WhatsApp Attachment Deploys Windows Malware With SYSTEM-Level Access

A malicious WhatsApp attachment is being used to deliver a Windows remote access trojan that can gain SYSTEM-level privileges, giving attackers extensive control over infected computers. The campaign begins with a ZIP archive containing a financial-document lure and an executable named Statement.exe , according to an analysis by Morphisec.

Once opened, the file triggers a multi-stage infection chain that moves from a standard user process into a Windows service running with LocalSystem privileges. The final payload, identified as VulcanRAT207.A, can collect system information, execute commands, manage files, capture screenshots, log keystrokes, alter local accounts and deploy additional payloads.

The malware also uses a signed driver to terminate selected security processes and creates a scheduled task that can restart the remote access trojan with SYSTEM privileges after a reboot.

FCRF Launches CP-FRM to Build India’s Generation of Fraud Risk Professionals

FCRF Launches CP-FRM to Build India’s Generation of Fraud Risk Professionals

Infection Chain Uses Privilege Escalation and Code Injection

Morphisec said the attack is divided into multiple stages covering unpacking, privilege elevation, code injection, payload download, security-tool disruption, persistence and remote control.

The first executable is heavily packed with NRV2E compression, which obscures the underlying loader from basic static analysis. After execution, the malware checks whether the machine appears to be a genuine user system rather than an automated analysis environment.

It examines factors including disk space, display configuration, memory, CPU resources, event logs, Registry keys, virtual-machine indicators and installed security products. Timing checks are also used in an attempt to stop execution in slow sandboxes or emulated systems.

If the malware does not already have administrator privileges, it attempts to elevate permissions through COM objects and can fall back to the Windows runas function. It then enables SeDebugPrivilege , restores a clean copy of ntdll.dll to remove user-mode security hooks and injects downloader shellcode into the process hosting the Windows Task Scheduler service.

Instead of relying on the more common CreateRemoteThread technique, the malware uses PoolParty Variant 7 and the Windows I/O completion system to execute code inside the trusted service process. Because the Task Scheduler runs as LocalSystem, subsequent components inherit SYSTEM-level privileges.

The injected shellcode contacts the server 61[.]18[.]208[.]27 over port 8888 and downloads a deployment bundle into memory. The bundle includes a legitimate Intel-signed VulkanInfo utility, a malicious vulkan-1.dll , a vulkan-1.bin RAT container and a deployment DLL.

Signed Driver and Scheduled Task Used for Persistence

The campaign uses DLL sideloading, a technique in which a legitimate application loads a malicious DLL placed beside it. Before establishing persistence, the deployment DLL attempts to install GoFly64.sys , a legitimately signed Chinese network-filter driver.

The malware creates a temporary driver file and service, then communicates with the driver using the 0x12227A control code. Morphisec found that this path targeted bdservicehost.exe and bduserhost.exe , processes associated with Baidu security software.

The signed driver allows the malware to operate at kernel level and terminate selected protection processes.

For persistence, the malware writes vulkaninfo-64.exe , vulkan-1.dll and vulkan-1.bin into C:\Program Files\Common Files\ . It then creates a SYSTEM-level scheduled task named USOPrivate Kit or USOPrivate , using names that may appear related to normal Microsoft update activity.

When the task launches the signed VulkanInfo utility, the program searches its local directory for vulkan-1.dll and loads the malicious file. The DLL then reads the adjacent .bin file, reconstructs the final RAT in memory and keeps the trusted host process running.

VulcanRAT207.A communicates with the same server using WebSocket version 13 after initially relying on HTTP for stage retrieval.

RAT Can Steal Data, Control Accounts and Deploy More Payloads

Once active, VulcanRAT207.A can collect information the host system, user accounts, network connections, installed applications, running processes, services, event logs and files selected by the operator.

It can open remote command shells, capture the desktop, record keystrokes, control the mouse and keyboard, modify clipboard contents, block network traffic through Windows Filtering Platform rules and inject payloads into other processes.

Its command set can also create local administrator accounts, change passwords, download files, launch executables and register additional drivers.

Morphisec advised organisations to block executable content received through WhatsApp and other messaging platforms, particularly ZIP files presented as financial statements, tax documents or payment-related records.

Security teams have also been advised to look for unusual memory activity involving Task Scheduler processes, creation of the USOPrivate Kit or USOPrivate scheduled task, unexpected files in C:\Program Files\Common Files\ , and execution of vulkaninfo-64.exe from that directory.

Monitoring signed-driver installation and attempts to terminate endpoint-security processes may also help identify the infection chain before the RAT becomes fully active.

the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.

the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.