Q2.
// HUNT: Lua-based in-memory loader (luaalloc/luacpy/luaexe) // MITRE: T1059, T1620 | CONF: medium FP: medium COST: low // TUNING: some apps embed Lua; flag user/temp paths + correlate to Q1/Q2 #event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|PeFileWritten/ | (FileName=/^lua(5\d?|jit)?\.exe$/i or CommandLine=/(luaalloc|luacpy|luaexe)/i or TargetFileName=/\\(Temp|AppData|Users)\\.+\.lua$/i) | table([@timestamp, ComputerName, UserName, FileName, CommandLine, TargetFileName], limit=200)
Q4 · MIMICRAT — token theft / in-memory RAT behavior
CONF MEDFP MEDCOST LOW
Looks for: a user/temp-path or injected process spawning children under unusual tokens, or behaviors consistent with token impersonation. FP: correlate to Q1-Q3; pair with N4 (4624/4648). Tune to your environment.
// HUNT: MIMICRAT token theft / RAT child behavior // MITRE: T1134, T1106 | CONF: medium FP: medium COST: low // TUNING: pair with Security 4624/4648; correlate to Q1-Q3 lineage #event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/ | ImageFileName=/\\(Temp|AppData|ProgramData|Users\\Public)\\/i | FileName=/^(cmd|powershell|net|net1|whoami|nltest|tasklist)\.exe$/i | table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, FileName, CommandLine], limit=200)
Q5 · SOCKS5 pivot / malleable-C2 egress
CONF MEDFP MEDCOST MED
Looks for: a user/temp-path or non-browser binary making outbound HTTPS/443 connections (malleable C2) or acting as a SOCKS5 pivot. FP: medium — baseline normal egress; correlate to Q1-Q4.
// HUNT: MIMICRAT SOCKS5 pivot / malleable-C2 egress // MITRE: T1090, T1071.001 | CONF: medium FP: medium COST: med // TUNING: baseline normal egress; flag non-browser user-path binaries beaconing 443 #event_simpleName=NetworkConnectIP4 | ImageFileName=/\\(Temp|AppData|ProgramData|Users\\Public)\\/i | ImageFileName!=/\\(chrome|msedge|firefox|brave)\.exe$/i | RemotePort=443 | table([@timestamp, ComputerName, ImageFileName, RemoteAddressIP4, RemotePort], limit=200)
Q6 · RunMRU ClickFix paste artifact (registry)
CONF MED-HIGHFP LOWCOST LOW
Looks for: a Run-dialog (RunMRU) entry containing powershell/cmd/mshta — the hallmark ClickFix paste. Accomplishes: a high-fidelity ClickFix signal. FP: low — few users type powershell into Win+R.
// HUNT: ClickFix RunMRU paste artifact // MITRE: T1204.004 | CONF: med-high FP: low COST: low // FP NOTES: legit users rarely paste powershell/mshta into the Run dialog #event_simpleName=/AsepValueUpdate|RegGenericValueUpdate/ | RegObjectName=/\\Explorer\\RunMRU$/i | RegStringValue=/(powershell|pwsh|mshta|cmd|curl|Invoke-|FromBase64|-enc)/i | table([@timestamp, ComputerName, UserName, RegStringValue], limit=200)
08
CrowdStrike Custom IOA Recommendations
| IOA Name | Field Patterns | Benign Exclusions | Deployment Path |
|---|---|---|---|
| MimiCRAT — ClickFix lineage | Parent chrome/msedge/explorer.exe; Child powershell/mshta + encoded/IEX cradle | Sanctioned admin scripts (allow-list) | Endpoint Security → Custom IOA → Process Creation, Detect+Block |
| MimiCRAT — AMSI/ETW bypass | CommandLine amsiInitFailed/EtwEventWrite/AmsiScanBuffer | Vetted security tooling | Custom IOA → Process Creation, Detect |
Q1/Q6 (ClickFix) are strong promotions — the entire chain depends on that first paste. Q2-Q5 stay tuned hunts (fileless / generic). Pair with PowerShell script-block logging for stage-2 visibility.
09
Machine-Readable IOC Appendix
Grouped IOC Quick-Copy
One-click blocks for detection. The chain is fileless and C2 is malleable — behavior is the durable surface. Add per-incident atoms during triage.
Behavioral Signaturesdetection logic
ClickFix: browser/explorer spawning powershell/mshta with encoded/IEX/DownloadString cradle RunMRU registry entry containing powershell/cmd/mshta (Win+R paste artifact) Command-line ETW/AMSI bypass: amsiInitFailed, AmsiScanBuffer, EtwEventWrite, VirtualProtect on amsi.dll Lua loader: lua/luajit interpreter or luaalloc/luacpy/luaexe helpers; .lua in %TEMP%/%AppData% User/temp-path or injected process spawning recon (whoami/net/nltest) under an unusual token (MIMICRAT) Non-browser user-path binary beaconing HTTPS/443 (malleable C2) or acting as a SOCKS5 pivot
Named Tooling / StagesMimiCRAT
MimiCRAT / AstarionRAT # native C++ RAT (token theft, SOCKS5 proxy, exec, file ops) Stage 1: ClickFix lure -> obfuscated PowerShell downloader Stage 2: ETW + AMSI bypass (in-memory patch) + payload drop Stage 3: Lua-based in-memory loader (luaalloc / luacpy / luaexe helpers) Stage 4: Meterpreter-like reflective shellcode Stage 5: MIMICRAT native C++ RAT C2: malleable profiles over HTTPS/443, mimicking web-analytics traffic
User-Coaching TellsClickFix awareness
"Verify you are human" / fake CAPTCHA asking you to press Win+R and paste Any site instructing: copy this, press Win+R (or Win+X / Terminal), paste, Enter PowerShell/cmd text on the clipboard after visiting a site # Rule for users: legitimate sites NEVER ask you to paste a command to continue.
Hardening / Blockdefense-in-depth
User awareness: "paste this command to continue" = attack (ClickFix) -- the cheapest fix PowerShell Constrained Language Mode + script-block/module logging fleet-wide ASR: block credential/LSASS theft; block obfuscated scripts; block executable content from web Consider disabling/monitoring the Win+R Run box on user tier via GPO AMSI on; promote Q1/Q6 (ClickFix) to Detect+Block IOAs Egress: baseline + flag non-browser user-path binaries beaconing 443 / SOCKS5 pivots
10
Hardening — Tiered & Deployable
Break the ClickFix front door, constrain PowerShell, and surface the in-memory chain.
Immediate — Break the front door
- User awareness: "paste this command to continue" is an attack — M1017. ClickFix dies if the user doesn't paste — the cheapest control.
- Promote Q1/Q6 (ClickFix lineage + RunMRU) to Detect+Block — M1040.
- PowerShell Constrained Language Mode + script-block/module logging — M1038 / M1047. Blunts stages 1-2 and feeds N2.
- ASR: block obfuscated scripts + executable content from web/email; AMSI on — M1042.
Near term — Constrain & observe (pilot first)
- Disable/monitor the Win+R Run box on the user tier via GPO — M1038. Removes the ClickFix paste surface.
- WDAC/app control for LOLBins + unsigned interpreters (lua.exe) — M1038.
- Egress control: baseline + flag non-browser user-path binaries beaconing 443 / SOCKS5 — M1037.
Strategic — Reduce RAT surface
- Application allowlisting; default-deny user-path execution — M1038.
- Credential-theft hardening (Credential Guard); phishing-resistant MFA — M1043 / M1032. Blunts token theft + reuse.
- Network segmentation to limit SOCKS5 pivoting — M1030.
11
Containment Runbook
| Phase | Actions | Owner | Evidence |
|---|---|---|---|
| Isolate | Network-contain the host; capture memory before reboot (fileless chain lives in RAM); preserve PowerShell logs + RunMRU | SOC L2 | Containment timestamp; Q1 event; memory image |
| Triage | Map ClickFix → PowerShell → Lua loader → Meterpreter → MIMICRAT; find C2/SOCKS5; assess token theft & lateral movement | IR | Process tree; script-block; C2 list |
| Eradicate | Kill the RAT; block C2; reset credentials touched on the host (token theft); remove any persistence | IR | Removal log; cred reset |
| Recover | Reimage if hands-on RAT control occurred; verify; restore from clean backup | IR + IT | Rebuild ticket |
| Harden | Promote Q1/Q6; CLM + script-block logging; ASR; user coaching; disable Win+R on user tier | Detection Eng | IOA enabled; logging on |
12
Detection Coverage Map & Validation
| Technique | Behavior | CQL | IOA | Coverage |
|---|---|---|---|---|
| T1204.004 / T1059.001 | ClickFix → PowerShell | Q1, Q6 | IOA-1 | Good + user coaching |
| T1562.001 | ETW/AMSI bypass | Q2 | IOA-2 | Partial + script-block (N2) |
| T1059 / T1620 | Lua in-memory loader | Q3 | — | Partial correlate to Q1/Q2 |
| T1134 / T1106 | MIMICRAT token theft | Q4 | — | Partial + 4624/4648 (N4) |
| T1090 / T1071.001 | SOCKS5 / malleable C2 | Q5 | — | Partial + proxy (N3) |
| T1204.004 | ClickFix lure delivery (web) | — | — | GAP web/proxy + awareness |
Validation gates: (1) confirm process lineage + RunMRU + PowerShell script-block + egress telemetry; (2) baseline any sanctioned admin PowerShell / Lua-using apps; (3) lab-test a benign chrome → powershell (Q1) and a benign RunMRU entry (Q6); (4) enable script-block logging + promote Q1/Q6. Break Q1 and stages 2-5 never run.
13
Hunt Summary Ticket
TITLE: Hunt — MimiCRAT (ClickFix -> Lua loader -> Meterpreter -> C++ RAT)
SEVERITY: High (multi-stage fileless RAT; token theft + SOCKS5 pivot)
SCOPE: User workstations; PowerShell logging; egress
HYPOTHESIS: ClickFix paste -> obfuscated PowerShell -> ETW/AMSI bypass -> Lua loader ->
Meterpreter shellcode -> MIMICRAT (token theft, SOCKS5, malleable HTTPS C2).
QUERIES RUN: Q1 ClickFix lineage (IOA) | Q2 ETW/AMSI bypass (IOA) | Q3 Lua loader |
Q4 token theft / RAT behavior | Q5 SOCKS5 / malleable C2 | Q6 RunMRU paste artifact
+ Native N1-N4 (RunMRU, script-block, C2 egress, anomalous token use)
DO FIRST: User coaching + Q1/Q6 — the whole chain rides on the first paste
FINDINGS: <pending analyst execution>
GAPS: Web delivery of the lure; fileless after stage 1 (needs memory/script-block telemetry)
ACTIONS: Promote Q1/Q6; CLM + script-block logging; ASR; AMSI on; disable Win+R on user tier;
Credential Guard; egress baselining for SOCKS5/443
OWNER: HuntPack
VERSION: v0.3 - 2026-06-12
14
Changelog
v0.52026-07-24CQL correctness pass. All
table() calls now carry an explicit row limit: the default is 200 and truncation is silent, so a capped result was indistinguishable from a complete one. Atomic-IOC sweeps (filters over 5+ hashes or C2 IPs) use limit=max so a wide infection is never silently under-scoped; behavioural hunts use limit=200, where exceeding the cap indicates the query needs tuning. Where present, event names that do not exist in the Falcon data model were corrected (e.g. ServiceInstalled is a Sysmon concept, not a Falcon event; ElfFileWritten is ELFFileWritten) — such queries could never return a row. No detection logic, fields, or IOCs changed.v0.42026-06-29CQL syntax review (crowdstrike-logscale-v3): removed invalid FileCreateInfo event (Q3).
v0.32026-06-12Re-hunt + reformatted to the review-v2 gold layout (fixed left-sidebar scrollspy TOC, collapsible, cloud selector inside the CQL section, per-card Copy/Open-in-Falcon, Grouped IOC Quick-Copy grid, coverage+validation, .ticket). Refreshed from Elastic Security Labs: the 5-stage chain (ClickFix → obfuscated PowerShell → ETW/AMSI bypass → Lua loader (luaalloc/luacpy/luaexe) → Meterpreter → MIMICRAT/AstarionRAT), token theft, SOCKS5 proxy, malleable HTTPS C2. 6 CQL + 4 native hunts, 2 IOA candidates; ClickFix front-door break emphasized.
v0.12026-05-18Initial pack: MimiCRAT overview + hunts. Pre-gold top-bar layout.
15
References
| Tier | Source | Used For |
|---|---|---|
| 1 | Elastic Security Labs — MimiCRAT | 5-stage chain, Lua loader, MIMICRAT capabilities, token theft/SOCKS5, malleable C2 |
| 2 | Proofpoint — ClickFix technique | ClickFix delivery mechanics (fake CAPTCHA / Win+R paste) |
| 2 | MITRE ATT&CK T1204.004 — Malicious Copy and Paste | ClickFix technique mapping |
HuntPack v0.3 · MimiCRAT (ClickFix → Lua → Meterpreter → C++ RAT) · Generated 2026-06-12 · Defensive use only — no offensive code. The whole chain rides on one pasted command; breaking the ClickFix front door (Q1/Q6 + user coaching) is the highest-leverage control. The remaining stages are fileless — pair the CQL hunts with PowerShell script-block logging. Validate field names before promoting any query.