40fc8d9cbedb7439b3e552d0a9dc8d066648d582a64294cde054ea8dbb8d284c

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REMOTO-DLL-TECNICO.exe
Size 388KB
Sample260603-pgalysfy8k
SHA256 40fc8d9cbedb7439b3e552d0a9dc8d066648d582a64294cde054ea8dbb8d284c
MD5 dda81d54b3aeba1d620296f68bcc8064
SHA1 dda82eac1391bb62bd3160c9b98e87c225d0b03d
SHA512 aa5efe96d29495076b3e2301903bf82a8a361de797770b96dff2deca43676abf31fbddda89f5c3f53eb7b7232f96a6e5662da53a61a3b36b8c011efa515410d5
SSDEEP 6144:A+cyl/IICwlBJuSaPwJ+dU6WcH9WaqRhWm0EjW0Vq0TBNk7am8:pCwlu++dWcH9qR0m0EjW0Vq087x8
TLSH
T155848E19FBA414F9E1678138CD664945EB727C5A0BB197CF23940B9A2F33AE04E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4216	icacls.exe
3176	icacls.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\REMOTO DLL\log\REMOTO-DLL-TECNICO_rCURRENT.log	REMOTO-DLL-TECNICO.exe
File opened for modification	C:\Windows\SystemTemp\shared_memory-rs\shmem_B75A5E6F90DDBFC3	REMOTO-DLL-TECNICO.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4092	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3440	REMOTO-DLL-TECNICO.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2364	REMOTO-DLL-TECNICO.exe
2364	REMOTO-DLL-TECNICO.exe
3440	REMOTO-DLL-TECNICO.exe
3440	REMOTO-DLL-TECNICO.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	REMOTO-DLL-TECNICO.exe
Token: SeDebugPrivilege	4092	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3440	REMOTO-DLL-TECNICO.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3440	REMOTO-DLL-TECNICO.exe
3440	REMOTO-DLL-TECNICO.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 4216	3440	REMOTO-DLL-TECNICO.exe	82
PID 3440 wrote to memory of 3176	3440	REMOTO-DLL-TECNICO.exe	83
PID 3440 wrote to memory of 2364	3440	REMOTO-DLL-TECNICO.exe	86
PID 3440 wrote to memory of 5116	3440	REMOTO-DLL-TECNICO.exe	87
PID 5116 wrote to memory of 4092	5116	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe
"C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\system32\icacls.exe
  "icacls" "C:\ProgramData\REMOTO DLL" /grant *S-1-1-0:(OI)(CI)F /T
  2⤵
  - Modifies file permissions
  PID:4216
- C:\Windows\system32\icacls.exe
  "icacls" "C:\ProgramData\REMOTO DLL\shared_memory_portable_service" /grant *S-1-1-0:(OI)(CI)F /T
  2⤵
  - Modifies file permissions
  PID:3176
- C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe
  "C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe" --portable-service
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe
    "C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe" --run-as-system
    3⤵
    - Drops file in Windows directory
    PID:1260
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RuntimeBroker_rustdesk.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shared_memory_portable_service

Path C:\ProgramData\REMOTO DLL\shared_memory_portable_service
Size 23B
SHA256 660a7d37ca22b80c3b7427b9b16a5f73870f23ac7239e44e6c7c1e505efa17c8
MD5 69c3fbf2fbdaf11e922d338b049bd66b
SHA1 1aa680fb7a7d3a8d68fcf95f03612edd7b5e3cf8
SHA512 64c9d6442fb6e0a941b28660d5285b636c2f933273f58090e998b067f261a452dc69e73fc0bf0758af8be0a60fc24b264f45ca960852a22401a25fb1dcf0daab
MD5 SHA1 SHA512

Submit Download

memory/1260-158-0x000001DE1E460000-0x000001DE1E561000-memory.dmp

Download

memory/1260-73-0x000001DE1E460000-0x000001DE1E561000-memory.dmp

Download

memory/2364-10-0x000001A4DD390000-0x000001A4DD491000-memory.dmp

Download

memory/3440-3-0x000001F8D1800000-0x000001F8D24A5000-memory.dmp

Download

memory/3440-5-0x000001F8D1800000-0x000001F8D24A5000-memory.dmp

Download

memory/3440-4-0x000001F8D1800000-0x000001F8D24A5000-memory.dmp

Download

memory/3440-68-0x000001F8CC8C0000-0x000001F8CC9C1000-memory.dmp

Download

memory/3440-6-0x000001F8D1560000-0x000001F8D1561000-memory.dmp

Download

memory/3440-109-0x000001F8CC8C0000-0x000001F8CC9C1000-memory.dmp

Download

memory/3440-151-0x000001F8CC8C0000-0x000001F8CC9C1000-memory.dmp

Download

memory/3440-2-0x000001F8D1550000-0x000001F8D1551000-memory.dmp

Download

memory/3440-315-0x000001F8CC8C0000-0x000001F8CC9C1000-memory.dmp

Download

memory/3440-397-0x000001F8CC8C0000-0x000001F8CC9C1000-memory.dmp

Download