Researchers Detail VulcanRAT207.B Chain Using RomulusLoader, SYSTEM Persistence and Driver Evasion
Summary
Morphisec details a VulcanRAT207.B chain using a side-loaded VulkanInfo package and RomulusLoader. It traces persistence, C2 and RAT capabilities; the package’s original delivery vector remains unconfirmed.
Key points
- The package reuses a signed VulkanInfo host but follows a distinct execution chain; the researchers say its original delivery vector is unconfirmed and cannot be assumed to match the earlier WhatsApp-delivered chain.
- An anti-analysis DLL loads shellcode from an adjacent .bin file. The shellcode matches all four blocks of Proofpoint’s RomulusLoader YARA rule and reflectively maps the controller.
- The recovered configuration points to 61[.]18[.]208[.]27:1234 over TCP, with campaign ID 0903. The code also supports UDP/KCP and HTTP/WebSocket, but those transports were not selected in the observed configuration.
- The controller installs 444.exe and companion files under C:\Program Files\Common Files, then registers a boot-triggered scheduled task to run with SYSTEM authority. The attempted RPC-based elevation path remains unresolved.
- VulcanRAT207.B supports remote desktop, file transfer, command execution, surveillance, process manipulation, keylogging and network relaying, among other operator functions.
- The analysis distinguishes the RAT’s PoisonX-style and TrueSight driver interfaces from the GoFly64.sys path in the related chain, and describes process concealment and security-process targeting.
- Morphisec recommends examining unexpected VulkanInfo executions, adjacent vulkan-1.dll and vulkan-1.bin files, the scheduled task, traffic to the port 1234 endpoint, and the identified driver interfaces.
Article Details
- Attack Vectors
- The initial delivery vector for this package is unconfirmed; the article cautions against assuming the WhatsApp delivery or Statement.exe stage documented for VulcanRAT207.A.
- The signed VulkanInfo executable loads an adjacent attacker-placed vulkan-1.dll, which reads vulkan-1.bin and executes its shellcode.
- The shellcode decrypts and reflectively maps the RomulusLoader controller, which contacts the configured C2 endpoint and retrieves VulcanRAT207.B.
- The controller installs 444.exe and registers it as a boot-triggered SYSTEM scheduled task named Microsoft Compatibility system.
- The RAT supports process injection, remote desktop control, command execution, keylogging, file transfer, process concealment, and kernel-driver-assisted operations.
- Defensive Notes
- Investigate unexpected execution of the signed VulkanInfo host alongside adjacent vulkan-1.dll and vulkan-1.bin files.
- Check for 444.exe, install.cfg, and the Microsoft Compatibility system scheduled task in C:\Program Files\Common Files.
- Monitor traffic to 61[.]18[.]208[.]27 on TCP port 1234 and inspect for the described PoisonX-style and TrueSight device interfaces.
- Keep this port-1234 branch’s loader, persistence, protocol, and driver artifacts distinct from the GoFly64.sys path associated with the port-8888 branch.
- Do not assume the initial delivery mechanism for VulcanRAT207.B from the separate VulcanRAT207.A investigation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 61[.]18[.]208[.]27 | RomulusLoader and VulcanRAT207.B C2 endpoint; the observed configuration uses TCP port 1234. |
| SHA256 | 442f5c7249459a26ba055cda56c1b89cbe1cbf1d875eaf0567896ef4906e32d4 | SHA-256 of the RomulusLoader controller, described as an analyst-repaired PE. |
| SHA256 | 7a0d05caf79d3a5939a536756c2b32347daa200d82f979fdf8590e41e04d6da7 | SHA-256 of the VulcanRAT207.B branch’s anti-analysis vulkan-1.dll launcher. |
| SHA256 | 7c0bc95d83263c0644420d4df9486ee47dc07c70455e6abb1c99996f370d3579 | SHA-256 of the vulkan-1.bin package containing the RomulusLoader shellcode. |
| SHA256 | f0a02ebd2edc6b708dd7c43c1a830453aadf028594e0d3b9d851eb38bf560b93 | SHA-256 of the VulcanRAT207.B full RAT payload. |
| SHA256 | facf78d474b66ed821288db41fa6ad8a7b6f30650eb12127cb3e9a3cc6146116 | SHA-256 of the signed VulkanInfo host used in both documented chains. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe launcher uses obfuscated dispatch logic and decoy task graphs, while shellcode and configuration data are encrypted with a modified RC4 transform.T1053.005 · Scheduled TaskThe controller registers 444.exe as a boot-triggered SYSTEM scheduled task named Microsoft Compatibility system.T1055 · Process InjectionThe RAT supports process injection, including launching a stub in winlogon.exe via a remote thread and using other injection paths.T1056.001 · KeyloggingVulcanRAT207.B provides keylogging capability and commands for retrieving or deleting keylog data.T1057 · Process DiscoveryThe RAT inventories processes and can filter selected PIDs from process-information output to conceal them.T1095 · Non-Application Layer ProtocolThe observed configuration selects direct TCP C2 to 61[.]18[.]208[.]27:1234.T1105 · Ingress Tool TransferThe controller requests and executes a separately delivered VulcanRAT207.B stage from the C2 connection.T1113 · Screen CaptureThe RAT captures desktop frames and changed pixel strips for its interactive remote-desktop capability.T1543.003 · Windows ServiceWhen installing an operator-supplied kernel driver, the RAT creates a tp_<tick> service before opening the driver device.T1562.001 · Disable or Modify ToolsThe RAT monitors for named security-product processes and uses injected stubs designed to repeatedly terminate them.T1564.001 · Hidden Files and DirectoriesThe controller applies hidden and system file attributes to the installed executable and its adjacent DLL and package files.T1573.001 · Symmetric CryptographyThe controller encrypts C2 message bodies using its modified RC4 transform and a static key.T1574.002 · DLL Side-LoadingThe signed VulkanInfo host loads the attacker-placed vulkan-1.dll from beside the executable.T1620 · Reflective Code LoadingRomulusLoader reflectively maps its controller DLL into memory, copying sections, resolving imports, and executing its entry point.T1622 · Debugger EvasionThe launcher checks debugger state, software breakpoints, process debug information, and execution timing before proceeding.
People
Malware
RomulusLoaderThe second chain executes RomulusLoader and ultimately retrieves VulcanRAT207.B over TCP port 1234.VulcanRAT207.AOur previous investigation traced a WhatsApp-delivered lure through Statement.exe to VulcanRAT207.A, a port 8888 WebSocket RAT running with SYSTEM privileges.VulcanRAT207.BThe second chain executes RomulusLoader and ultimately retrieves VulcanRAT207.B over TCP port 1234.
Vendors
IntelThe host is byte for byte identical to the Intel signed VulkanInfo binary in the port 8888 chain, with the same SHA-256 and size.Morphisecour earlier analysis, “From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain” (https://www.morphisec.com/blog/vulcanrat207-a_intrusion-chain_explained/), we documented the Statement.exe-to-port-8888
Products
Microsoft WindowsWhen hosted by the Windows Task Scheduler service host, the controller checks the Schedule service context and either launches the C2 worker, terminates the installed 444.exe process, or enters retry-and-injection logic.Morphisec Automated Moving Target Defense (AMTD)Morphisec Automated Moving Target Defense (AMTD) is designed to disrupt malicious execution in memory, including classes of activity represented by shellcode execution and reflective loading.VulkanInfoShared artifacts include the signed VulkanInfo host, package layout, endpoint IP address, ntdll.dll restoration behavior, and the 0x0207 protocol prefix.