RSServCmd[.]exe | Triage™

Resubmissions

09/08/2026, 02:13

260809-cnspwsgk4z3

09/08/2026, 02:09

260809-clh3nsstbt6

Sharing

Copy URL Twitter E-mail

General

Target
RSServCmd.exe
Size 7.6MB
Sample260809-clh3nsstbt
SHA256 e80752b1e14d8cffffb828e9d776f4c64cb79ca79e4f1c5538d2bf5905ae7cb3
MD5 b49b23a56a3934fb6cd0d787b65028aa
SHA1 cd69079e828917e56ea95c128dfab86d75317897
SHA512 85840aa1cae66fa5b894c70596c4818bbbe08087f4708802813bd49099ce1b615f26d9a282ec6eff63abca137e9848094d35d813c289501d6fb7b6ff581b42f3
SSDEEP 196608:BMUSF2n5kSTGGWCYj/FsQ/vtc/aBYHEoVk9Bi+K7XzS:BJSFdShWT9/vtcBHEoVk9037XzS
TLSH
T13286D002F202C154D456DD398D42AA96E7717848AF2657EB3284BF1E2EF73C19FBA740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RSServCmd.exe

File Explorer

RSServCmd.exe

.exe 7.6MB

RSServCmd.exe

IMPHASH 2aef0c6665db96d751007949aa1b3591
SHA256 e80752b1e14d8cffffb828e9d776f4c64cb79ca79e4f1c5538d2bf5905ae7cb3
MD5 b49b23a56a3934fb6cd0d787b65028aa
SHA1 cd69079e828917e56ea95c128dfab86d75317897
SHA512 85840aa1cae66fa5b894c70596c4818bbbe08087f4708802813bd49099ce1b615f26d9a282ec6eff63abca137e9848094d35d813c289501d6fb7b6ff581b42f3
SSDEEP 196608:BMUSF2n5kSTGGWCYj/FsQ/vtc/aBYHEoVk9Bi+K7XzS:BJSFdShWT9/vtcBHEoVk9037XzS
TLSH
T13286D002F202C154D456DD398D42AA96E7717848AF2657EB3284BF1E2EF73C19FBA740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1532968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpReceiveResponse WinHttpAddRequestHeaders WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpQueryHeaders

bcrypt

BCryptGetProperty BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash

rpcrt4

UuidCreate RpcStringFreeA UuidToStringA

kernel32

GetFileInformationByHandleEx GetLocaleInfoEx InitOnceComplete InitOnceBeginInitialize WriteFile Sleep GetTempPathA CreateFileA DeleteFileA CloseHandle GetCurrentProcessId GetModuleHandleA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleFileNameA LoadLibraryExA GetLastError FormatMessageA GetTickCount64 SetThreadPriority GetCurrentThread GetCurrentThreadId CreateDirectoryA VirtualAllocEx CreateDirectoryW GetEnvironmentVariableW GetFileAttributesW GetFileAttributesExW ReadFile PeekNamedPipe CreateFileW OpenProcess WaitNamedPipeW MoveFileExW SetConsoleMode GetConsoleMode GetLocalTime GetConsoleWindow GetComputerNameA LocalFree QueryFullProcessImageNameW GetConsoleScreenBufferInfo SetConsoleTitleA WaitForSingleObject SetConsoleCP GetModuleHandleW SetConsoleOutputCP Process32First SetLastError Module32Next GetProcessId Module32First CreateToolhelp32Snapshot Process32Next GetExitCodeProcess SetPriorityClass K32GetProcessMemoryInfo SetProcessWorkingSetSize ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead SetFileInformationByHandle CopyFileW GetStdHandle GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle FindNextFileW FindFirstFileExW FindFirstFileW FindClose AreFileApisANSI GetCurrentProcess

user32

DispatchMessageA GetWindowRect DestroyWindow IsWindow TrackMouseEvent SetWindowLongA SetWindowDisplayAffinity CreateCursor MessageBoxA DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow ShowCursor SetWindowPos GetWindowLongPtrA GetDesktopWindow MonitorFromPoint GetDC GetWindow IsWindowVisible ShowWindow EnumWindows BringWindowToTop FindWindowW SetForegroundWindow GetWindowTextW GetWindowThreadProcessId GetForegroundWindow ScreenToClient LoadCursorA GetMessageExtraInfo GetKeyState GetShellWindow SendInput IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCursorPos GetSystemMetrics GetAsyncKeyState OpenClipboard CloseClipboard EmptyClipboard SetWindowLongPtrA SetCapture GetParent SetCursor GetClientRect GetCapture ClientToScreen GetClipboardData SetClipboardData MonitorFromWindow

gdi32

GetDeviceCaps

comdlg32

GetOpenFileNameA

advapi32

ImpersonateLoggedOnUser RevertToSelf GetTokenInformation OpenProcessToken DuplicateTokenEx

shell32

ShellExecuteA SHGetFolderPathA ShellExecuteExA

ole32

CoInitializeEx CoCreateInstance

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??Bios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ??7ios_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z _Thrd_yield ?_Random_device@std@@YAIXZ _Cnd_broadcast ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Mtx_lock _Mtx_unlock ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z _Query_perf_frequency ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit _Cnd_wait _Thrd_id _Query_perf_counter _Xtime_get_ticks _Thrd_join

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

ws2_32

WSAStartup WSACleanup gethostname inet_ntop freeaddrinfo getaddrinfo

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __std_terminate strstr strchr longjmp strrchr _purecall wcsstr __std_exception_destroy memchr memcpy memset __C_specific_handler __current_exception __current_exception_context _CxxThrowException memcmp memmove __intrinsic_setjmp

api-ms-win-crt-heap-l1-1-0

_callnewh realloc malloc free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

abort strerror system _errno _beginthreadex _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _invoke_watson _get_initial_narrow_environment _initterm _initterm_e _exit terminate __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback exit

api-ms-win-crt-math-l1-1-0

sinh sinf sqrt sqrtf atan2f ceilf cos cosf cosh atan2 round pow atan expf floor floorf fmod frexp fmodf tan asinf sin ceil asin acosf acos roundf _fdclass nearbyint tanh cbrt __setusermatherr ldexp powf lroundf logf log10 exp log

api-ms-win-crt-stdio-l1-1-0

fsetpos __p__commode __stdio_common_vfprintf _set_fmode __stdio_common_vsprintf_s fwrite fseek fgetpos fgetc __stdio_common_vsnprintf_s fputc _wfopen __stdio_common_vsprintf fread __stdio_common_vsscanf freopen ferror fopen getc fclose tmpnam fflush feof __acrt_iob_func fgets ftell clearerr _get_stream_buffer_pointers _pclose tmpfile _fseeki64 setvbuf _popen ungetc _ftelli64

api-ms-win-crt-string-l1-1-0

_wcsicmp isxdigit strpbrk _stricmp strcmp strcpy_s isdigit strspn isalnum toupper strncpy_s strnlen strncpy isgraph isupper tolower isalpha strncmp iscntrl ispunct islower strcoll isspace

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-convert-l1-1-0

strtol strtod strtoull strtoul atoi strtof atof

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale setlocale

api-ms-win-crt-time-l1-1-0

_gmtime64 _localtime64_s strftime _localtime64 clock _difftime64 _time64 _gmtime64_s _mktime64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file remove rename