Researchers uncovered a custom Windows backdoor named RtkNGUI64.exe on a single Windows 7 workstation, where it hid its command-and-control address inside the number of spaces in a UTF-16LE `desktop.ini` file and persisted through a WMI subscription named “Realtek.” The implant called home to diagrtrack.com, impersonated Realtek software, and showed signs of a deliberately targeted operation rather than a broad campaign. #RtkNGUI64.exe #diagrtrack.com #Realtek #DiagTrack
Keypoints
- The investigation centered on a single domain-joined Windows 7 SP1 workstation, with only one observed instance of the backdoor.
- The malware, RtkNGUI64.exe, was a 12 KB custom x64 executable disguised as legitimate Realtek audio software.
- Its C2 server address was encoded in the count of spaces on each line of C:ProgramDatadesktop.ini, making the config look nearly empty.
- A WMI subscription named “Realtek” used a Win32_LocalTime trigger at 19:50 to launch persistence after reboot.
- The backdoor used a very small command set: system, put, and time, and communicated through ICMP plus HTTP POST requests to /version/check.php.
- The domain diagrtrack.com typosquatted DiagTrack, and the sample and related artifacts were unique enough to suggest selective deployment.
- When the domain expired, the implant kept running and attempting to resolve and contact the dead address until rebooted.
MITRE Techniques
- [T1546.003 ] Event Triggered Execution: WMI Event Subscription – Persistence was achieved through a WMI subscription that fired on a time-based filter using Win32_LocalTime [‘A filter watching Win32_LocalTime for hour 19, minute 50 is a restart timer, not a boot hook.’]
- [T1036 ] Masquerading – The implant disguised itself as Realtek software and used a fake-looking install path to blend in [‘disguised itself as legitimate Realtek software’ / ‘C:Program FilesRealtekAudioRtkNGUI64.exe’]
- [T1027 ] Obfuscated Files or Information – The C2 address was hidden by encoding it as counts of spaces in a desktop.ini file [‘the address of its command-and-control server was not stored as readable text or encrypted data, but encoded in the number of spaces on each line’]
- [T1001 ] Data Obfuscation – Configuration data was represented indirectly through whitespace counts rather than plaintext, making the file appear empty [‘Those spaces spelled out its server address’]
- [T1105 ] Ingress Tool Transfer – The put command accepted base64 content and wrote files to disk, supporting payload delivery [‘put writes a file, taking a path and base64 content’]
- [T1059.003 ] Command and Scripting Interpreter: Windows Command Shell – The system command executed commands via cmd.exe and captured output [‘runs a command through cmd.exe, captures stdout and stderr through a pipe’]
- [T1041 ] Exfiltration Over C2 Channel – Command output was returned to the operator by base64- and URL-encoded HTTP responses [‘r carries the previous command’s output, base64-encoded and then URL-encoded’]
- [T1095 ] Non-Application Layer Protocol – The implant used ICMP echo requests as a knock before speaking HTTP [‘Every cycle then opens with an ICMP knock rather than an HTTP request’]
- [T1071.001 ] Application Layer Protocol: Web Protocols – Tasking and responses were exchanged over HTTP POST requests to /version/check.php [‘POST /version/check.php HTTP/1.1’]
Indicators of Compromise
- [Domain ] C2 domain used by the backdoor – diagrtrack.com, and expired/no longer resolves
- [File hash ] Backdoor sample hash for RtkNGUI64.exe – d411d93f358128c77aed0be91365b18cfb7575ecd188d22a216cbaeaa51c5e11, and config hash 1cc5a4be7f2e41086b53e698b487e43426e5e572bc99e5de62eada9baf83bdcd
- [File path ] Fake installation path and config location – C:Program FilesRealtekAudioRtkNGUI64.exe, C:ProgramDatadesktop.ini
- [URI path ] HTTP C2 endpoint – /version/check.php, used for tasking and responses
- [WMI object name ] Persistence objects and trigger name – Realtek, bound to Win32_LocalTime
- [File name ] Dropped or referenced files – RtkNGUI64.exe, desktop.ini, and tempcache.tmp
Read more: https://www.gendigital.com/blog/insights/research/kb-backdoor