Analysis
- user interaction
yes - max time kernel
150s - max time network
153s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
10/07/2026, 14:21
General
- Target krita.dll
- Size 23.9MB
- Sample260710-rpg24sdt4w
- SHA256 77a617f4af4ff6fe93e0e199663810b432719c093abb9e3bcddb6e179d363725
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 59 IoCs
- RustDesk remote access tool
RustDesk is an open-source remote admin tool.
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\krita.dll,#11⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rustdesk-1.4.9-x86_64.exeC:\Users\Admin\AppData\Local\Temp\rustdesk-1.4.9-x86_64.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM RuntimeBroker_rustdesk.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service --portable-service-shmem-name=_portable_service_2040_f9885a5c4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system --portable-service-shmem-name=_portable_service_2040_f9885a5c5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RuntimeBroker_rustdesk.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
rustdesk-1.4.9-x86_64.exe
app.so
desktop_drop_plugin.dll
desktop_multi_window_plugin.dll
file_selector_windows_plugin.dll
flutter_custom_cursor_plugin.dll
flutter_gpu_texture_renderer_plugin.dll
flutter_windows.dll
librustdesk.dll
printer_driver_adapter.dll
rustdesk.exe
screen_retriever_plugin.dll
texture_rgba_renderer_plugin.dll
uni_links_desktop_plugin.dll
url_launcher_windows_plugin.dll
window_manager_plugin.dll
window_size_plugin.dll
RustDesk2.toml
memory/1040-323-0x000001FEA1CB0000-0x000001FEA2DFF000-memory.dmp
memory/1040-244-0x000001FEA1CB0000-0x000001FEA2DFF000-memory.dmp
memory/2040-419-0x0000023DF56E0000-0x0000023DF682F000-memory.dmp
memory/2040-303-0x0000023DF56E0000-0x0000023DF682F000-memory.dmp
memory/2040-201-0x0000023DF56E0000-0x0000023DF682F000-memory.dmp
memory/2040-659-0x0000023DF56E0000-0x0000023DF682F000-memory.dmp
memory/2040-621-0x0000023DF56E0000-0x0000023DF682F000-memory.dmp
memory/2040-580-0x0000023DF56E0000-0x0000023DF682F000-memory.dmp
memory/2040-222-0x0000023DF56E0000-0x0000023DF682F000-memory.dmp
memory/2040-236-0x0000023DF56E0000-0x0000023DF682F000-memory.dmp
memory/2040-155-0x0000023DFC570000-0x0000023DFD229000-memory.dmp
memory/2040-153-0x0000023DF9570000-0x0000023DF9571000-memory.dmp
memory/2040-264-0x0000023DF56E0000-0x0000023DF682F000-memory.dmp
memory/2040-156-0x0000023DFC570000-0x0000023DFD229000-memory.dmp
memory/2040-167-0x0000023DFC420000-0x0000023DFC421000-memory.dmp
memory/2040-343-0x0000023DF56E0000-0x0000023DF682F000-memory.dmp
memory/2040-378-0x0000023DF56E0000-0x0000023DF682F000-memory.dmp
memory/2040-154-0x0000023DFC570000-0x0000023DFD229000-memory.dmp
memory/2040-459-0x0000023DF56E0000-0x0000023DF682F000-memory.dmp
memory/2040-500-0x0000023DF56E0000-0x0000023DF682F000-memory.dmp
memory/2040-540-0x0000023DF56E0000-0x0000023DF682F000-memory.dmp
memory/3556-215-0x00000238DC520000-0x00000238DD66F000-memory.dmp
memory/3556-208-0x00000238DC520000-0x00000238DD66F000-memory.dmp
memory/3680-213-0x000001B4552C0000-0x000001B45640F000-memory.dmp