baa36514329766db2993e8435d92209f167b27725e54ca166239158bd100794f

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RiotClientServices.exe
Size 11.9MB
Sample260724-phkhjsyvht
SHA256 baa36514329766db2993e8435d92209f167b27725e54ca166239158bd100794f
MD5 e946e35aa172f9a403bf2b7e76b3f698
SHA1 c2d97c265ccb112387b508d4362b23920a3e9bc0
SHA512 c3723a59b40b895e96e4daf87b8f35f11be337c13c7f866020523b2a65f1c8c0c450aac6bd8b065db4c1e3292e52bff0f52441844f371b03c7245605080458e6
SSDEEP 98304:NbtsZXDVFXzJ2iUeVUK5lmb13PONW1wVwoECBxMKiJqx+:NbtkpFXN2iYKC1mNW+V4C/g
TLSH
T133C65B03E86241E9C5AAD6308AB6D263BB717C495B2037D72B50F7382F76BD06E79710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1728	netsh.exe
6136	netsh.exe
5008	netsh.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\test_elev.tmp	RiotClientServices.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1
HTTP User-Agent header	4	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe
5684	RiotClientServices.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 1728	5684	RiotClientServices.exe	89
PID 5684 wrote to memory of 6136	5684	RiotClientServices.exe	91
PID 5684 wrote to memory of 5008	5684	RiotClientServices.exe	93

C:\Users\Admin\AppData\Local\Temp\RiotClientServices.exe
"C:\Users\Admin\AppData\Local\Temp\RiotClientServices.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=RiotClientServices
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1728
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=RiotClientServices_out
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:6136
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=RiotClientServices dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\RiotClientServices.exe protocol=any profile=any enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5684-5-0x00007FF60F4A0000-0x00007FF6101D8000-memory.dmp

Download

memory/5684-6-0x00007FF60F4A0000-0x00007FF6101D8000-memory.dmp

Download

memory/5684-7-0x00007FF60F4A0000-0x00007FF6101D8000-memory.dmp

Download

memory/5684-8-0x00007FF60F4A0000-0x00007FF6101D8000-memory.dmp

Download

memory/5684-9-0x00007FF60F4A0000-0x00007FF6101D8000-memory.dmp

Download

memory/5684-10-0x00007FF60F4A0000-0x00007FF6101D8000-memory.dmp

Download

memory/5684-11-0x00007FF60F4A0000-0x00007FF6101D8000-memory.dmp

Download

memory/5684-12-0x00007FF60F4A0000-0x00007FF6101D8000-memory.dmp

Download

memory/5684-13-0x00007FF60F4A0000-0x00007FF6101D8000-memory.dmp

Download

memory/5684-14-0x00007FF60F4A0000-0x00007FF6101D8000-memory.dmp

Download

memory/5684-15-0x00007FF60F4A0000-0x00007FF6101D8000-memory.dmp

Download

memory/5684-16-0x00007FF60F4A0000-0x00007FF6101D8000-memory.dmp

Download

memory/5684-17-0x00007FF60F4A0000-0x00007FF6101D8000-memory.dmp

Download

memory/5684-18-0x00007FF60F4A0000-0x00007FF6101D8000-memory.dmp

Download