Analysis
- max time kernel
151s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 03:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
rustdesk-host=rabbitmsp.duckdns.org,key=LggHP9sNUvR+bfqDqAsFpTyG20LGT9cClSFO+uSWT6U=.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target rustdesk-host=rabbitmsp.duckdns.org,key=LggHP9sNUvR+bfqDqAsFpTyG20LGT9cClSFO+uSWT6U=.exe
- Size 23.3MB
- Sample260825-dnghasstby
- SHA256 f0053229fa2a2459c8b86f326c3e7423018a72f010f9758dc21be171b112d1b2
- MD5 5af92ed4c3f11961876966d7e13faff4
- SHA1 74345e4c5aeb9406003ac00652910e01495a4bc9
- SHA512 497502e0c513209fdf4e3f5b3b4a5808607bd8c1f729e5af8332b4ef04844949e119d37b93c34e6d579c86ebc70c529d65323afa7c2ef749994fa6ecb967e3c7
- SSDEEP 393216:gwvq+NU4x4OUxSz6yxfEFwB8WYzDlXbKKQeIOZX7lbydJxnjRArJhh6Zmbw:gw24xz6w3FYNbrQrW9y9jYhAZmM
- TLSH T1A7373365F1A7097DD63BC07082011BB6A6797CF94B3598FB029077153F3DED02A3AA68
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 2852 rustdesk.exe 2700 rustdesk.exe 3428 rustdesk.exe 3388 rustdesk.exe - Loads dropped DLL 56 IoCs
pid Process 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2700 rustdesk.exe 2700 rustdesk.exe 2700 rustdesk.exe 2700 rustdesk.exe 2700 rustdesk.exe 2700 rustdesk.exe 2700 rustdesk.exe 2700 rustdesk.exe 2700 rustdesk.exe 2700 rustdesk.exe 2700 rustdesk.exe 2700 rustdesk.exe 2852 rustdesk.exe 2700 rustdesk.exe 3428 rustdesk.exe 3428 rustdesk.exe 3428 rustdesk.exe 3428 rustdesk.exe 3428 rustdesk.exe 3428 rustdesk.exe 3428 rustdesk.exe 3428 rustdesk.exe 3428 rustdesk.exe 3428 rustdesk.exe 3428 rustdesk.exe 3428 rustdesk.exe 3428 rustdesk.exe 3388 rustdesk.exe 3388 rustdesk.exe 3388 rustdesk.exe 3388 rustdesk.exe 3388 rustdesk.exe 3388 rustdesk.exe 3388 rustdesk.exe 3388 rustdesk.exe 3388 rustdesk.exe 3388 rustdesk.exe 3388 rustdesk.exe 3388 rustdesk.exe 3388 rustdesk.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\log\portable-service\rustdesk_rCURRENT.log rustdesk.exe File opened for modification C:\Windows\SystemTemp\shared_memory-rs\shmem_C66C04523EABC8F6 rustdesk.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6128 cmd.exe - Kills process with taskkill 2 IoCs
pid Process 364 taskkill.exe 6100 taskkill.exe - Modifies system certificate store 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\CA\Certificates\0185FF9961FF0AA2E431817948C28E83D3F3EC70 rustdesk.exe Set value (data) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\CA\Certificates\0185FF9961FF0AA2E431817948C28E83D3F3EC70\Blob = 0300000001000000140000000185ff9961ff0aa2e431817948c28e83d3f3ec70140000000100000014000000813292412b28cd46c8c4a2c62a3912ec48a93f146b0000000100000020000000384e9f98355a133565eb03083b79e71a46f00c21352ed7c06990d841228cbe880f0000000100000030000000f55821c081b58e86eaa202923e715e1524c422c7be0469b13a9e7a319e50d70cb5b67e864273029a79250f9dc3203cbd19000000010000001000000079d9deaeb2dbf0e37e8750aa80b4cdfa5c0000000100000004000000000c00001800000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c4b0000000100000044000000310038004500360042003400410035003700410036004200430037004500430039004200380036003100430044004600320044003600440030004400300032005f0000002000000001000000200600003082061c30820404a003020102021033d708a891405319e2a5bbd339b9ad6e300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3336303332313233353935395a3057310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312e302c060355040313255365637469676f205075626c696320436f6465205369676e696e6720434120455620523336308201a2300d06092a864886f70d01010105000382018f003082018a0282018100bbd1fe1eb7425b78f590a7ae2c83f18d21d33086857bdfd3cdd9164bac85c5bb01cfe28c28117204762c81c5ab127a404ac510e88114391b5f4f07f63030307f3525e5c0733d400994e8a8f8eb390b55d5b60c8b1e27f8de3e22c1bfef65ee73ee65dd28ddbb1f7d9b327fb7995517aab249a83c106a3ac321b299a843d73b82a81961b53e6a5a5db8bc9e13d00a9ef55b8f693868eaa51f5bca23ee0bedbcd01e43436eb0538cc2732a44316ebe8fb8c602f6bb820415790c5220e898277161ef2fe4f802fb3359b5f4c355e7dff60822aeb6d10959ec019f7389b7434fd5f2d9bd565909ddb717f6c47480ba8746ac06dbdb040dd54ebaee8c093419951be670130425df8fb8d784338c6ca60ceb68ba954f7c44e8d4698d2579c321f13577f84fb6125595d056e81802d5ee79c886a169f11b4e94136a0762f0d06b99a597509e1c33a11eee618b05681c8ef5ee269083d6fe7185a79af20d143e36b512ad77757acce746366a9053cbc69471de073a21f9d63267e09c6e5486a064a083cb0203010001a38201633082015f301f0603551d2304183016801432eb929aff3596482f284042702036915c1785e6301d0603551d0e04160414813292412b28cd46c8c4a2c62a3912ec48a93f14300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff02010030130603551d25040c300a06082b06010505070303301a0603551d200413301130060604551d20003007060567810c0103304b0603551d1f044430423040a03ea03c863a687474703a2f2f63726c2e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67526f6f745234362e63726c307b06082b06010505070101046f306d304606082b06010505073002863a687474703a2f2f6372742e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67526f6f745234362e703763302306082b060105050730018617687474703a2f2f6f6373702e7365637469676f2e636f6d300d06092a864886f70d01010c050003820201005f36acfbf9f6725a14b7f00b1dded8fd9701d2fd01ee992d86e8f6b7f039ffd6814a5aa7424a0a2d159de694fdc5694ab2d74bf116124cf6be9066658b2d74d4ab08f76a110308777cbe69e1b0db9f248903d6de5ca4e0b2d6b4cfe338d5b96dcc27d6ce6411e8107276d3f9e0e92c89e949d3b39796060ae1f60ac8419a915d81d8367798ca804197a8f8913f639faacd54544b80eaf51766d39471fd9efd4731e3e91a861dd3be20d23fb1525fb293bd8c950998728f9501f49843a54afb1426aa9d36bf72b0fcdcbd840deced34a85e952b3816630575d9f6312e156be294b22ad27435b5989aa3fef82b2fb6174b276c5ae6b9765eda86ddab64d66aea8318881b3182f588b39425c0212f086902e34cbb4c2a1130eb817906e141952ad420f60b93e47c760c9d1d266b5f8401f62a99cdafdec7f0e418a24e9b2f2a0c66a6927526bed94035136faea6371a7ae8ad1c5163072a56066ced7e18f6e3ec6473a66d08368baf0f99ae756b172bc24d6ac351464156e98fc28dff13719bdaed9ed39fabe545a612c5145a524197a3060008c5e61cea27823c3bdbe646c4ef2d003513cd367d9de5aa270805cccec0360e4b194fd0639a6dbfc529533122db75507786d0f2f86aee6b061b3e85232b97c87e7a99410cdd587f0ea8c3123d3a359be09d2c8c17815444a87a1d989d967f5958a65465ff51420bf847ebcff8e5bf rustdesk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E rustdesk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 6b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd20f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd rustdesk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254836b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd22000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd rustdesk.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2852 rustdesk.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2700 rustdesk.exe 2700 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe 2852 rustdesk.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 364 taskkill.exe Token: SeDebugPrivilege 2700 rustdesk.exe Token: SeDebugPrivilege 6100 taskkill.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2852 rustdesk.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2852 rustdesk.exe 2852 rustdesk.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2552 wrote to memory of 364 2552 rustdesk-host=rabbitmsp.duckdns.org,key=LggHP9sNUvR+bfqDqAsFpTyG20LGT9cClSFO+uSWT6U=.exe 88 PID 2552 wrote to memory of 2852 2552 rustdesk-host=rabbitmsp.duckdns.org,key=LggHP9sNUvR+bfqDqAsFpTyG20LGT9cClSFO+uSWT6U=.exe 91 PID 2852 wrote to memory of 2700 2852 rustdesk.exe 92 PID 2852 wrote to memory of 6128 2852 rustdesk.exe 93 PID 2852 wrote to memory of 3428 2852 rustdesk.exe 95 PID 6128 wrote to memory of 6100 6128 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\rustdesk-host=rabbitmsp.duckdns.org,key=LggHP9sNUvR+bfqDqAsFpTyG20LGT9cClSFO+uSWT6U=.exe"C:\Users\Admin\AppData\Local\Temp\rustdesk-host=rabbitmsp.duckdns.org,key=LggHP9sNUvR+bfqDqAsFpTyG20LGT9cClSFO+uSWT6U=.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\system32\taskkill.exe"taskkill" /F /IM RuntimeBroker_rustdesk.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:364
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service --portable-service-shmem-name=_portable_service_2852_29f945713⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700 -
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system --portable-service-shmem-name=_portable_service_2852_29f945714⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:3388
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\system32\taskkill.exetaskkill /F /IM RuntimeBroker_rustdesk.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6100
-
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3428
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\rustdesk\data\app.so
- Size 12.7MB
- SHA256 84328df154658f03bd5f6e0f6aff48c279eaf8caa64280a916b36fb66e5abd0f
- MD5 ab9ae77c67d98012bbf31236acfd565c
- SHA1 6ab32edc55cd333401f0322d34dbf2d833344424
- SHA512 05fbd6b6e9140cc14e36d1e76b72c9b879503d5b70d28757837484f7d443c42d38527683569d5a1c4a02754d930ba74d85c1db0c6c112d5dd1afb81aa993b753
- SSDEEP 393216:K222x/LoGXSNKcBfHtJTn18F/AFke30TFYoHOMUX:Yc/5CNjPtJT1EACe30RWMUX
- TLSH T1D4D63B5FD0B647A0C029B6B5F79E6BBB5A1878D84E74A18656DC0B723E93C6007CE133
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\data\flutter_assets\AssetManifest.bin
- Size 4KB
- SHA256 5ff1849d2dfcedb6c994c116105f3b816559e3ce71bee1ec9aca3c265e2d4651
- MD5 917644686808dc844d51a83e4d00a519
- SHA1 84126e9459aed8e2a413262610f68699bd83ebd8
- SHA512 bf8b025af83cdff803af3f13549e503c2f7b52b9cb07d19b941b305fdb2af5ba763401fad631858d96a26a6358ce381f7b2a88898f464d100529d98e1d368693
- SSDEEP 96:12fMzo5d9I/SVqMk24bfiKhwzNZnvjEkviyeyXU2:y9VqMk24bfiKhwzNZbEkviyeyXU2
- TLSH T1EF918A2842B11ACD6875B4B26CD255CA181A4F855D98F2FF233AC9287185C7B48FFCB5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\data\flutter_assets\FontManifest.json
- Size 483B
- SHA256 068f1cc96816fab157a6813ce233731e46bf661ad84d0018381fb58b19396886
- MD5 f4f31d18ca443c7bfb50340e84b860d5
- SHA1 f97538077e02122cf0377211bba8a4ab0bbbe4f3
- SHA512 3da40b86ad28f41e29b44112601a910e4d2def19a0da8de3c272fb59227b025f7d25e713a3f89d22069f5799bf68fa4ac5647e85a71344925d664a61ac3e6ffe
- TLSH T1DDF0540F052519F890DDC595B0E3649370542B47528DE81EE7751FA4ABF0B0027286F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\data\icudtl.dat
- Size 760KB
- SHA256 c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c
- MD5 692337664e861ad322138061132dddc6
- SHA1 8a99bc860eda0772f3b1f4a125fa4d474410e21c
- SHA512 3e2e6adb651e37e530734f999634d7c101fa1c45ae380be8ad169bbfb0a047f2878ff6c8d1428d6b9e7301b447ab2f8839484322ddb3831984be71d442829a55
- SSDEEP 12288:HMlhw771h0jM7ykPG07+r4c8w0P4N48RkjtYdPHz982VT50q:ahw3zVtjsbGu4RjgPHzfCq
- TLSH T18CF47C03B1D79C9FE0D48636C9A1E37A9A33978C5B7311D67E6D45887F4A0D70282BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\desktop_drop_plugin.dll
- Size 330KB
- SHA256 a1f2c0ea79b890bc29f85f9d0852b48a70db80f277b3de6c78d6ab56e8415f4d
- MD5 f89ad7df37f4a1359f6193fc90abcc41
- SHA1 890038b3eb61a062e13cd7d31a63dea569ae69bb
- SHA512 a7e4bd0b5201363aed5ff0214cdc17c14bc65f076e988e1624d008e5137e2c4725a75d377ab7862d3ad82d78b507bae40975910107975a368ff8e6a5e2089c3d
- SSDEEP 6144:1Rd/9uC6PoqJivCriaariRqiKPl0Gyq7SsIE9J:1RaC6xi6DaG8iKPlXyGSsIE9J
- TLSH T16B745B19B7A954BAE167853CC9A34945EBF2BC560BA0D6CB1390075A3F33BE0493E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\desktop_multi_window_plugin.dll
- Size 394KB
- SHA256 679a4339ca9f852b43e20461dfee9ace74b73cfbcb41a2a6a266143b05df8d58
- MD5 6cb0e418620fb22aae8939d68548cd6e
- SHA1 98384c95eb7185d156423146256e0ded952dc489
- SHA512 bc6dbd03891ddc57063d6c12a75d013ec266994fbede1597c1de21236c58bb8bffe9d30a73d984f565fdb207425afa2ee75e59a35eb848adce5c3a99f3e2b1aa
- SSDEEP 6144:3EHBL7tynClpbXh3mkPBBN2IGdkem4EgxEPwlnvwT0unzIp:U1iCl7FvN2DdnxEPwlnvwouzIp
- TLSH T17B846C2AFB6504B5E167C138C9B74646DA727C894B609BCF2394075A6F33FE04A3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\file_selector_windows_plugin.dll
- Size 357KB
- SHA256 ff166f4fc5c77dd5ef1d949ea853f83fd30be15faa212dc33b812af59132777c
- MD5 345add44e2b7022bc5bffc7c079c922a
- SHA1 ae823787a58666c3e5e7276d63cd905aa4a0165d
- SHA512 4d179917b9ee0809da05e986b5c4a655e805e309639cc529cef9ad9f32c204a3c6e566ea50ae22fbe36fb473c28db3d91dc846a30e751d57fc1b4b3873c65e58
- SSDEEP 6144:dRDPe8/ArrCObbV7jMiW0zBOHpxI9z6bdx7xvsUE7tIU:XCrrCQVjW0UpChM7xvsJtIU
- TLSH T1FC746D1AFBA854B5E167C178CDA78945EBB27C460B6096CF23A0075A2F33FE0593E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\flutter_custom_cursor_plugin.dll
- Size 320KB
- SHA256 74829f83b54c73a8237a62e7ed9be8ab261c6ed19bb0422e4dc519f004e37fce
- MD5 7dd601abf78f05f8ca30c4405b3e4e1b
- SHA1 31e4bb9e1dd29aeb5d8994d40090b98ca567980d
- SHA512 18b97f83232127ce336cd6e996ccee5549aad039bd6ab3102c9f3222d6ef5a32000cf483ec998179e65cc50b4bee2839b1f54977595ddb5ea643e0d9367bb87f
- SSDEEP 6144:3wYCGjdkOMK38qsYp+G9pF5Z7qaE4gSX7kIe:AYCGjnl3G03pHZ7qaE4g7Ie
- TLSH T1F1646C19F7A454BAE167813CCD974945EBF27C460BA0E6CB1390069A3F37BE14A3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\flutter_gpu_texture_renderer_plugin.dll
- Size 352KB
- SHA256 89b9fb175902d5319742015111f19ef4f28d9bc328d0ed125c14e65092c26e61
- MD5 c7b8a0d12675c07666daa6252594b75c
- SHA1 efc7d0f331dfd0145a5ebef730362d4e2d08a7e6
- SHA512 4a8c11cf70c801e6093b26acd1963d9fe82f9a35b2d3b8c7abecfc9049988e21f0a7833a368627017bbde04f21682ab1680ee833c3c9262de049d508c0ee12ac
- SSDEEP 6144:vIqQRCxIDdJ9kzqMeOtvQVSUiOnSg7TOo2iGIx:rQRCxyJ+zUOWVSUiO77TOokIx
- TLSH T157747D1AFBA454BAE167C138C9674945E7B27C460B609BCF13A40B5A2F37FE0893E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\flutter_windows.dll
- Size 17.2MB
- SHA256 fa82840fe5c909e036193de663a29fd76724bcc78013c165a42797928f8cf646
- MD5 50cd313ab5cb448b978f02e348efcf4b
- SHA1 37e5d2f57e310b0b121f431453e1be8edfad7b99
- SHA512 f62e547bb96c2283fb6f22706bd03622366c410b9334dd7742298ff84b45d94baafe7b84c68c0e31ed8cb3cc5ba9a640c1f4bf4b74191af481dc715666de8f21
- SSDEEP 98304:Ar9tjMEbhsb464T36lgzqbka78FKAWS3rpUJkUNZ3phDJ8cpSq6nYriNtZ356rXw:Affggz7Q35r36YriN707e3
- TLSH T159078C03E59640FDC48DD2B89B5B9A27F671B8490621B5DF238827263F67BB01B3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\librustdesk.dll
- Size 34.4MB
- SHA256 80e10134e74f56483b4294b1dcd69dc393ccf8505903534c33c2b3d67cfbe00f
- MD5 369724c5cfdfcb34dd818599e0139bcf
- SHA1 36e41c02d4a86d1008045412c04189f703713877
- SHA512 88708e6bda059aef51efe5db467cec0820e411d6529fff1388df8788743a52336ebf1cfa2e13dc52b3ccb33fcfce38809fb1c19221b3e8b125dfe3a6c31328d9
- SSDEEP 393216:GaWS4c3Ba0LXEoUPNKhSAPn6YQPhkSDV9H7bDmZPir4RY6GUS6pKnDKjts3nYlWL:GatQ0RGRLArPsX
- TLSH T1FF877C46F35651E8C02AE474826B6E22FAB17C4D43316BEB17D44A213E63BD05B3F798
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\printer_driver_adapter.dll
- Size 1.3MB
- SHA256 722997c2ae438622e266039779c6deec6e2c9038978e53c08338226672c79d4f
- MD5 b5f14a0937973623839066b4956323dd
- SHA1 a3490c0a49f57b9770cbe4cc60fd914ce2ace73c
- SHA512 2e1c68ba57ed91e61204c2df60ec972e2cf1381c75361c9742349de995cfbe9df18cfa547e670ed2f0f9e5557ea3be5f36d18ef1c2b32917a6a89e15a59b5310
- SSDEEP 24576:jUzwii98X0HkTYjW1JXp2gX9N8WdAov2Efq/FBIN:IzwLHOa4Xp2vWdfqd8
- TLSH T1B3557D62FA95897DC06BC07482574BB6AA7174CA0B30A9FF419896383E25FF51F3C394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
- Size 358KB
- SHA256 26c45993946f63063e12fbe38546a13c55ec596ea362ce657545c74459622331
- MD5 e03f61d97aadd6fee0ed418dd2448ee0
- SHA1 5eb26fe2e4be8175d8315ec1e4e09c1f8d604e92
- SHA512 cef1513f9f51144e85395363804a7ac59110c55e3ac88634a81287fc31cc8e54bfd4271fee1a50b6e6574a341044a0e6860fd637c59ea64b4c7424a7debe6783
- SSDEEP 6144:tebSY1I7C/UpanQo06Up3Qou01bvoFm0EjW0VqWusUIgi:/C/DL0r3QCbom0EjW0VqWrUIgi
- TLSH T134747E19FBA414F9E1678538CD664945EA727C4A0BB1D7CF23940B9A2F33AE04D3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\screen_retriever_plugin.dll
- Size 524KB
- SHA256 c8fc6af10ed327e6c8a3ccf857da31cbd1f74bcee2451102efa40c25f7baf2bc
- MD5 609ab7ccf5505efc26fb13af6d4f675c
- SHA1 a0431a91d1cd44186fea4ccb002ac487bf7c6be6
- SHA512 d0816c74691334acb42238f4468ddef5b91c206cd71c29ec453198f19671554e7393fe9515fa48f9d50b8211ecb5c5d9054f5e65779d6b64af74456450851c31
- SSDEEP 6144:ovM4CN74yApJ245VAhLQzzBzXjEUmo1wOerpzQSUJ+LDf82yroz7wgfuPb6Il:opCNkTAizXjjT3+LDf0oz7wgfIb6Il
- TLSH T1F3B46C2AE7A843B5E167D138C9534606F7B1B84A576196CF43E00AAE2F677F04A3F311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\texture_rgba_renderer_plugin.dll
- Size 329KB
- SHA256 52e7d7c4e04b2e615749036726b21bd30184d7bac98139f0319d0c94dff65e7b
- MD5 2a76323287a4e1bd59b70b37f05eeae5
- SHA1 ce4c1c9dae66abf988f232ba6768a1b7d6da4006
- SHA512 dd3e99c291f21a4c299823980cf2b99e6875d6fdcdc885c545fa699478b1f8211b5ef39d17afb4f754556402dbad04d79f031bf18cca6bda5b9aeef32365bce3
- SSDEEP 6144:cK6gpCyvo6xlody6G1iYpCyo7Vmhi4nqaYI3:cYCyghybroyo7VmhlYI3
- TLSH T19D745B1AF7A514B5E167853CC9A34A46EBB27C460BA1E6CF13A0075A3F33BE0593E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\uni_links_desktop_plugin.dll
- Size 527KB
- SHA256 262c841c71573c515b82706e406be5b80c64c25f47af9baea581a428c0bc0519
- MD5 7ddea7c1f66fe4b87b1a48d85d9567cb
- SHA1 bef202995ffdfa36227dcce6c54e51d92dc293fb
- SHA512 04a63abb7a65e9767fad16fcd214ac2f66de0c8e7f464f3310c195c6315c8f9f9aba771f61a77bf5adad4c7809f99ffe8c216510f358f3aae2c88cb6e485da5a
- SSDEEP 6144:aT8UknWbCV/HZFfulbfzHlvnCN3WZlAgNSAWUSXYFs+F1EkMINLQ7qaEBhjLpcFW:aT8NeCV8lvnljhF1EkMIpQ7qaEBhSwIm
- TLSH T1BDB47D29F7AC43B5E167D178C9934906E7B1B84A576197CF43E006AA2F277E04A3F321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\url_launcher_windows_plugin.dll
- Size 333KB
- SHA256 fcf4b19dac191c0ca36229399185718cb025e449105766a848f63a8ed2d8059c
- MD5 09f6f4f13fa77daa74f1955be5816849
- SHA1 359fbc886753861b5dfe53072b70959779783c12
- SHA512 4f480a9aef24011d5ea14a3c7f3156cc86bde28c620b41a4ae40041627dcdd077acc2c971a02bfbaa89616f205d50834de95fda50764fdb45e40a5701f9c8a31
- SSDEEP 6144:n7uWnIdCDOlYgxWprJc0XuM5s7Vob76II:SWnIdChgUpO0+M5s7VobWII
- TLSH T1F3746B1AF7A554B9E167C13CC9634945EBB2BC524BA0D6CF1390065A3F37BE08A3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\window_manager_plugin.dll
- Size 553KB
- SHA256 5c7aa01462153107875f4c2eed83f4d2caf8fb9398a124834d9370e9744f2240
- MD5 9cb4404d2ffec2b4dde57d19f54f2de0
- SHA1 237c08024d172adb74a8ba5de60e51010fe93e6c
- SHA512 fb67d22d46519924718b4f9bee88487756c970bf6e14d14d211dbb27307d1abd1fa9ce902d3a945e734847127cb7cf4716b69f05740df31e8b3435316a48efe8
- SSDEEP 6144:ghljoCpTGgCP3CB0+rx9GhawM/3zuc37gvOJwzZ/4t1GdjS2QMEoPjzdCR7l+0PY:5gCPyBdz1Z8jpQTm0PqaEOET9IE
- TLSH T18CC48D1AB6A843B5E167D138C9874606EBB1B8465761A7CF03E056AF2F277F04A3F311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\window_size_plugin.dll
- Size 522KB
- SHA256 7acf74517909275e9d02d93f01212c6c0900ac5a2fc52d80582dcba41e54f5e2
- MD5 167a981870622e9facea1ffa221a0327
- SHA1 fcb789333f107b9ddfa8922fc2d5c0498216b511
- SHA512 9f320bbb0c46c68daf7297a7fc9089ecf7d797348ca86cf9f39d7465d1146d964d6c77c83ce8d26e7d6325c2ac2185d6620509e27b9a7e413c4e0d23562a2b77
- SSDEEP 6144:rthj2jCUMPI7HV0nUBD5P9noC+yCIz3JjjoI1ZiQfKxY8GMj8PqaqpPxyXeehI5:rwCUPNnoIF13KxY8B8PqaqpPoI5
- TLSH T1E9B46D29E7AC43B6F167D178C9574502EBB1784A176197CF03E046BA2F277E04A3E722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\RustDesk\config\RustDesk2.toml
- Size 126B
- SHA256 39fd009fe8d4b20f4abe3599dbb1f41cf84e265efe602e7e92ca9d1abdf28aee
- MD5 f4dc73377d5a30942d24217af1dbf419
- SHA1 e03bdb4cc21ccc167be9f2edb6991ecc70ae1e22
- SHA512 6be58aa7c56ddafed26c0aaa54ff7b7aa75038979ce5fcae31eedf04bcff6ad5332ce59ea3e9d25043548f01da090d364d2e89eaa348f7a29dd2fa7facd00e32
- TLSH T1DBB02B40C773328010C500C02C3B5015CC2C4332194A05D13383C60064CC509D908D17
- MD5 SHA1 SHA512 TLSH