# HIDDEN COBRA deploys ECCENTRICBANDWAGON keylogger RAT

Published: 2025-07-16 · Severity: routine · Sectors: government-national, defense, energy, financial-services
Canonical: https://vorant.io/reports/d6c389bc-8981-5c57-9cd6-57bcab46813f/hidden-cobra-deploys-eccentricbandwagon-keylogger-rat

> North Korean-attributed ECCENTRICBANDWAGON RAT performs keylogging and screenshots; multiple variants use temp folders and thread-based data exfiltration.

CISA, FBI, and DoD analysis identifies ECCENTRICBANDWAGON, a remote access tool attributed to North Korean HIDDEN COBRA actors. The malware family functions as a reconnaissance platform, deployed via proxy servers to maintain persistent access on victim networks. Four analyzed variants are 64-bit DLLs that create three threads to simultaneously perform keylogging, screen capture, and activity logging. Logged data is written to disguised temp directories using names like "GoogleChrome" and "TrendMicroUpdate" to evade detection. Some variants implement RC4 encryption for embedded strings and cleanup routines; one variant forcibly terminates explorer.exe during shutdown, potentially alerting users. The malware responds only to an exported "Process" function call to cease logging and exit, suggesting control via legitimate host processes or injected code. No active CVE exploitation is documented; the threat relies on initial compromise via separate means.

## Mentioned in this report

- Threat actors: Lazarus Group
- Malware: ECCENTRICBANDWAGON

## Detection guidance (public sample)

### File Written to Temp Directory Masquerading as Chrome or Trend Micro Update

ATT&CK: T1036.005

Files created in Temp subfolders named GoogleChrome or TrendMicroUpdate, the disguised log directories used by ECCENTRICBANDWAGON keylogger and screen-capture data. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: File Written to Temp Directory Masquerading as Chrome or Trend Micro Update
description: Detects file creation inside a Temp subfolder named after a legitimate
  vendor product (GoogleChrome, TrendMicroUpdate). ECCENTRICBANDWAGON stores keylog
  and screenshot data in such disguised directories. Legitimate Chrome and Trend Micro
  components do not normally write to these Temp paths.
tags:
- attack.stealth
- attack.t1036.005
- attack.collection
- attack.t1056.001
- attack.t1113
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - \Temp\GoogleChrome\
    - \Temp\TrendMicroUpdate\
  condition: selection
falsepositives:
- Third-party software that legitimately creates a similarly named staging folder
  under Temp
level: medium
id: 8ada36c1-5343-5907-9861-013b5a46ddf2
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-239a
```

### Rundll32 Invoking Exported Process Function from User-Writable Path

ATT&CK: T1140

rundll32 calling an export named Process on a DLL located in a user-writable path, matching the control interface of the ECCENTRICBANDWAGON DLL. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Rundll32 Invoking Exported Process Function from User-Writable Path
description: Detects rundll32.exe executing an export literally named Process from
  a DLL in a user-writable location (Temp, AppData, ProgramData, Public). The ECCENTRICBANDWAGON
  64-bit DLL only stops logging via an exported Process function, implying it is driven
  by a host process or loader.
tags:
- attack.stealth
- attack.t1140
- attack.collection
- attack.t1056.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \rundll32.exe
  selection_export:
    CommandLine|endswith:
    - ',Process'
    - ',Process"'
    - ', Process'
  selection_path:
    CommandLine|contains:
    - \Temp\
    - \AppData\
    - \ProgramData\
    - \Users\Public\
  condition: selection_img and selection_export and selection_path
falsepositives:
- Custom in-house DLLs that happen to export a function named Process and are run
  via rundll32 from AppData
level: medium
id: dcc3d9b4-b2e4-5731-a1ed-d8eb1029ecf6
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-239a
```

### Forced Termination of explorer.exe via Taskkill

ATT&CK: T1056.001

taskkill forcibly ending explorer.exe, behaviour similar to the ECCENTRICBANDWAGON variant that kills explorer during shutdown. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Forced Termination of explorer.exe via Taskkill
description: Detects taskkill.exe forcibly terminating explorer.exe. One ECCENTRICBANDWAGON
  variant kills explorer.exe during its shutdown routine; command-line based kills
  are a related observable. Needs context since admins and scripts also restart the
  shell.
tags:
- attack.collection
- attack.t1056.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \taskkill.exe
    CommandLine|contains|all|windash:
    - -f
    - explorer.exe
  condition: selection
falsepositives:
- Administrators or helpdesk scripts restarting the Windows shell to apply UI or policy
  changes
- Software installers that restart explorer.exe
level: low
id: 7a58bf25-3787-5007-bf54-df5bf44e961e
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-239a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-239a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d6c389bc-8981-5c57-9cd6-57bcab46813f/hidden-cobra-deploys-eccentricbandwagon-keylogger-rat.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup