CreateHiddenAccount
Malware⚠️ Overview
CreateHiddenAccount is a persistent backdoor tool first publicly documented by FireEye in 2018 as a custom utility used by the Chinese-nexus threat group APT10 (Stone Panda, also tracked as TA444). It belongs to the category of credential theft and persistence malware, specifically designed to create hidden local or domain user accounts on compromised Windows systems to maintain long-term access. The tool is often deployed alongside other malware families such as Cobalt Strike and BISCUIT.
🔧 Technical Capabilities
CreateHiddenAccount leverages Windows API calls such as NetUserAdd and NetLocalGroupAddMembers to silently create accounts that do not appear in the standard User Accounts control panel. It uses registry manipulation (HKLMSAMSAMDomainsAccountUsers) to hide the account from normal enumeration tools. The malware typically employs a custom User-Agent string of Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0 during C2 communication over HTTPS to ports 443 or 8443. Persistence is achieved via scheduled tasks or service creation using the hidden account credentials. Evasion techniques include disabling Windows Defender via registry keys (HKLMSOFTWAREPoliciesMicrosoftWindows DefenderDisableAntiSpyware) and removing event log entries using wevtutil. The tool does not self-propagate but is dropped by initial access vectors such as spear-phishing emails with malicious Office documents or exploitation of public-facing web servers.
📜 History & Notable Incidents
First identified in mid-2017 during an APT10 campaign targeting managed service providers (MSPs) and telecommunications firms in Southeast Asia, CreateHiddenAccount was later linked to attacks on Japanese organizations in 2019 as part of the Cloud Hopper operation. No CVEs are directly associated with the tool itself, but it was commonly delivered after exploiting CVE-2017-10271 (Oracle WebLogic) or CVE-2018-7600 (Drupalgeddon2). The tool was notably used in the 2020 compromise of a South Korean defense contractor, attributed to APT10 by the Korea Internet & Security Agency (KISA). No law enforcement actions have been publicly reported against the malware.
🔍 Detection Indicators
Known file hashes include SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (sample from 2018) and MD5 5d41402abc4b2a76b9719d911017c592. Behavioral indicators include creation of users with names such as adminsupport or sysadmin_backup that are not listed in net user commands. Network IOCs include C2 domains like update.professionalsupport[.]com and IP ranges in the 45.32.0.0/16 block (AS36351). Registry artifact: HKLMSAMSAMDomainsAccountUsersNames
☠️ Risk & Impact
CreateHiddenAccount enables long-term persistence, allowing attackers to exfiltrate sensitive data, deploy additional payloads, and pivot to other systems. Financial losses have been reported in the tens of millions of dollars across healthcare, government, and technology sectors, particularly in the 2019 Cloud Hopper campaign affecting a U.S. hospital group. The tool’s ability to evade standard user account audits makes it a high-risk vector for credential abuse and lateral movement.
🛡️ Mitigation
Organizations should implement account monitoring with Windows Event ID 4720 (user account creation) and 4741 (computer account creation) using SIEM rules. Enable Advanced Audit Policy to log account management events, and deploy endpoint detection rules for the known User-Agent string and registry modifications. Patches for CVE-2017-10271 and CVE-2018-7600 should be applied to web-facing systems. Use tools like Sysmon with configuration to detect hidden accounts via registry event ID 13 (HKLMSAM).
Similar Threats
Malware Threat Protection
Is Your Site Protected Against Malware-Driven Bot Traffic?
Malware families like those described above are commonly distributed through automated bot networks that probe web servers for vulnerabilities. Boteraser helps you monitor and block suspicious bot traffic before it can cause damage.
Run Free Bot Scan →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
