A 12 KB Windows Backdoor Hid Its C2 Domain in desktop.ini Whitespace
Summary
Researchers analyzed a custom 12 KB Windows backdoor found on one Windows 7 workstation. It encoded diagrtrack[.]com in UTF-16LE desktop.ini whitespace and persisted via WMI; the actor and initial access remain unknown.
Key points
- The backdoor was found on one domain-joined Windows 7 SP1 workstation. Researchers assess with moderate confidence that it was selectively deployed, but identified no actor or campaign.
- RtkNGUI64.exe was a custom 12,288-byte x64 executable disguised as Realtek audio software.
- The malware encoded its C2 domain, diagrtrack[.]com, as counts of UTF-16LE spaces in lines appended to a standard desktop.ini header.
- A WMI subscription named “Realtek” used a Win32_LocalTime trigger at 19:50 to start the backdoor.
- The backdoor used ICMP before HTTP POST requests to /version/check.php and supported three commands: system, put, and time.
- After diagrtrack[.]com expired, the implant remained on the workstation and continued attempting network contact until reboot, according to the researchers’ analysis.
- The researchers recommend hunting for desktop.ini files containing whitespace after the standard header and suspicious WMI time-based subscriptions; their structural detection found only the known workstation.
Article Details
- Attack Vectors
- The initial infection vector is unknown; the backdoor was already present before the researchers' protection was installed.
- Persistence used a WMI subscription named “Realtek,” triggered by Win32_LocalTime at 19:50.
- The backdoor decoded its C2 domain from counts of UTF-16LE spaces in desktop.ini.
- It sent an ICMP echo request before communicating with the C2 server through HTTP POST requests to /version/check.php.
- The system command ran commands through cmd.exe; the put command wrote files using content supplied by the C2.
- Defensive Notes
- Hunt for __EventFilter and CommandLineEventConsumer pairs bound to Win32_LocalTime, especially those launching executables from paths that resemble legitimate software.
- Inspect C:ProgramDatadesktop.ini for a stock Windows header followed only by UTF-16 whitespace; treat a zero-byte file at that location as potentially significant.
- Use structural detections for desktop.ini files containing only UTF-16 spaces, carriage returns, and line feeds after byte 174; the article reports this approach detected the observed host.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | diagrtrack[.]com | C2 domain used by the backdoor; it later expired and no longer resolves. |
| SHA256 | 1cc5a4be7f2e41086b53e698b487e43426e5e572bc99e5de62eada9baf83bdcd | Hash identified for the backdoor's whitespace-encoded configuration. |
| SHA256 | d411d93f358128c77aed0be91365b18cfb7575ecd188d22a216cbaeaa51c5e11 | Hash identified for the RtkNGUI64.exe backdoor sample. |
MITRE ATT&CK
T1001 · Data ObfuscationConfiguration data was represented indirectly through whitespace counts rather than readable domain text.T1027 · Obfuscated Files or InformationThe backdoor concealed its C2 domain by encoding its characters as counts of spaces in desktop.ini.T1036 · MasqueradingRtkNGUI64.exe disguised the backdoor as Realtek audio software and used a software-like installation path.T1041 · Exfiltration Over C2 ChannelCommand output was returned in a later C2 beacon, base64-encoded and then URL-encoded.T1059.003 · Windows Command ShellThe system command executed commands through cmd.exe and captured their output.T1071.001 · Web ProtocolsThe backdoor exchanged tasking and responses through HTTP POST requests to /version/check.php.T1095 · Non-Application Layer ProtocolEach communication cycle began with an ICMP echo request carrying the victim identifier.T1105 · Ingress Tool TransferThe put command accepted base64 content and wrote the resulting file to disk.T1546.003 · Windows Management Instrumentation Event SubscriptionA WMI subscription using a Win32_LocalTime filter triggered persistence at 19:50.