Researchers have uncovered a custom Windows backdoor that uses several low-noise techniques to avoid detection, including corrupting executable headers while writing dropped files to disk.
The malware was found on a single 64-bit Windows 7 corporate workstation during a hunt for suspicious WMI persistence.
The backdoor disguised itself as Realtek audio software and used a WMI event subscription named Realtek to launch every day at 19:50.
Its payload, named RtkNGUI64.exe, was placed under a fake Realtek-style path and used the legitimate name of Realtek’s audio control panel.
The malware was small, only 12 KB, and had a limited command set. However, its design showed careful attention to bypassing on-access scanning, hiding strings, and concealing command-and-control (C2) configuration.
Researchers found no confirmed link to a known threat group. The backdoor appeared on only one monitored system, had no matching samples in public repositories, and used a custom configuration format.
These details suggest a targeted intrusion, although the initial access vector and operator identity remain unknown.
PE Corruption Evades Scanners
The backdoor did not store its C2 domain as plain text, encrypted data, or an encoded blob. Instead, it hid the address in the number of spaces placed on each line of a desktop.ini file under C:\ProgramData.
The malware builds the filename in two separate fragments: \DESKTOP. and ini. The two fragments are separated by unrelated code, meaning the full string desktop.ini does not appear directly in the executable.
This can reduce the value of simple string-based detection. After opening the file, the malware skips the first 174 bytes, which match a normal Windows desktop.ini header.
It then reads UTF-16LE text and counts spaces on each line. Each count represents the ASCII value of one character.
For example, 100 spaces represent the letter d, 105 spaces represent i, and 97 spaces represent a. Ten whitespace-only lines reconstruct the string diagrtrack, after which the malware appends .com to create its C2 domain: diagrtrack[.]com.
The domain imitates DiagTrack, the Windows Connected User Experiences and Telemetry service. This naming choice helped the infrastructure appear Windows-related while also matching the malware’s use of a Windows shell configuration file.
The malware also uses an unusual WMI persistence method. Its __EventFilter monitors Win32_LocalTime and starts the payload only at 19:50. Because the WMI subscription survives rebooting, the implant remains persistent but does not automatically launch during system startup, gendigital said.
Indicators of Compromise
| Indicator | Type | Description |
|---|---|---|
diagrtrack[.]com | C2 Domain | Expired command-and-control domain typosquatting the Windows DiagTrack service |
d411d93f358128c77aed0be91365b18cfb7575ecd188d22a216cbaeaa51c5e11 | SHA-256 | RtkNGUI64.exe custom Windows bac |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
