be4ea6c0805f73ffd2be16c27f7c37870cba9ccf720c560a9acea480b5f2bf91

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REMOTO-DLL.exe
Size 388KB
Sample260603-pgalysfy8j
SHA256 be4ea6c0805f73ffd2be16c27f7c37870cba9ccf720c560a9acea480b5f2bf91
MD5 0ff06d634032d04dbd7d601054954b6c
SHA1 154e823ce44cb6aa09ebfe99a0f8eb14d03defa9
SHA512 c948c7c7ee9c6e4ec6165ed1b8c12d54c87ecd324d2b671d9b4dea54393b8d49f8ff6e16e740e470240c134e1ec7550990a5454a90febeeb1b0a1df701fff82c
SSDEEP 6144:X+cyl/IICwlBJuSaPwJ+dU6WcH9Waq2hWm0EjW0Vq0TBNk7am8:KCwlu++dWcH9q20m0EjW0Vq087x8
TLSH
T15D848E19FBA414F9E1678138CD664945EB727C5A0BB197CF23940B9A2F33AE04E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1788	icacls.exe
4924	icacls.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\REMOTO DLL\log\REMOTO-DLL_rCURRENT.log	REMOTO-DLL.exe
File opened for modification	C:\Windows\SystemTemp\shared_memory-rs\shmem_3B4D2465588F6048	REMOTO-DLL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1412	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1480	REMOTO-DLL.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4020	REMOTO-DLL.exe
4020	REMOTO-DLL.exe
1480	REMOTO-DLL.exe
1480	REMOTO-DLL.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4020	REMOTO-DLL.exe
Token: SeDebugPrivilege	1412	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1480	REMOTO-DLL.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1480	REMOTO-DLL.exe
1480	REMOTO-DLL.exe
1480	REMOTO-DLL.exe
1480	REMOTO-DLL.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 1788	1480	REMOTO-DLL.exe	81
PID 1480 wrote to memory of 4924	1480	REMOTO-DLL.exe	82
PID 1480 wrote to memory of 4020	1480	REMOTO-DLL.exe	85
PID 1480 wrote to memory of 4256	1480	REMOTO-DLL.exe	87
PID 4256 wrote to memory of 1412	4256	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe
"C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\system32\icacls.exe
  "icacls" "C:\ProgramData\REMOTO DLL" /grant *S-1-1-0:(OI)(CI)F /T
  2⤵
  - Modifies file permissions
  PID:1788
- C:\Windows\system32\icacls.exe
  "icacls" "C:\ProgramData\REMOTO DLL\shared_memory_portable_service" /grant *S-1-1-0:(OI)(CI)F /T
  2⤵
  - Modifies file permissions
  PID:4924
- C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe
  "C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe" --portable-service
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- - C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe
    "C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL.exe" --run-as-system
    3⤵
    - Drops file in Windows directory
    PID:5036
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RuntimeBroker_rustdesk.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shared_memory_portable_service

Path C:\ProgramData\REMOTO DLL\shared_memory_portable_service
Size 23B
SHA256 72c554f20dd35a4cce352726d57f67070f30b0feb8b5fb86db9ae58fd30c27ee
MD5 420f8517222cf64815257ee00cf64ee7
SHA1 b227ee5e4fae9ee4edbd966a44a7e37569045bf2
SHA512 5c792c6fcc655752d664b49de388c0d98d01b108c72af1abb47e95ce6161b008e8ee238e096461dba1ad634d36517a63f6cb09c30d34b543a6c80b5af5abcbd9
MD5 SHA1 SHA512

Submit Download

memory/1480-424-0x000001CAB4FB0000-0x000001CAB6C60000-memory.dmp

Download

memory/1480-106-0x000001CAB4FB0000-0x000001CAB6C60000-memory.dmp

Download

memory/1480-2-0x000001CAB9FC0000-0x000001CAB9FC1000-memory.dmp

Download

memory/1480-5-0x000001CABA230000-0x000001CABAED5000-memory.dmp

Download

memory/1480-4-0x000001CABA230000-0x000001CABAED5000-memory.dmp

Download

memory/1480-590-0x000001CAB4FB0000-0x000001CAB6C60000-memory.dmp

Download

memory/1480-70-0x000001CAB4FB0000-0x000001CAB6C60000-memory.dmp

Download

memory/1480-225-0x000001CAB4FB0000-0x000001CAB6C60000-memory.dmp

Download

memory/1480-184-0x000001CAB4FB0000-0x000001CAB6C60000-memory.dmp

Download

memory/1480-145-0x000001CAB4FB0000-0x000001CAB6C60000-memory.dmp

Download

memory/1480-3-0x000001CABA230000-0x000001CABAED5000-memory.dmp

Download

memory/1480-546-0x000001CAB4FB0000-0x000001CAB6C60000-memory.dmp

Download

memory/1480-506-0x000001CAB4FB0000-0x000001CAB6C60000-memory.dmp

Download

memory/1480-267-0x000001CAB4FB0000-0x000001CAB6C60000-memory.dmp

Download

memory/1480-311-0x000001CAB4FB0000-0x000001CAB6C60000-memory.dmp

Download

memory/1480-352-0x000001CAB4FB0000-0x000001CAB6C60000-memory.dmp

Download

memory/1480-390-0x000001CAB4FB0000-0x000001CAB6C60000-memory.dmp

Download

memory/1480-6-0x000001CAB9FD0000-0x000001CAB9FD1000-memory.dmp

Download

memory/1480-466-0x000001CAB4FB0000-0x000001CAB6C60000-memory.dmp

Download

memory/4020-10-0x0000023AD16F0000-0x0000023AD33A0000-memory.dmp

Download

memory/5036-71-0x0000021C99DF0000-0x0000021C9BAA0000-memory.dmp

Download

memory/5036-150-0x0000021C99DF0000-0x0000021C9BAA0000-memory.dmp

Download

memory/5036-595-0x0000021C99DF0000-0x0000021C9BAA0000-memory.dmp

Download