Analysis
- max time kernel
166s - max time network
169s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/09/2026, 12:27
General
- Target rustdesk-host=gateway.network26.com,key=dv7BFGROJbEQ93eOcRffzyc3BsVu0GzLiuozNqLWmpw=.exe
- Size 23.3MB
- Sample260903-pm2bvsgp8x
- SHA256 eaedeb0088e687bf46f7c46a9c6ea5493ce51f3134dfd6acbedb47b5b9136274
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 56 IoCs
- RustDesk remote access tool
RustDesk is an open-source remote admin tool.
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Kills process with taskkill 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rustdesk-host=gateway.network26.com,key=dv7BFGROJbEQ93eOcRffzyc3BsVu0GzLiuozNqLWmpw=.exe"C:\Users\Admin\AppData\Local\Temp\rustdesk-host=gateway.network26.com,key=dv7BFGROJbEQ93eOcRffzyc3BsVu0GzLiuozNqLWmpw=.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM RuntimeBroker_rustdesk.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service --portable-service-shmem-name=_portable_service_2468_a5629bae3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system --portable-service-shmem-name=_portable_service_2468_a5629bae4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RuntimeBroker_rustdesk.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
app.so
FontManifest.json
icudtl.dat
desktop_drop_plugin.dll
desktop_multi_window_plugin.dll
file_selector_windows_plugin.dll
flutter_custom_cursor_plugin.dll
flutter_gpu_texture_renderer_plugin.dll
flutter_windows.dll
librustdesk.dll
printer_driver_adapter.dll
rustdesk.exe
screen_retriever_plugin.dll
texture_rgba_renderer_plugin.dll
uni_links_desktop_plugin.dll
url_launcher_windows_plugin.dll
window_manager_plugin.dll
window_size_plugin.dll
RustDesk2.toml
memory/2468-162-0x000001E5E9E80000-0x000001E5EAB39000-memory.dmp
memory/2468-176-0x000001E5E9E80000-0x000001E5EAB39000-memory.dmp
memory/2468-161-0x000001E5E9E80000-0x000001E5EAB39000-memory.dmp
memory/2468-177-0x000001E5E9CD0000-0x000001E5E9CD1000-memory.dmp
memory/2468-160-0x000001E5E9C80000-0x000001E5E9C81000-memory.dmp