NarwhalRAT userscreen.exe Loading user32.dll for KakaoTalk Window Filtering

Ibrahim Saud@tektrix

•updated 14 days ago•0•0•1

Detects the execution of 'userscreen.exe' (a renamed pythonw.exe used by NarwhalRAT) loading 'user32.dll'. This behavior is associated with the use of ctypes in Python to perform window enumeration via EnumWindows, specifically used by the malware to identify and monitor KakaoTalk application windows.