Overview

overview

8

Static

static

3

Adobe-Docu...6A.exe

windows10-2004-x64

8

Adobe-Docu...6A.exe

windows11-21h2-x64

7

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDIR/INetC.dll

windows11-21h2-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows11-21h2-x64

3

$PLUGINSDI...ay.dll

windows10-2004-x64

3

$PLUGINSDI...ay.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...ON.dll

windows10-2004-x64

3

$PLUGINSDI...ON.dll

windows11-21h2-x64

3

$PLUGINSDI...rk.dll

windows10-2004-x64

3

$PLUGINSDI...rk.dll

windows11-21h2-x64

3

$TEMP/Inte...er.exe

windows10-2004-x64

1

$TEMP/Inte...er.exe

windows11-21h2-x64

1

$TEMP/RMM....er.exe

windows10-2004-x64

1

$TEMP/RMM....er.exe

windows11-21h2-x64

1

ArpLookup.dll

windows10-2004-x64

1

ArpLookup.dll

windows11-21h2-x64

1

Cloud.Back...IO.dll

windows10-2004-x64

1

Cloud.Back...IO.dll

windows11-21h2-x64

1

CronExpres...or.dll

windows10-2004-x64

1

CronExpres...or.dll

windows11-21h2-x64

1

Elasticsearch.Net.dll

windows10-2004-x64

1

Elasticsearch.Net.dll

windows11-21h2-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/05/2026, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Adobe-Document-Large-File_rmm_v2.5.0.67_oid4e02d40f-326b-4cce-a0d6-502c2b99e72b_bidBJevs7-txkS-iM-mMo1D6A.exe
  • Size 17.1MB
  • Sample260511-pgwt7ac16j
  • SHA256 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 26 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Adobe-Document-Large-File_rmm_v2.5.0.67_oid4e02d40f-326b-4cce-a0d6-502c2b99e72b_bidBJevs7-txkS-iM-mMo1D6A.exe
    "C:\Users\Admin\AppData\Local\Temp\Adobe-Document-Large-File_rmm_v2.5.0.67_oid4e02d40f-326b-4cce-a0d6-502c2b99e72b_bidBJevs7-txkS-iM-mMo1D6A.exe"
    1⤵
    • Downloads MZ/PE file
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4296
    • C:\Windows\SysWOW64\EVENTCREATE.EXE
      "C:\Windows\system32\EVENTCREATE.EXE" /T INFORMATION /L APPLICATION /ID 100 /SO "MSP360 RMM Agent installer" /D "Begin installation."
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4000
    • C:\Windows\SysWOW64\CMD.EXE
      "C:\Windows\system32\CMD.EXE" /C move /y "C:\Users\Admin\AppData\Local\Temp\RMM Agent\install.log" "C:\Program Files\RMM Agent\"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4532
    • C:\Windows\SysWOW64\CMD.EXE
      "C:\Windows\system32\CMD.EXE" /C dotnet --list-runtimes 1> C:\Users\Admin\AppData\Local\Temp\nsh56E7.tmp 2>&1
      2⤵
      • System Location Discovery: System Language Discovery
      • System Time Discovery
      • Suspicious use of WriteProcessMemory
      PID:2576
      • C:\Program Files\dotnet\dotnet.exe
        dotnet --list-runtimes
        3⤵
        • System Time Discovery
        PID:4568
    • C:\Windows\SysWOW64\CMD.EXE
      "C:\Windows\system32\CMD.EXE" /C copy "C:\Program Files\RMM Agent\install.log"+C:\Users\Admin\AppData\Local\Temp\nsh56E7.tmp "C:\Program Files\RMM Agent\install.log"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:456
    • C:\Users\Admin\AppData\Local\Temp\nsh704D.tmp
      C:\Users\Admin\AppData\Local\Temp\nsh704D.tmp /passive /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3216
      • C:\Windows\Temp\{3BBE36A6-2623-4D25-BABF-A9AAD593D2A7}\.cr\nsh704D.tmp
        "C:\Windows\Temp\{3BBE36A6-2623-4D25-BABF-A9AAD593D2A7}\.cr\nsh704D.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsh704D.tmp" -burn.filehandle.attached=688 -burn.filehandle.self=692 /passive /norestart
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4256
        • C:\Windows\Temp\{6C870C33-F5D0-4DF8-845C-5940DEADBDDE}\.be\windowsdesktop-runtime-8.0.22-win-x64.exe
          "C:\Windows\Temp\{6C870C33-F5D0-4DF8-845C-5940DEADBDDE}\.be\windowsdesktop-runtime-8.0.22-win-x64.exe" -q -burn.elevated BurnPipe.{6595844D-839C-49FD-A067-CCBD8B61D2FA} {0037B34A-9676-4D35-BCE6-3DD526B9AAB8} 4256
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:4344
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 1140
          4⤵
          • Program crash
          PID:4272
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 819D66CFDF9824CCE74A451E0FA5552D
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4892
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 84F8FCD249B65C7823957B424585A97F
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:960
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 8E95ED4B6747CBA3E65B9E892C812B07
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4964
  • C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe
    "C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4748
    • C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe
      "C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260511135057.log"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4644
      • C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe
        "C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260511135057.log"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3224
        • C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe
          "C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\windowsdesktop-runtime-8.0.22-win-x64.exe" -q -burn.elevated BurnPipe.{4A46B056-F81E-4909-AB5B-AA5F46C39C8B} {67291EE8-44CD-43C0-A708-176A1D1F7B0B} 3224
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:3052
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1140
          4⤵
          • Program crash
          PID:5048
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4256 -ip 4256
    1⤵
      PID:2028
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3224 -ip 3224
      1⤵
        PID:4348

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e59d175.rbs
            • Path C:\Config.Msi\e59d175.rbs
            • Size 48KB
            • SHA256 069c714aa7586ce744f0018fcf9117554f2b68d565e91e06633098010d947b90
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59d17a.rbs
            • Path C:\Config.Msi\e59d17a.rbs
            • Size 9KB
            • SHA256 223b83607adff0addff285955a9fb70ada39cf70cf41e74e091f56fb7873d286
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            install.log
            • Path C:\Program Files\RMM Agent\install.log
            • Size 8KB
            • SHA256 f7d8ad061cae0e411973da43b8f5972b93c196127714459a52ac4a0fd70150a0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            install.log
            • Path C:\Program Files\RMM Agent\install.log
            • Size 9KB
            • SHA256 8e6d6e809cedd98ca853482b684f7d5e00027914932e962f4cba14f6ef2c22a0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            state.rsm
            • Path C:\ProgramData\Package Cache\{a3899eef-6164-4d42-b8c3-95ae6a844821}\state.rsm
            • Size 908B
            • SHA256 e08c53d6ebf404dc1231fa0af5880ef8595718610253bda311025b3102d7b263
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260511135057.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260511135057.log
            • Size 11KB
            • SHA256 2b193d99c773b912d621048ec4e3512e4741a416590d8e2b5d0c8d05da32755a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260511135057_000_dotnet_runtime_8.0.22_win_x64.msi.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.22_(x64)_20260511135057_000_dotnet_runtime_8.0.22_win_x64.msi.log
            • Size 2KB
            • SHA256 7da8fbcea83e9561c03ee9eb215bb02d68385b040a4af8202bf4e0ff1ed41c17
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            install.log
            • Path C:\Users\Admin\AppData\Local\Temp\RMM Agent\install.log
            • Size 8KB
            • SHA256 0c4633dfe083ee56f4f852f5bb4b9a88a0fc14c870116db42357580a6334a43e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsh56E7.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\nsh56E7.tmp
            • Size 552B
            • SHA256 3a540187aba2047118a389c22152a488c215f21766cd75e59c187f7c414bddb1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            INetC.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nst1AB8.tmp\INetC.dll
            • Size 21KB
            • SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nst1AB8.tmp\System.dll
            • Size 10KB
            • SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UAC.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nst1AB8.tmp\UAC.dll
            • Size 17KB
            • SHA256 e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            modern-wizard.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\nst1AB8.tmp\modern-wizard.bmp
            • Size 150KB
            • SHA256 bfb254c0cbb17a4350a312e79dcccda1beef44701b03e014841d367557840509
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsArray.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nst1AB8.tmp\nsArray.dll
            • Size 12KB
            • SHA256 81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nst1AB8.tmp\nsDialogs.dll
            • Size 9KB
            • SHA256 4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsExec.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nst1AB8.tmp\nsExec.dll
            • Size 6KB
            • SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            processwork.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nst1AB8.tmp\processwork.dll
            • Size 231KB
            • SHA256 27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSID6DE.tmp
            • Path C:\Windows\Installer\MSID6DE.tmp
            • Size 219KB
            • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsh704D.tmp
            • Path C:\Windows\Temp\{3BBE36A6-2623-4D25-BABF-A9AAD593D2A7}\.cr\nsh704D.tmp
            • Size 608KB
            • SHA256 daa2e35615ad3b138003d150096c27dd03bd754c434657031e64c33376eddb40
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bg.png
            • Path C:\Windows\Temp\{6C870C33-F5D0-4DF8-845C-5940DEADBDDE}\.ba\bg.png
            • Size 4KB
            • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{6C870C33-F5D0-4DF8-845C-5940DEADBDDE}\.ba\wixstdba.dll
            • Size 190KB
            • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_host_8.0.22_win_x64.msi
            • Path C:\Windows\Temp\{6C870C33-F5D0-4DF8-845C-5940DEADBDDE}\dotnet_host_8.0.22_win_x64.msi
            • Size 708KB
            • SHA256 41bee98f21575992e7a5ae1e0e499881117e62f46d722fe183016338c025ee32
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_hostfxr_8.0.22_win_x64.msi
            • Path C:\Windows\Temp\{6C870C33-F5D0-4DF8-845C-5940DEADBDDE}\dotnet_hostfxr_8.0.22_win_x64.msi
            • Size 776KB
            • SHA256 5348ead3f40fbede2047d43c8303e20b12bfc2e0bdf5ebf5020ebc3b311b28d4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_runtime_8.0.22_win_x64.msi
            • Path C:\Windows\Temp\{6C870C33-F5D0-4DF8-845C-5940DEADBDDE}\dotnet_runtime_8.0.22_win_x64.msi
            • Size 26.3MB
            • SHA256 efab95895aa3d5dee85b686cef9a81c613cd8bdc1cadcc9ecfe248804e96b4fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            windowsdesktop_runtime_8.0.22_win_x64.msi
            • Path C:\Windows\Temp\{6C870C33-F5D0-4DF8-845C-5940DEADBDDE}\windowsdesktop_runtime_8.0.22_win_x64.msi
            • Size 29.1MB
            • SHA256 4605b47ecf5e0512c595e2ea514985f0187765b4d80eca72c95bba40c61c38a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thm.wxl
            • Path C:\Windows\Temp\{FC3FB58C-8245-475A-B133-F2771DBE8BEC}\.ba\1033\thm.wxl
            • Size 5KB
            • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2744-270-0x00000164EEBB0000-0x00000164EEC5C000-memory.dmp
            Download

            memory/2744-271-0x00000164F0F60000-0x00000164F0F6C000-memory.dmp
            Download

            memory/2744-493-0x00000164EEBB0000-0x00000164EEC5C000-memory.dmp
            Download

            memory/3052-492-0x0000000002870000-0x00000000028A4000-memory.dmp
            Download

            memory/4296-34-0x00000000027C0000-0x0000000002801000-memory.dmp
            Download