c1dfd3712d6f927acf98a78f1b77367d0b57aefbcd6ea8a7120d61a2b8a76525

Analysis

max time kernel
151s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RiotClientServices.exe
Size 11.9MB
Sample260722-pgd95sef88
SHA256 c1dfd3712d6f927acf98a78f1b77367d0b57aefbcd6ea8a7120d61a2b8a76525
MD5 578cf1b851b46878b94f3bbeba86a092
SHA1 f6b5a311ae505b15d3c4f276ceca779e93ee259a
SHA512 d4cd4657ec519b7f04ba5f85c6bd1fba41e17bb86056092678a7e274dab6f292b77e0d3fba444de071a1bac23cde66ab2c7e67f0d0cb5aa79c5d04d4ab60c298
SSDEEP 98304:wkDIu0jVz14sqCPTgH5lx0QDksHn7pFBOAoSEkPMKiJqxZ8S:wkDIj34sFPTkksbpF0ASC
TLSH
T126C65B03E8A241E9C5AAD6308AB6D163BB717C495B2037D72B50F7382F76BD06E79710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
936	netsh.exe
5748	netsh.exe
3540	netsh.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\test_elev.tmp	RiotClientServices.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	6	Go-http-client/1.1
HTTP User-Agent header	7	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe
4872	RiotClientServices.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 936	4872	RiotClientServices.exe	89
PID 4872 wrote to memory of 5748	4872	RiotClientServices.exe	91
PID 4872 wrote to memory of 3540	4872	RiotClientServices.exe	93

C:\Users\Admin\AppData\Local\Temp\RiotClientServices.exe
"C:\Users\Admin\AppData\Local\Temp\RiotClientServices.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=RiotClientServices
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:936
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=RiotClientServices_out
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5748
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=RiotClientServices dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\RiotClientServices.exe protocol=any profile=any enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4872-5-0x00007FF7F7140000-0x00007FF7F7E78000-memory.dmp

Download

memory/4872-6-0x00007FF7F7140000-0x00007FF7F7E78000-memory.dmp

Download

memory/4872-7-0x00007FF7F7140000-0x00007FF7F7E78000-memory.dmp

Download

memory/4872-8-0x00007FF7F7140000-0x00007FF7F7E78000-memory.dmp

Download

memory/4872-9-0x00007FF7F7140000-0x00007FF7F7E78000-memory.dmp

Download

memory/4872-10-0x00007FF7F7140000-0x00007FF7F7E78000-memory.dmp

Download

memory/4872-11-0x00007FF7F7140000-0x00007FF7F7E78000-memory.dmp

Download

memory/4872-12-0x00007FF7F7140000-0x00007FF7F7E78000-memory.dmp

Download

memory/4872-13-0x00007FF7F7140000-0x00007FF7F7E78000-memory.dmp

Download

memory/4872-14-0x00007FF7F7140000-0x00007FF7F7E78000-memory.dmp

Download

memory/4872-15-0x00007FF7F7140000-0x00007FF7F7E78000-memory.dmp

Download

memory/4872-16-0x00007FF7F7140000-0x00007FF7F7E78000-memory.dmp

Download

memory/4872-17-0x00007FF7F7140000-0x00007FF7F7E78000-memory.dmp

Download

memory/4872-18-0x00007FF7F7140000-0x00007FF7F7E78000-memory.dmp

Download