Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
22/04/2026, 12:31
General
- Target rustdesk-host=remote.mtc-server.de,key=gVUI62sIIEXmAkHhtBRYK8wumXkFQjxaLcL51uwqPnQ=.exe
- Size 19.8MB
- Sample260422-pp7awsfs2p
- SHA256 23b661d7bc171cd500d5096456905283ffe06479582b62d3bd5066633935d43e
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 47 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- RustDesk remote access tool
RustDesk is an open-source remote admin tool.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 2 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rustdesk-host=remote.mtc-server.de,key=gVUI62sIIEXmAkHhtBRYK8wumXkFQjxaLcL51uwqPnQ=.exe"C:\Users\Admin\AppData\Local\Temp\rustdesk-host=remote.mtc-server.de,key=gVUI62sIIEXmAkHhtBRYK8wumXkFQjxaLcL51uwqPnQ=.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM RuntimeBroker_rustdesk.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T3⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T3⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RuntimeBroker_rustdesk.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
shared_memory_portable_service
app.so
desktop_drop_plugin.dll
desktop_multi_window_plugin.dll
flutter_custom_cursor_plugin.dll
flutter_windows.dll
librustdesk.dll
rustdesk.exe
screen_retriever_plugin.dll
texture_rgba_renderer_plugin.dll
uni_links_desktop_plugin.dll
url_launcher_windows_plugin.dll
window_manager_plugin.dll
window_size_plugin.dll
memory/1348-202-0x00000145DC9E0000-0x00000145DCD58000-memory.dmp
memory/1456-176-0x000002A119150000-0x000002A1194C8000-memory.dmp
memory/1604-203-0x0000016980090000-0x0000016980408000-memory.dmp
memory/2976-171-0x0000020BF3F70000-0x0000020BF42E8000-memory.dmp
memory/3984-110-0x000001D3AF990000-0x000001D3AFD08000-memory.dmp
memory/4056-90-0x0000026FAB000000-0x0000026FAB378000-memory.dmp
memory/4996-140-0x000001EAC1860000-0x000001EAC24F1000-memory.dmp
memory/4996-137-0x000001EAC1860000-0x000001EAC24F1000-memory.dmp
memory/4996-136-0x000001EAC17E0000-0x000001EAC17E1000-memory.dmp
memory/4996-141-0x000001EAC1860000-0x000001EAC24F1000-memory.dmp
memory/4996-142-0x000001EAC17F0000-0x000001EAC17F1000-memory.dmp
memory/4996-204-0x000001EABC7F0000-0x000001EABCB68000-memory.dmp
memory/4996-322-0x000001EABC7F0000-0x000001EABCB68000-memory.dmp
memory/4996-441-0x000001EABC7F0000-0x000001EABCB68000-memory.dmp
memory/4996-675-0x000001EABC7F0000-0x000001EABCB68000-memory.dmp