WhatsApp-Delivered Malware Injects Into Windows Task Scheduler to Run as SYSTEM

A WhatsApp-delivered financial-document lure is being used to deploy a sophisticated Windows malware chain that injects code into the Task Scheduler service and executes subsequent payloads with LocalSystem privileges.

The executable acts as an NRV2E-compressed wrapper that reconstructs its malicious loader entirely in memory, limiting obvious artifacts on disk and obscuring imports, strings, and control-flow logic from static inspection.

The loader performs extensive host profiling before contacting its command-and-control infrastructure.

It checks display settings, available storage and memory, CPU characteristics, Event Log records, Registry markers, virtualization indicators, selected System32 DLL reparse points, and the presence of Baidu endpoint-security processes.

It also uses timing gates and anti-hook checks intended to break execution in instrumented, emulated, or sandboxed environments.

After screening the host, the malware attempts privilege elevation through COM auto-elevation techniques, with ShellExecuteW using the runas verb as a fallback.

If it obtains an elevated token, it enables SeDebugPrivilege, restores a clean copy of ntdll.dll to weaken user-mode monitoring, and targets the Windows Task Scheduler service host.

The crucial transition occurs through PoolParty Variant 7, a process-injection technique that inserts a malicious TP_DIRECT callback into a target process’s Windows thread pool through an I/O completion queue rather than using conventional CreateRemoteThread execution.

Because Task Scheduler runs as LocalSystem, the injected downloader inherits SYSTEM authority. This is central to the intrusion: later components do not need to exploit another local privilege-escalation flaw.

Instead, they execute under the privileged security context inherited from the service process.

The downloader sends an HTTP POST request to 61[.]18[.]208[.]27:8888, validates a custom response header, and retrieves an in-memory deployment bundle.

That bundle reflectively loads a deployment DLL that coordinates defense evasion, payload execution, and persistence.

Morphisec said in a report shared with GBhackers, the activity identified a ZIP archive carrying Statement-846143734.exe, disguised as a financial statement.

WhatsApp-Delivered Malware

The DLL deploys GoFly64.sys, a legitimately signed driver abused through the bring-your-own-vulnerable-driver model. It creates a kernel driver service and uses IOCTL 0x12227A to terminate selected Baidu security processes from kernel mode.

The payload then creates a persistent side-loading package in C:\Program Files\Common Files\.

Executable content begins 54 bytes into the HTTP body – a 50-byte malware header followed by a 4-byte stage-size field.

It writes a legitimate Intel-signed vulkaninfo-64.exe executable alongside a malicious vulkan-1.dll and vulkan-1.bin payload container.

A SYSTEM scheduled task named USOPrivate Kit starts the trusted Vulkan utility at boot or on task execution. Since the executable loads vulkan-1.dll through an unqualified DLL path, Windows resolves the attacker-controlled DLL from the application directory first.

The malicious DLL reads vulkan-1.bin, reconstructs the embedded payload in memory, and launches the final implant, tracked as VulcanRAT207.A.

The RAT establishes a WebSocket version 13 connection to 61[.]18[.]208[.]27:8888 and supports broad post-compromise activity, including system reconnaissance, file operations, shell execution, clipboard modification, account creation and password changes, Event Log access, remote desktop control, screen capture.

This operation layers several evasive techniques instead of depending on a single malware dropper.

WhatsApp bypasses traditional email-security inspection; memory-only unpacking and reflective loading reduce forensic visibility; PoolParty injection avoids a heavily monitored injection path.

A signed driver undermines targeted endpoint defenses; and signed-binary DLL side-loading provides durable SYSTEM-level persistence.

The use of Vulkan-themed files also fits a broader pattern. Proofpoint has documented campaigns involving Vulkan-related executables, malicious vulkan-1.dll files, and vulkan-1.bin payloads in activity associated with the Chinese-speaking threat cluster TA4922.

However, the available reporting should not be treated as a confirmed attribution of this specific VulcanRAT207.A intrusion to TA4922 without an explicit researcher assessment.

Security teams should block and hunt for connections to 61[.]18[.]208[.]27:8888, investigate executions of Statement*.exe originating from messaging-app downloads or ZIP archives, and review Task Scheduler telemetry for newly created tasks named USOPrivate Kit or similarly deceptive update-themed entries.

The file combination vulkaninfo-64.exe, vulkan-1.dll, and vulkan-1.bin under C:\Program Files\Common Files\ is a high-confidence hunting lead.

Defenders should also monitor suspicious kernel-driver service creation, unexpected loading of GoFly64.sys, access to \\.\GoFly, and attempts to terminate bdservicehost.exe or bduserhost.exe.

Network controls should alert on HTTP registration traffic or WebSocket upgrades from service-host processes to TCP port 8888.

Process creation involving taskeng.exe, Task Scheduler service hosts, or signed Vulkan utilities deserves particular scrutiny when accompanied by DLL loads from writable or unexpected locations.

Indicators of compromise

Indicator	Details
0c418989bbc836208a087dee8fd64210f58909dddf736bc94769c269f65c26eb	Type: SHA-256 Component: Tax-202609078869.exe Context: WhatsApp-delivered outer wrapper
be740b05caead2fa4521f42da0653a10f53029df5455ebafe4701ab3d41afdf9	Type: SHA-256 Component: Packed Statement.exe Context: WhatsApp-delivered outer wrapper
6833b1946ac219cf6ddf6cfbde1f81352b12d9125c8735961b5256216c4fdc49	Type: SHA-256 Component: Unpacked Statement loader Context: Stage 1 loader (analyzed image)
61.18.208.27:8888	Type: Network Component: HTTP shellcode + final RAT Context: HTTP stage retrieval; WebSocket C2

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.