Overview

overview

8

Static

static

5

PCRemoteRe..._1.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...dl.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

7z.dll

windows11-ltsc_2024-x64

1

MVCameraDriver.dll

windows11-ltsc_2024-x64

1

MonectMediaCenter.exe

windows11-ltsc_2024-x64

1

MonectRunt...ck.exe

windows11-ltsc_2024-x64

8

MonectServer.exe

windows11-ltsc_2024-x64

1

MonectServ...ce.exe

windows11-ltsc_2024-x64

1

PCRemoteReceiver.exe

windows11-ltsc_2024-x64

8

PCRemoteRe...UI.exe

windows11-ltsc_2024-x64

6

Packages/v...64.exe

windows11-ltsc_2024-x64

4

SDL2.dll

windows11-ltsc_2024-x64

1

SDL2_image.dll

windows11-ltsc_2024-x64

1

TouchInput.dll

windows11-ltsc_2024-x64

1

avcodec-59.dll

windows11-ltsc_2024-x64

1

avformat-59.dll

windows11-ltsc_2024-x64

1

avutil-57.dll

windows11-ltsc_2024-x64

1

channel.dll

windows11-ltsc_2024-x64

1

driver/ViG...us.sys

windows11-ltsc_2024-x64

3

driver/ViG...09.dll

windows11-ltsc_2024-x64

1

driver/leg...us.sys

windows11-ltsc_2024-x64

3

driver/leg...09.dll

windows11-ltsc_2024-x64

1

driver/leg...09.dll

windows11-ltsc_2024-x64

1

driver/leg...df.sys

windows11-ltsc_2024-x64

3

driver/leg...oy.sys

windows11-ltsc_2024-x64

3

driver/usb...64.exe

windows11-ltsc_2024-x64

1

driver/usb...dd.dll

windows11-ltsc_2024-x64

1

driver/vJo...09.dll

windows11-ltsc_2024-x64

1

driver/vJo...df.sys

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 04:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MonectRuntimeCheck.exe
  • Size 122KB
  • Sample260731-ewdbaace47
  • SHA256 84d0135bdd7b3e51d79ba0a799145bc9be78b4870e8b48d38722e45f6fc2af34
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Drops file in Drivers directory 9 IoCs
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Drops file in System32 directory 52 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 10 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MonectRuntimeCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\MonectRuntimeCheck.exe"
    1⤵
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Users\Admin\AppData\Local\Temp\driververifyx64.exe
      "C:\Users\Admin\AppData\Local\Temp\driververifyx64.exe"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2028
    • C:\Windows\System32\netsh.exe
      advfirewall firewall add rule name="MonectServerService" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\MonectServerService.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:4376
    • C:\Windows\System32\netsh.exe
      advfirewall firewall add rule name="PCRemoteReceiver" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\PCRemoteReceiver.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:4592
    • C:\Windows\System32\netsh.exe
      advfirewall firewall add rule name="MonectMediaCenter" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\MonectMediaCenter.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:7040
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{049e0dd3-37fa-3143-92e4-9f56496c778a}\vjoy.inf" "9" "49e52482b" "0000000000000180" "WinSta0\Default" "000000000000017C" "208" "c:\users\admin\appdata\local\temp\driver\vjoy"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:6000
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\System32\DriverStore\FileRepository\vjoy.inf_amd64_958aef712eba5057\vjoy.inf" "oem1.inf:b2fe4818a00a2e82:vjoy.Inst.Win7:12.53.21.621:root\vid_1234&pid_bead&rev_0219," "49e52482b" "0000000000000180" "9334"
    1⤵
    • Drops file in Drivers directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:6964
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x000000000000049C 0x00000000000004F0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4440
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{9a15cf9b-aad7-714e-8d56-9cadf05e9b94}\vigembus.inf" "9" "429a86e87" "0000000000000180" "WinSta0\Default" "000000000000017C" "208" "c:\users\admin\appdata\local\temp\driver\vigem"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:6152
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\System32\DriverStore\FileRepository\vigembus.inf_amd64_dc012c700833063e\vigembus.inf" "oem2.inf:c14ce88408607219:ViGEmBus_Device:1.16.112.0:nefarius\vigembus\gen1," "429a86e87" "0000000000000180" "9334"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:5236
  • C:\Users\Admin\AppData\Local\Temp\MonectServerService.exe
    C:\Users\Admin\AppData\Local\Temp\MonectServerService.exe
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Users\Admin\AppData\Local\Temp\driververifyx64.exe
      -disable
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3464
    • C:\Users\Admin\AppData\Local\Temp\MonectServer.exe
      "C:\Users\Admin\AppData\Local\Temp\MonectServer.exe"
      2⤵
        PID:3416

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          dberr.txt
          • Path C:\Windows\System32\CatRoot2\dberr.txt
          • Size 63KB
          • SHA256 4bedefd377b4c5caedba06fd256dda49ed1e9a3ecb3d6a82e97de422017edda3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vigembus.inf_amd64_dc012c700833063e.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\vigembus.inf_amd64_dc012c700833063e.ini
          • Size 554B
          • SHA256 67a99ba73ff878b5fadf187b23c81e751409892217357833f31bdbd93503c10c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2700-25-0x00007FF8B0CD0000-0x00007FF8B0ED3000-memory.dmp
          Download

          memory/2700-26-0x00007FF8B81F0000-0x00007FF8B8293000-memory.dmp
          Download

          memory/2700-28-0x00007FF8AF7C0000-0x00007FF8AF868000-memory.dmp
          Download

          memory/2700-27-0x00007FF8A0FA0000-0x00007FF8A5EA9000-memory.dmp
          Download