f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e

Analysis

max time kernel
180s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe
Size 30.2MB
Sample260808-phancawfnd
SHA256 f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e
MD5 1d4e31eeaabfea203505a503e7aa8e96
SHA1 31283d0ab182d3ca2ac7dee39bf1d67cdaa26a38
SHA512 beca7aec9028be5059370c9d92f4f4e866b3627e94681caccab7c58c8d1c0029b77f08f7677edb8252c61e07a194021746fea5d820c112ba3a34fb676e7b8e2f
SSDEEP 786432:WmtwijsbokVM1mrrZBiT/BCmDJZW8QWfbH:Wmrk0
TLSH
T132678D40E797ABA4C8860431205FBB3BA7385D198319CBF3D7D46E75A8737C1197AB0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\log\portable-service\f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e_rCURRENT.log	f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe
File opened for modification	C:\Windows\SystemTemp\shared_memory-rs\shmem_12335D68A44F3F0B	f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3928	556	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2408	f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe
2408	f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 2408	556	f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe	90

C:\Users\Admin\AppData\Local\Temp\f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe
"C:\Users\Admin\AppData\Local\Temp\f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:556
- C:\Users\Admin\AppData\Local\Temp\f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe
  "C:\Users\Admin\AppData\Local\Temp\f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe" --portable-service --portable-service-shmem-name=_portable_service_556_5d07f7b8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- - C:\Users\Admin\AppData\Local\Temp\f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe
    "C:\Users\Admin\AppData\Local\Temp\f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.exe" --run-as-system --portable-service-shmem-name=_portable_service_556_5d07f7b8
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 1520
  2⤵
  - Program crash
  PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 556 -ip 556
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shared_memory_portable_service_556_5d07f7b8

Path C:\ProgramData\RustDesk\portable_service_shmem\shared_memory_portable_service_556_5d07f7b8
Size 23B
SHA256 18d3b588cb27c44b7f616f324b7cefd859989d3f901e9bd579315946b2175ca6
MD5 e6ab0aa73e0baa767a02519617aab8b2
SHA1 52983d132935f38265fddd9bf3e0cb80fbcb35b2
SHA512 b52529c01d6dce2b4a08044dec2c14cdd1d2211adc2c1bc5d5a624ccba2b04e69d0a5c58fdeae039450e982d31074cf9a370590ce942628f073345e0c07f121e
MD5 SHA1 SHA512

Submit Download