Overview
overview
6Static
static
3RClient-4....er.exe
windows10-2004-x64
1RClient-4....er.exe
windows11-ltsc_2024-x64
1RClient-4....et.exe
windows10-2004-x64
6RClient-4....et.exe
windows11-ltsc_2024-x64
6RClient-4....L2.dll
windows10-2004-x64
1RClient-4....L2.dll
windows11-ltsc_2024-x64
1RClient-4....61.dll
windows10-2004-x64
1RClient-4....61.dll
windows11-ltsc_2024-x64
1RClient-4....61.dll
windows10-2004-x64
1RClient-4....61.dll
windows11-ltsc_2024-x64
1RClient-4....59.dll
windows10-2004-x64
1RClient-4....59.dll
windows11-ltsc_2024-x64
1RClient-4....ry.bat
windows10-2004-x64
3RClient-4....ry.bat
windows11-ltsc_2024-x64
3RClient-4....con.js
windows10-2004-x64
3RClient-4....con.js
windows11-ltsc_2024-x64
3RClient-4....st.vbs
windows10-2004-x64
5RClient-4....st.vbs
windows11-ltsc_2024-x64
5RClient-4....dk.dll
windows10-2004-x64
1RClient-4....dk.dll
windows11-ltsc_2024-x64
1RClient-4....rl.dll
windows10-2004-x64
1RClient-4....rl.dll
windows11-ltsc_2024-x64
1RClient-4....pe.dll
windows10-2004-x64
1RClient-4....pe.dll
windows11-ltsc_2024-x64
1RClient-4....gg.dll
windows10-2004-x64
1RClient-4....gg.dll
windows11-ltsc_2024-x64
1RClient-4....us.dll
windows10-2004-x64
1RClient-4....us.dll
windows11-ltsc_2024-x64
1RClient-4....le.dll
windows10-2004-x64
1RClient-4....le.dll
windows11-ltsc_2024-x64
1RClient-4....16.dll
windows10-2004-x64
1RClient-4....16.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 18:07
Static task
static1
Behavioral task
behavioral1
Sample
RClient-4.0.1-win64/DDNet-Server.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
RClient-4.0.1-win64/DDNet-Server.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
RClient-4.0.1-win64/DDNet.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
RClient-4.0.1-win64/DDNet.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
RClient-4.0.1-win64/SDL2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
RClient-4.0.1-win64/SDL2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
RClient-4.0.1-win64/avcodec-61.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
RClient-4.0.1-win64/avcodec-61.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
RClient-4.0.1-win64/avformat-61.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
RClient-4.0.1-win64/avformat-61.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
RClient-4.0.1-win64/avutil-59.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
RClient-4.0.1-win64/avutil-59.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
RClient-4.0.1-win64/config_directory.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
RClient-4.0.1-win64/config_directory.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
RClient-4.0.1-win64/data/tclient/builtinscripts/sayemoticon.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
RClient-4.0.1-win64/data/tclient/builtinscripts/sayemoticon.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
RClient-4.0.1-win64/data/wordlist.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
RClient-4.0.1-win64/data/wordlist.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
RClient-4.0.1-win64/discord_game_sdk.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
RClient-4.0.1-win64/discord_game_sdk.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
RClient-4.0.1-win64/libcurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
RClient-4.0.1-win64/libcurl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
RClient-4.0.1-win64/libfreetype.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
RClient-4.0.1-win64/libfreetype.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
RClient-4.0.1-win64/libogg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
RClient-4.0.1-win64/libogg.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
RClient-4.0.1-win64/libopus.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
RClient-4.0.1-win64/libopus.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
RClient-4.0.1-win64/libopusfile.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
RClient-4.0.1-win64/libopusfile.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
RClient-4.0.1-win64/libpng16-16.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
RClient-4.0.1-win64/libpng16-16.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target RClient-4.0.1-win64/DDNet.exe
- Size 6.6MB
- Sample260910-wqfynaea83
- SHA256 369cb5d38f6ed3bae4d7fefa6bf698b1242b0988f14c55770364bacfdfbd6a3c
- MD5 5daaef07ce3bbd68d135866752711cfb
- SHA1 2f111bf286d4d7998f5a05f1575d9e7ab4a0d3a3
- SHA512 53256dcf0df8c9a2bbd0c702d431013b3ae33875fd70b536508edf067b05c655f585fd42ca0eccdea1604f7ab0134cce625e69b9e5d9239ed9835b5b503d6ba8
- SSDEEP 98304:sTpu0KlPSBqXQu7lXLp7cIN4XOp1pjjMTDpgeIoDbq:GublPSBqXQu7lXLp7cINLp1RMOeI8b
- TLSH T133669E2273A500EDD07BD0B8CB97A917EBB274550331ABDB06D0461A1F7BAE06E7F611
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 7 raw.githubusercontent.com 29 raw.githubusercontent.com - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DDNet.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags DDNet.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DDNet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DDNet.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags DDNet.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters DDNet.exe - Modifies registry class 31 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ddnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RClient-4.0.1-win64/DDNet.exe\" \"%1\"" DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ddnet\shell\open\command DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ddnet\shell DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.map DDNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\.map\ = "DDNet.map" DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.demo DDNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.demo\ = "DDNet Demo File" DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ddnet\shell\open DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.map\shell\open\command DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\.map DDNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.demo\FriendlyTypeName = "DDNet Demo File" DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.demo\shell\open DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.map\shell\open DDNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.map\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RClient-4.0.1-win64/DDNet.exe\" \"%1\"" DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.demo\shell DDNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ddnet\ = "URL:ddnet Protocol" DDNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ddnet\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RClient-4.0.1-win64/DDNet.exe\",0" DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.map\DefaultIcon DDNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.map\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RClient-4.0.1-win64/DDNet.exe\",0" DDNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.demo\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RClient-4.0.1-win64/DDNet.exe\",0" DDNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\.demo\ = "DDNet.demo" DDNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.map\FriendlyTypeName = "DDNet Map File" DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.map\shell DDNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.map\ = "DDNet Map File" DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.demo\DefaultIcon DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.demo\shell\open\command DDNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\DDNet.demo\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RClient-4.0.1-win64/DDNet.exe\" \"%1\"" DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ddnet DDNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ddnet\URL Protocol DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\ddnet\DefaultIcon DDNet.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\.demo DDNet.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 6400 DDNet.exe