8e7ac17758d334ebb73a932415c26993a4d254c1f40bf4fe51a429c51d635225

Analysis

max time kernel
150s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REMOTO-DLL.exe
Size 396KB
Sample260603-pgalysfy7r
SHA256 8e7ac17758d334ebb73a932415c26993a4d254c1f40bf4fe51a429c51d635225
MD5 5fb1010f98372b1c48c9aad649b6a123
SHA1 d08fb4758a92f3b1367a570ed828672edd321e50
SHA512 ce423fee3ae1dee90b4096f68088a13926cac88e2ab7206107d105c07dac872d34573f025638bf0d6635a62c3b354e1ea1f661920140e25fa38b3a8a28635dbc
SSDEEP 6144:t+cyl/IICwlBJuSaPwJ+dU6WcH9WaquhWm0EjW0Vq0TBNk7am8R:oCwlu++dWcH9qu0m0EjW0Vq087x8R
TLSH
T1BB849E1AFBA414F9E1678138CD664945EB727C5A0BA1D7CF23940B962F33AE04E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2340	icacls.exe
1620	icacls.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\REMOTO DLL\log\REMOTO-DLL_rCURRENT.log	REMOTO-DLL.exe
File opened for modification	C:\Windows\SystemTemp\shared_memory-rs\shmem_6DEC2C0C5ED8E597	REMOTO-DLL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4844	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1680	REMOTO-DLL.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1680	REMOTO-DLL.exe
1680	REMOTO-DLL.exe
4760	REMOTO-DLL.exe
4760	REMOTO-DLL.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	REMOTO-DLL.exe
Token: SeDebugPrivilege	4844	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	REMOTO-DLL.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1680	REMOTO-DLL.exe
1680	REMOTO-DLL.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2340	1680	REMOTO-DLL.exe	81
PID 1680 wrote to memory of 1620	1680	REMOTO-DLL.exe	82
PID 1680 wrote to memory of 4760	1680	REMOTO-DLL.exe	85
PID 1680 wrote to memory of 1900	1680	REMOTO-DLL.exe	86
PID 1900 wrote to memory of 4844	1900	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe
"C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\system32\icacls.exe
  "icacls" "C:\ProgramData\REMOTO DLL" /grant *S-1-1-0:(OI)(CI)F /T
  2⤵
  - Modifies file permissions
  PID:2340
- C:\Windows\system32\icacls.exe
  "icacls" "C:\ProgramData\REMOTO DLL\shared_memory_portable_service" /grant *S-1-1-0:(OI)(CI)F /T
  2⤵
  - Modifies file permissions
  PID:1620
- C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe
  "C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe" --portable-service
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4760
- - C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe
    "C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe" --run-as-system
    3⤵
    - Drops file in Windows directory
    PID:2608
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RuntimeBroker_rustdesk.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shared_memory_portable_service

Path C:\ProgramData\REMOTO DLL\shared_memory_portable_service
Size 23B
SHA256 9ca82b97c2daab68ff5a6fbd3373604df9850245bcd78dfd676d47fc6bdc8181
MD5 49918a005ca4cd928f93f202561e0889
SHA1 c6a3727d0209e294d36f9d1251e1a8b753e62bb0
SHA512 355cdda67f2391808c571166d97b55646d435c79dbbbfdacfb0249be24ac241f58bdea1b66540c9e56a0de3f61cf8f7575b88d597aa20007f3bb1ff48ef64bbe
MD5 SHA1 SHA512

Submit Download

memory/1680-2-0x000002BBD7F70000-0x000002BBD7F71000-memory.dmp

Download

memory/1680-4-0x000002BBDA750000-0x000002BBDB3F5000-memory.dmp

Download

memory/1680-8-0x000002BBDA6D0000-0x000002BBDA6D1000-memory.dmp

Download

memory/1680-3-0x000002BBDA750000-0x000002BBDB3F5000-memory.dmp

Download

memory/1680-5-0x000002BBDA750000-0x000002BBDB3F5000-memory.dmp

Download

memory/1680-65-0x000002BBD5690000-0x000002BBD5836000-memory.dmp

Download

memory/2608-70-0x000002D3253C0000-0x000002D325566000-memory.dmp

Download

memory/4760-26-0x000002C929400000-0x000002C9295A6000-memory.dmp

Download