Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/08/2026, 23:14
General
- Target JOEKNAUERBAND_rmm_v2.5.0.68_oid3194489f-d085-4291-8d78-656ac55707f3_bidYSHwnSuiR0OuVI-TFmGn5g.exe
- Size 17.1MB
- Sample260810-274zps1cmd
- SHA256 6f35b915daa5c635f6a05e04cdb9b4aa5c682262139316df3ddd6cd412b18eb4
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 20 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JOEKNAUERBAND_rmm_v2.5.0.68_oid3194489f-d085-4291-8d78-656ac55707f3_bidYSHwnSuiR0OuVI-TFmGn5g.exe"C:\Users\Admin\AppData\Local\Temp\JOEKNAUERBAND_rmm_v2.5.0.68_oid3194489f-d085-4291-8d78-656ac55707f3_bidYSHwnSuiR0OuVI-TFmGn5g.exe"1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\EVENTCREATE.EXE"C:\Windows\system32\EVENTCREATE.EXE" /T INFORMATION /L APPLICATION /ID 100 /SO "MSP360 RMM Agent installer" /D "Begin installation."2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.EXE"C:\Windows\system32\CMD.EXE" /C move /y "C:\Users\Admin\AppData\Local\Temp\RMM Agent\install.log" "C:\Program Files\RMM Agent\"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.EXE"C:\Windows\system32\CMD.EXE" /C dotnet --list-runtimes 1> C:\Users\Admin\AppData\Local\Temp\nsw6E38.tmp 2>&12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Time Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\dotnet\dotnet.exedotnet --list-runtimes3⤵
- System Time Discovery
-
-
-
C:\Windows\SysWOW64\CMD.EXE"C:\Windows\system32\CMD.EXE" /C copy "C:\Program Files\RMM Agent\install.log"+C:\Users\Admin\AppData\Local\Temp\nsw6E38.tmp "C:\Program Files\RMM Agent\install.log"2⤵
- Drops file in Program Files directory
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\nsg878E.tmpC:\Users\Admin\AppData\Local\Temp\nsg878E.tmp /passive /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{5B0295B0-BBC1-4FB0-953E-8B340066D358}\.cr\nsg878E.tmp"C:\Windows\Temp\{5B0295B0-BBC1-4FB0-953E-8B340066D358}\.cr\nsg878E.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsg878E.tmp" -burn.filehandle.attached=660 -burn.filehandle.self=668 /passive /norestart3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{1A6ABC9E-5961-4DA9-A3ED-7BF837B23A59}\.be\windowsdesktop-runtime-8.0.22-win-x64.exe"C:\Windows\Temp\{1A6ABC9E-5961-4DA9-A3ED-7BF837B23A59}\.be\windowsdesktop-runtime-8.0.22-win-x64.exe" -q -burn.elevated BurnPipe.{2985D329-8413-4C26-AD2C-CD921B32CD11} {84B5B1DB-60D2-4B23-B928-D6FDAE18A0E1} 23724⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
install.log
install.log
install.log
nsw6E38.tmp
INetC.dll
System.dll
UAC.dll
modern-wizard.bmp
nsArray.dll
nsDialogs.dll
nsExec.dll
processwork.dll
bg.png
wixstdba.dll
nsg878E.tmp
memory/1804-34-0x0000000002900000-0x0000000002941000-memory.dmp