# WhatsApp-Delivered VulcanRAT207.A Injects into Windows Task Scheduler (PoolParty Variant 7) to Run as SYSTEM

> A WhatsApp-delivered financial-document lure (Statement.exe) unpacks a multi-stage loader that elevates via COM auto-elevation, injects a downloader into the Task Scheduler service using PoolParty Variant 7, abuses the signed GoFly64.sys driver (BYOVD) to kill Baidu security processes, and side-loads vulkan-1.dll through the Intel-signed vulkaninfo-64.exe to run the WebSocket RAT VulcanRAT207.A as SYSTEM. Attribution to TA4922 is suspected by Morphisec but is not confirmed.

- **Published:** 2026-10-12T10:37:31Z
- **Last reviewed:** 2026-10-12T15:46:36.390Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3343
- **ID:** TL-2026-3343
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** TA4922 (China)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Morphisec (report dated 2026-10-07, covered by GBHackers on 2026-10-12 and The Hacker News ThreatsDay) documents an eight-stage intrusion chain that begins with a ZIP delivered over WhatsApp. The ZIP contains Statement.exe (wrapper sample name Tax-202609078869.exe), an NRV2E-compressed executable that reconstructs the real loader in memory without writing it to disk. WhatsApp delivery sidesteps email-security inspection.

The initial loader performs extensive host screening before any C2 contact: display dimensions via DirectDraw, system-drive size (>3 GiB), CPU and memory thresholds, display-device strings, LocalSystem/administrator token state, Security event log entries (IDs 4624 and 1102), registry markers (.NET, Hyper-V, IIS, PowerShell, virtualization keys), reparse-point state of ntdll.dll/kernel32.dll/user32.dll, and the presence of Baidu endpoint processes (HipsDaemon.exe, HipsTray.exe). Two 50 ms D3D11 timing gates act as anti-emulation checks, and eight integrity-check variants look for INT3/hook opcodes at function starts. The loader tries COM auto-elevation (CLSIDs {3AD05575-8857-4850-9277-11B85BDB8E09} and {BDB57FF2-79B9-4205-9447-F5FE85F37312}), falls back to ShellExecuteW with the runas verb, enables SeDebugPrivilege, and overwrites the .text section of ntdll.dll with the on-disk copy to remove user-mode hooks.

It then uses PoolParty Variant 7 (SafeBreach technique) to inject a downloader into the Windows Task Scheduler service host: it enumerates and duplicates handles from the target, finds the IoCompletion object, and queues a malicious TP_DIRECT callback with ZwSetIoCompletion instead of using CreateRemoteThread. The shellcode runs under the inherited LocalSystem token. This 3,192-byte position-independent downloader resolves APIs with a ROR13-plus-add hash and registers with the C2 at 61.18.208.27:8888 over HTTP using an empty User-Agent and a 50-byte XOR(0x3A)-protected header (registration ID 0x00013009, magic 0x02072024) followed by an RC4-variant-encrypted config. The server returns a bundle that is copied into RWX memory and executed.

A reflective loader maps a deployment DLL (headers stomped, Huffman-compressed) from a four-record bundle: vulkaninfo-64.exe, vulkan-1.dll, vulkan-1.bin, and a compressed configuration. The deployment DLL runs vulkan-1.bin from memory immediately, and in a separate path opens \\.\GoFly. If the device is missing, it writes the signed GoFly64.sys to %WINDIR%\System32\drivers\tp_<GetTickCount>.tmp, creates a SERVICE_SYSTEM_START service, and sends the PIDs of bdservicehost.exe and bduserhost.exe to IOCTL 0x12227A, which calls ZwTerminateProcess from ring 0. For persistence it writes vulkaninfo-64.exe, vulkan-1.dll and vulkan-1.bin (with randomized overlay data appended) to C:\Program Files\Common Files\ and registers a SYSTEM scheduled task named 'USOPrivate Kit' or 'USOPrivate' under \Microsoft\Windows\ (fallback \Microsoft\Windows\AppID). It adjusts behavior when 360Tray.exe or QQPCTray.exe/QQPCRTP.exe are running, uses the mutex Global\Admindllhost!!! in its dllhost.exe branch, and self-deletes if bdservicehost.exe terminates.

When the task runs, the genuine Intel-signed Khronos vulkaninfo-64.exe (v1.3.204.1, PE timestamp 2022-02-25) loads the malicious vulkan-1.dll from its own directory. On vkEnumerateInstanceVersion the DLL derives vulkan-1.bin from its own path, decompresses it, and executes it. The final VulcanRAT207.A decrypts its configuration with a ChaCha-derived 20-round cipher, uses the mutex analplug<suffix> (ExitProcess(123) on duplicate), opens \\.\pipe\<PID>_pipe, and connects by raw TCP to 61.18.208.27:8888, upgrading HTTP/1.1 to WebSocket v13 with a 50-byte custom header (magic 0x0207, command ID at offset 0x1E). Confirmed capabilities include victim profiling, shell sessions, file and registry management, event-log reading and clearing (ClearEventLogW), local account creation (added to Administrators) and password change, clipboard replacement, keylogging, DXGI/GDI screen capture with remote desktop control (PrivacyScreenClass window), WFP-based traffic blocking (NetstatBlockSession, BlockAllTrafficSession), download-and-execute, operator-supplied driver installation, and injection into explorer.exe or winlogon.exe (six injection variants).

Attribution: Morphisec reports overlap with the Vulkan-themed loader pattern (legitimate Vulkan executable, malicious vulkan-1.dll, vulkan-1.bin sidecar) that Proofpoint documented on 2026-06-03 for TA4922, a Chinese-speaking, financially motivated cybercrime cluster (RomulusLoader masquerading as Vulkan Loader). GBHackers states the reporting should not be treated as a confirmed attribution of this intrusion to TA4922. No CVE is associated; GoFly64.sys is a signed WFP network-filter driver (signer Nanjing Siyanrui Network Technology) with 20+ unauthenticated IOCTLs, listed in LOLDrivers and also distributed as PandaSpeed64.sys and drv_02581.sys. The Baidu, 360 and Tencent targeting suggests victims in Chinese-language environments, but the sources do not state victim geography or sectors. BeaconBeagle returned HTTP 404 for the C2 IP at research time, so no C2 correlation is recorded.

## MITRE ATT&CK

- T1204 User Execution
- T1106 Native API
- T1053.005 Scheduled Task
- T1543.003 Windows Service
- T1136.001 Local Account
- T1548.002 Bypass User Account Control
- T1055 Process Injection
- T1574.001 DLL
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall
- T1027.002 Software Packing
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1685.005 Clear Windows Event Logs
- T1036.004 Masquerade Task or Service
- T1480.001 Environmental Keying
- T1497.001 System Checks
- T1518.001 Security Software Discovery
- T1012 Query Registry
- T1057 Process Discovery
- T1056.001 Keylogging
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1059.003 Command and Scripting Interpreter
- T1574.002 Hijack Execution Flow
- T1098 Account Manipulation
- T1087.001 Account Discovery
- T1082 System Information Discovery
- T1563.002 Remote Service Session Hijacking
- T1134 Access Token Manipulation
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1573.001 Encrypted Channel

## Sources

- [From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain (Morphisec)](https://www.morphisec.com/blog/vulcanrat207-a_intrusion-chain_explained/)
- [WhatsApp-Delivered Malware Injects Into Windows Task Scheduler to Run as SYSTEM (GBHackers)](https://gbhackers.com/whatsapp-delivered-malware/)
- [ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories (The Hacker News)](https://thehackernews.com/2026/10/threatsday-ransomware-affiliate.html)
- [TA4922: Suspected Chinese Crime Group Going Global (Proofpoint)](https://www.proofpoint.com/us/blog/threat-insight/ta4922-suspected-chinese-crime-group-going-global)
- [GoFly64.sys (LOLDrivers)](https://www.loldrivers.io/drivers/c2ed6a76-95ad-45fd-97d4-b55deefb3e32/)
- [PoolParty: process injection techniques abusing Windows thread pools (SafeBreach Labs)](https://github.com/SafeBreach-Labs/PoolParty)
- [Process Injection Using Windows Thread Pools (SafeBreach)](https://www.safebreach.com/blog/process-injection-using-windows-thread-pools/)
- [Add GoFlyDrv, LOLDrivers issue #299](https://github.com/magicsword-io/LOLDrivers/issues/299)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3343