When a malicious file is detected, it can be tempting to treat that file as the entire threat. In reality, a dropped payload typically represents just one step in a much longer sequence of activity. Many security decisions are historically framed around isolated questions, but evaluating a single artifact or moment in time doesn’t showcase the full picture. Malware detection requires more than simply recognizing a bad file. The context to understand where an object came from, what it became, and what it does provides a much clearer picture of an attack.
Attackers have long used techniques like encryption, runtime decryption, staging, persistence and masquerading to evade detection. Highly prevalent threat families like Emotet, Qakbot and IcedID have spent years utilizing complex delivery chains. What multi-stage malware demands is preserving context from across the entire attack chain, everything from provenance and delivery, to payload transformation and execution through to persistence and command-and-control.
The <a href="https://www.pointwild.com/threat-intelligence/?” rel=”nofollow noopener” target=”_blank”>Point Wild Lat61 Threat Intelligence Team’s recent analysis of a campaign delivering BotHelper RAT shows a concrete study of this concept in action The campaign relies on familiar evasion techniques, with each stage providing another piece of the larger attack. What makes BotHelper RAT interesting isn’t a single technique, rather it’s how the pieces fit together. Because the chain is relatively easy to follow from the initial stage through the ultimate malicious behavior, it nicely illustrates why preserving contextual connections is vital to protection.
The infection begins with a small stager that profiles the host before requesting an encrypted second-stage payload from a remote server. When that payload arrives on the endpoint, it contains no discernible executable header, readable strings or obvious structure. Once it reaches the endpoint, the stager decrypts it in memory into a recognizable Windows executable. That executable is written to the user’s temp directory as msedge_proxy.exe, borrowing the name of a legitimate Microsoft Edge component, and is launched without a visible window.
The activity continues beyond the initial drop. BotHelper copies itself to a hidden location and establishes persistence through a scheduled task designed to relaunch the malware every 30 minutes. It actively tampers with Windows’ Antimalware Scan Interface (AMSI) and establishes communication with its command-and-control infrastructure. In the activity observed by the Lat61 team, the attacker ultimately used BotHelper to take a screenshot and begin live streaming images of the victim’s desktop. The malware also supports a variety of capabilities including running shell and PowerShell commands, downloading additional files, monitoring the clipboard and loading plugins at runtime.
Following the full attack chain BotHelper provides a relatively clear example of why those connections matter. Network activity helps trace where the encrypted payload originated, while analysis reveals the executable that was ultimately delivered. Endpoint telemetry then shows what happened once that executable began running. Together, these observations connect the malware’s provenance– including how it reached the endpoint and was transformed along the way– with its subsequent behavior, giving defenders a clearer view of the attack from initial delivery through malicious activity.
This visibility completely changes how an individual signal is interpreted. For example, a process called msedge_proxy.exe may initially appear to be associated with a legitimate Microsoft Edge component. However, tracing that process back to an encrypted payload that was decrypted and dropped into a temporary directory adds critical context. Connecting that finding to its subsequent behavior, such as AMSI tampering and command-and-control communications, fills in the complete picture.
Preserving context in practice
For defenders, preserving these connections directly informs both investigation and remediation.A downloaded object must be traceable to the process it eventually becomes, just as an outbound network connection should be traceable to the initiating process. Process names provide another piece of the puzzle, but understanding where a process came from, where it is running and what happened before it executed offers a much better indication of whether it belongs there.Security tampering also becomes more informative when viewed as part of the wider chain. Interference with a control like AMSI is a meaningful signal, but connecting that activity to the responsible process gives defenders actionable intelligence.
The context is equally critical during incident remediation. In the case of BotHelper, simply deleting the dropped executable would leave behind the scheduled task designed to relaunch the malware every 30 minutes. Following the attack beyond the initial file uncovers the persistence mechanisms and other activity that also must be addressed.
Furthermore, there is significant value in retaining the artifacts collected throughout an investigation. The Lat61 team recovered BotHelper while the infrastructure hosting the payload was still active. Once that infrastructure goes offline, the initial stager alone may no longer reveal what it originally downloaded. Preserving what was observed and recovered along the way provides critical information that may not be available later.
BotHelper illustrates a longstanding challenge in malware detection: individual artifacts and behaviors rarely tell the full story of an attack. While recognizing a malicious file remains an important baseline, preserving the connections between delivery, execution and subsequent activity allows defenders to accurately reconstruct how an attack unfolded and what needs to be addressed. Ultimately, it’s not just about identifying what is malicious, but understanding where it came from, what it became and what it did next.
Dr. Zulfikar Ramzan is Chief Technology and AI Officer at Point Wild, a global leader in AI-powered cybersecurity. He spearheaded the development and launch of Lat61, a highly scalable, extensible AI platform that consolidates data from multiple sources to detect multi-vector attacks, optimize protection across 50+ products and support over 25 million active users. He also leads the Lat61 Threat Intelligence Team, directing research into emerging threats and strengthening Point Wild’s Lat61 platform.
Dr. Ramzan has over 20 years of experience in cybersecurity. At Aura, he served as Chief Scientist and Board member, leading the development of AI-driven platforms such as Aura Call Protection, Aura Message Protection, Smart Vault, and the Apollo platform for AI workloads. He has also held senior leadership roles at RSA as Chief Technology Officer and Chief Digital Officer. Earlier in his career, he contributed to Symantec Endpoint Protection and advanced machine learning–powered technologies at Immunet, now part of Cisco. He holds a PhD from MIT and is an inventor on more than 60 patents in cybersecurity and applied cryptography.
