be4ea6c0805f73ffd2be16c27f7c37870cba9ccf720c560a9acea480b5f2bf91

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REMOTO-DLL.exe
Size 388KB
Sample260603-pgalysfy8j
SHA256 be4ea6c0805f73ffd2be16c27f7c37870cba9ccf720c560a9acea480b5f2bf91
MD5 0ff06d634032d04dbd7d601054954b6c
SHA1 154e823ce44cb6aa09ebfe99a0f8eb14d03defa9
SHA512 c948c7c7ee9c6e4ec6165ed1b8c12d54c87ecd324d2b671d9b4dea54393b8d49f8ff6e16e740e470240c134e1ec7550990a5454a90febeeb1b0a1df701fff82c
SSDEEP 6144:X+cyl/IICwlBJuSaPwJ+dU6WcH9Waq2hWm0EjW0Vq0TBNk7am8:KCwlu++dWcH9q20m0EjW0Vq087x8
TLSH
T15D848E19FBA414F9E1678138CD664945EB727C5A0BB197CF23940B9A2F33AE04E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	REMOTO-DLL.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3012	icacls.exe
2740	icacls.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\REMOTO DLL\log\REMOTO-DLL_rCURRENT.log	REMOTO-DLL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1352	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1192	REMOTO-DLL.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2768	REMOTO-DLL.exe
2768	REMOTO-DLL.exe
1192	REMOTO-DLL.exe
1192	REMOTO-DLL.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2768	REMOTO-DLL.exe
Token: SeDebugPrivilege	1352	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1192	REMOTO-DLL.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1192	REMOTO-DLL.exe
1192	REMOTO-DLL.exe
1192	REMOTO-DLL.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2740	1192	REMOTO-DLL.exe	88
PID 1192 wrote to memory of 3012	1192	REMOTO-DLL.exe	89
PID 1192 wrote to memory of 2768	1192	REMOTO-DLL.exe	92
PID 1192 wrote to memory of 4404	1192	REMOTO-DLL.exe	94
PID 4404 wrote to memory of 1352	4404	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe
"C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\system32\icacls.exe
  "icacls" "C:\ProgramData\REMOTO DLL" /grant *S-1-1-0:(OI)(CI)F /T
  2⤵
  - Modifies file permissions
  PID:2740
- C:\Windows\system32\icacls.exe
  "icacls" "C:\ProgramData\REMOTO DLL\shared_memory_portable_service" /grant *S-1-1-0:(OI)(CI)F /T
  2⤵
  - Modifies file permissions
  PID:3012
- C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe
  "C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe" --portable-service
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- - C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe
    "C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe" --run-as-system
    3⤵
    - Drops file in Windows directory
    PID:1900
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RuntimeBroker_rustdesk.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shared_memory_portable_service

Path C:\ProgramData\REMOTO DLL\shared_memory_portable_service
Size 23B
SHA256 72aa46f262ee28e726ac6733266495419ebcde988c9d2ae30dc882413f38dc96
MD5 d91fdf77921a7293265b54bcf3fe2c0d
SHA1 d8e38f067085cf92f2fa45a5f9dad5a58bd7da31
SHA512 79ad9f44785656ea2558b361751e586ededb5dc1164015ff35f3d20fa75d49f5e70e3cfb1d25c52905cdcfd11917f309c3883f7c678124ae699d4f30056b2c29
MD5 SHA1 SHA512