f2d88db941dc4a90b175c0ef3cf42476eb2c0b366a81338a26065c9b29c59281

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REMOTO-DLL-TECNICO.exe
Size 396KB
Sample260603-pgalysfy7p
SHA256 f2d88db941dc4a90b175c0ef3cf42476eb2c0b366a81338a26065c9b29c59281
MD5 e91ab4bd3623cae279dbe5fb627eea57
SHA1 b720c7acfeb3e98e18babf0454e33f5988f6c72f
SHA512 0d239847c70c8c7d4b07ba67c1eca7df307be9349f6d6c805d62b71ce1de2d67eb4e9f8b723557d8489f03d742093f8527f1354d06bc3ad62e4d80d5179625ac
SSDEEP 6144:k+cyl/IICwlBJuSaPwJ+dU6WcH9WaqThWm0EjW0Vq0TBNk7am8D:FCwlu++dWcH9qT0m0EjW0Vq087x8D
TLSH
T1CB849E1AFBA414F9E1678138CD664945EB727C5A0BA1D7CF23940B962F33AE04E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	REMOTO-DLL-TECNICO.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4588	icacls.exe
4552	icacls.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\REMOTO DLL\log\REMOTO-DLL-TECNICO_rCURRENT.log	REMOTO-DLL-TECNICO.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1000	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4548	REMOTO-DLL-TECNICO.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2384	REMOTO-DLL-TECNICO.exe
2384	REMOTO-DLL-TECNICO.exe
4548	REMOTO-DLL-TECNICO.exe
4548	REMOTO-DLL-TECNICO.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	REMOTO-DLL-TECNICO.exe
Token: SeDebugPrivilege	1000	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4548	REMOTO-DLL-TECNICO.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4548	REMOTO-DLL-TECNICO.exe
4548	REMOTO-DLL-TECNICO.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4552	4548	REMOTO-DLL-TECNICO.exe	86
PID 4548 wrote to memory of 4588	4548	REMOTO-DLL-TECNICO.exe	87
PID 4548 wrote to memory of 2384	4548	REMOTO-DLL-TECNICO.exe	90
PID 4548 wrote to memory of 4116	4548	REMOTO-DLL-TECNICO.exe	92
PID 4116 wrote to memory of 1000	4116	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe
"C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\system32\icacls.exe
  "icacls" "C:\ProgramData\REMOTO DLL" /grant *S-1-1-0:(OI)(CI)F /T
  2⤵
  - Modifies file permissions
  PID:4552
- C:\Windows\system32\icacls.exe
  "icacls" "C:\ProgramData\REMOTO DLL\shared_memory_portable_service" /grant *S-1-1-0:(OI)(CI)F /T
  2⤵
  - Modifies file permissions
  PID:4588
- C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe
  "C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe" --portable-service
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2384
- - C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe
    "C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe" --run-as-system
    3⤵
    - Drops file in Windows directory
    PID:1960
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RuntimeBroker_rustdesk.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shared_memory_portable_service

Path C:\ProgramData\REMOTO DLL\shared_memory_portable_service
Size 23B
SHA256 b1813f3f5721121a257782494c19cae222dd7580c06b5325a701df79570e8e57
MD5 bcf4fbfa3588ad2ea0b5814317eae291
SHA1 a1a6c2532d3e13f7f70fc360beeb3529847ea44e
SHA512 7dbfed7641d2334e3264df9bcf90461929cad366b9baf58b0bf0ddc76c8487da0894d2dd03353e4af377805130b68280498c79ddec199616e7d17f49d16dc5b2
MD5 SHA1 SHA512

Submit Download

memory/4548-3-0x0000013C06040000-0x0000013C06CE5000-memory.dmp

Download

memory/4548-8-0x0000013C05CD0000-0x0000013C05CD1000-memory.dmp

Download

memory/4548-5-0x0000013C06040000-0x0000013C06CE5000-memory.dmp

Download

memory/4548-4-0x0000013C06040000-0x0000013C06CE5000-memory.dmp

Download

memory/4548-2-0x0000013C05CC0000-0x0000013C05CC1000-memory.dmp

Download