TASK#STOMP Deploys Dual PowerShell Modules with Mutual Watchdog and Timestomping

The infection begins with wscript.exe executing a randomly named VBScript on the desktop that creates persistence through scheduled tasks titled Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler plus a backup msdiag.vbs in the startup folder. It then launches hidden PowerShell processes that terminate duplicates, apply timestomping, and decode diag_pack.dat and win_conn_cfg.dat to activate document exfiltration, filesystem monitoring, screenshot capture, and arbitrary command execution.

Securonix reporting shows the two PowerShell modules maintain a mutual-watchdog relationship while sharing the same token-authenticated C2 servers. The final observed actions include opening irantenders[.]com and running an unrecovered purge.bat script. These steps indicate deliberate operational security to evade both automated detection and manual forensic review.

The campaign fits patterns seen in prior espionage tools that combine redundant persistence with minimal external dependencies, though initial access remains unconfirmed beyond possible phishing. The Iranian tender site connection suggests targeting or staging related to government procurement data rather than generic crimeware.

Next indicators to monitor include new variants reusing the same task names or C2 infrastructure and any overlap with documented Iranian infrastructure campaigns tracked by commercial threat intel platforms.