Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
08/05/2026, 12:21
General
- Target rustdeskx86_64.exe
- Size 23.1MB
- Sample260508-pjct4act4n
- SHA256 422ce31131e6537ea4f611ebf4a4d1804f28a6f58c83aa05065071c5958f1551
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 55 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- RustDesk remote access tool
RustDesk is an open-source remote admin tool.
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rustdeskx86_64.exe"C:\Users\Admin\AppData\Local\Temp\rustdeskx86_64.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM RuntimeBroker_rustdesk.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T3⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T3⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RuntimeBroker_rustdesk.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
shared_memory_portable_service
app.so
desktop_drop_plugin.dll
desktop_multi_window_plugin.dll
file_selector_windows_plugin.dll
flutter_custom_cursor_plugin.dll
flutter_gpu_texture_renderer_plugin.dll
flutter_windows.dll
librustdesk.dll
printer_driver_adapter.dll
rustdesk.exe
screen_retriever_plugin.dll
texture_rgba_renderer_plugin.dll
uni_links_desktop_plugin.dll
url_launcher_windows_plugin.dll
window_manager_plugin.dll
window_size_plugin.dll
RustDesk.372_ThreadId(41)_1778245006321719700
memory/372-163-0x0000024A7F1B0000-0x0000024A7FE55000-memory.dmp
memory/372-162-0x0000024A7F1B0000-0x0000024A7FE55000-memory.dmp
memory/372-161-0x0000024A7F1B0000-0x0000024A7FE55000-memory.dmp
memory/372-160-0x0000024A7D110000-0x0000024A7D111000-memory.dmp
memory/372-164-0x0000024A00150000-0x0000024A00151000-memory.dmp
memory/372-236-0x0000024A79DE0000-0x0000024A79E8C000-memory.dmp
memory/1080-240-0x000002B6E9230000-0x000002B6E92DC000-memory.dmp
memory/1080-855-0x000002B6E9230000-0x000002B6E92DC000-memory.dmp
memory/4792-109-0x00000232EE130000-0x00000232EE1DC000-memory.dmp
memory/4848-193-0x000002040B330000-0x000002040B3D9000-memory.dmp
memory/5028-206-0x0000028210AC0000-0x0000028210B6C000-memory.dmp
memory/5192-105-0x0000020F587F0000-0x0000020F58899000-memory.dmp
memory/5472-186-0x000001F410F20000-0x000001F410FCC000-memory.dmp