APT37 NarwhalRAT sandbox evasion via userscreen.exe CPUID VM check then network connect

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•6

Detects execution of a renamed pythonw.exe (userscreen.exe) from a suspicious location (Public\AccountPictures) that demonstrates short-lived execution characteristics indicative of a sandbox/VM evasion check, immediately followed by network connectivity to known NarwhalRAT C2 domains or pcloud infrastructure.