Starland RAT Python Process Execution Under WDAGUtilityAccount Account

Duo Tech@duotech

•updated Jul 16, 2026•1•0•1

Detects pythonw.exe or python.exe process execution running under the WDAGUtilityAccount user context, which Starland RAT checks against its hardcoded sandbox-account blacklist before continuing execution. Observing this account name paired with the Python runtime used by the RAT's loader chain is a strong indicator of the malware executing (or attempting to execute) inside a sandboxed analysis environment.