eaedeb0088e687bf46f7c46a9c6ea5493ce51f3134dfd6acbedb47b5b9136274

Analysis

max time kernel
151s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rustdesk-1.4.9-x86_64.exe
Size 23.3MB
Sample261017-al952stsbx
SHA256 eaedeb0088e687bf46f7c46a9c6ea5493ce51f3134dfd6acbedb47b5b9136274
MD5 3dcd83c485b9fbc53d7d56fb9d4585f0
SHA1 16510df7792f178932e964180d277ce0414d3f03
SHA512 54f5635928b61a09b8897664397965ea21d098c503fd88d4aac62a8bb30f012ce62e4405100322e3dd4533b68e16945b162f9784f873f2a7e8526503f89def68
SSDEEP 393216:tRjHllxmdlrzd1Wn6xOjAZ8WSI4AtJRA82xXphKiCwqFf4vIr5wFndQOqv4CDIV3:LjF+dxzd1Wn6bZfPtJRAVhKiVqFwvwSB
TLSH
T177373360F25515F9E51BC43092425AB2A73ABC754B107CFB11A871263F7AAF01F3B7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor defense_evasion discovery execution rat spyware trojan

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2444	rustdesk.exe

Executes dropped EXE 4 IoCs

pid	Process
2444	rustdesk.exe
1352	rustdesk.exe
3936	rustdesk.exe
4512	rustdesk.exe

Loads dropped DLL 56 IoCs

pid	Process
2444	rustdesk.exe
2444	rustdesk.exe
2444	rustdesk.exe
2444	rustdesk.exe
2444	rustdesk.exe
2444	rustdesk.exe
2444	rustdesk.exe
2444	rustdesk.exe
2444	rustdesk.exe
2444	rustdesk.exe
2444	rustdesk.exe
2444	rustdesk.exe
2444	rustdesk.exe
2444	rustdesk.exe
2444	rustdesk.exe
2444	rustdesk.exe
1352	rustdesk.exe
1352	rustdesk.exe
1352	rustdesk.exe
1352	rustdesk.exe
1352	rustdesk.exe
1352	rustdesk.exe
1352	rustdesk.exe
1352	rustdesk.exe
1352	rustdesk.exe
1352	rustdesk.exe
1352	rustdesk.exe
1352	rustdesk.exe
1352	rustdesk.exe
2444	rustdesk.exe
3936	rustdesk.exe
3936	rustdesk.exe
3936	rustdesk.exe
3936	rustdesk.exe
3936	rustdesk.exe
3936	rustdesk.exe
3936	rustdesk.exe
3936	rustdesk.exe
3936	rustdesk.exe
3936	rustdesk.exe
3936	rustdesk.exe
3936	rustdesk.exe
3936	rustdesk.exe
4512	rustdesk.exe
4512	rustdesk.exe
4512	rustdesk.exe
4512	rustdesk.exe
4512	rustdesk.exe
4512	rustdesk.exe
4512	rustdesk.exe
4512	rustdesk.exe
4512	rustdesk.exe
4512	rustdesk.exe
4512	rustdesk.exe
4512	rustdesk.exe
4512	rustdesk.exe

RustDesk remote access tool
RustDesk is an open-source remote admin tool.
backdoor rat

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\log\portable-service\rustdesk_rCURRENT.log	rustdesk.exe
File opened for modification	C:\Windows\SystemTemp\shared_memory-rs\shmem_43F33D9AAA00BF06	rustdesk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2192	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rustdesk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rustdesk.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
244	taskkill.exe
2316	taskkill.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\CA\Certificates\0185FF9961FF0AA2E431817948C28E83D3F3EC70	rustdesk.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\CA\Certificates\0185FF9961FF0AA2E431817948C28E83D3F3EC70\Blob = 0300000001000000140000000185ff9961ff0aa2e431817948c28e83d3f3ec70140000000100000014000000813292412b28cd46c8c4a2c62a3912ec48a93f146b0000000100000020000000384e9f98355a133565eb03083b79e71a46f00c21352ed7c06990d841228cbe880f0000000100000030000000f55821c081b58e86eaa202923e715e1524c422c7be0469b13a9e7a319e50d70cb5b67e864273029a79250f9dc3203cbd19000000010000001000000079d9deaeb2dbf0e37e8750aa80b4cdfa5c0000000100000004000000000c00001800000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c4b0000000100000044000000310038004500360042003400410035003700410036004200430037004500430039004200380036003100430044004600320044003600440030004400300032005f0000002000000001000000200600003082061c30820404a003020102021033d708a891405319e2a5bbd339b9ad6e300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3336303332313233353935395a3057310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312e302c060355040313255365637469676f205075626c696320436f6465205369676e696e6720434120455620523336308201a2300d06092a864886f70d01010105000382018f003082018a0282018100bbd1fe1eb7425b78f590a7ae2c83f18d21d33086857bdfd3cdd9164bac85c5bb01cfe28c28117204762c81c5ab127a404ac510e88114391b5f4f07f63030307f3525e5c0733d400994e8a8f8eb390b55d5b60c8b1e27f8de3e22c1bfef65ee73ee65dd28ddbb1f7d9b327fb7995517aab249a83c106a3ac321b299a843d73b82a81961b53e6a5a5db8bc9e13d00a9ef55b8f693868eaa51f5bca23ee0bedbcd01e43436eb0538cc2732a44316ebe8fb8c602f6bb820415790c5220e898277161ef2fe4f802fb3359b5f4c355e7dff60822aeb6d10959ec019f7389b7434fd5f2d9bd565909ddb717f6c47480ba8746ac06dbdb040dd54ebaee8c093419951be670130425df8fb8d784338c6ca60ceb68ba954f7c44e8d4698d2579c321f13577f84fb6125595d056e81802d5ee79c886a169f11b4e94136a0762f0d06b99a597509e1c33a11eee618b05681c8ef5ee269083d6fe7185a79af20d143e36b512ad77757acce746366a9053cbc69471de073a21f9d63267e09c6e5486a064a083cb0203010001a38201633082015f301f0603551d2304183016801432eb929aff3596482f284042702036915c1785e6301d0603551d0e04160414813292412b28cd46c8c4a2c62a3912ec48a93f14300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff02010030130603551d25040c300a06082b06010505070303301a0603551d200413301130060604551d20003007060567810c0103304b0603551d1f044430423040a03ea03c863a687474703a2f2f63726c2e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67526f6f745234362e63726c307b06082b06010505070101046f306d304606082b06010505073002863a687474703a2f2f6372742e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67526f6f745234362e703763302306082b060105050730018617687474703a2f2f6f6373702e7365637469676f2e636f6d300d06092a864886f70d01010c050003820201005f36acfbf9f6725a14b7f00b1dded8fd9701d2fd01ee992d86e8f6b7f039ffd6814a5aa7424a0a2d159de694fdc5694ab2d74bf116124cf6be9066658b2d74d4ab08f76a110308777cbe69e1b0db9f248903d6de5ca4e0b2d6b4cfe338d5b96dcc27d6ce6411e8107276d3f9e0e92c89e949d3b39796060ae1f60ac8419a915d81d8367798ca804197a8f8913f639faacd54544b80eaf51766d39471fd9efd4731e3e91a861dd3be20d23fb1525fb293bd8c950998728f9501f49843a54afb1426aa9d36bf72b0fcdcbd840deced34a85e952b3816630575d9f6312e156be294b22ad27435b5989aa3fef82b2fb6174b276c5ae6b9765eda86ddab64d66aea8318881b3182f588b39425c0212f086902e34cbb4c2a1130eb817906e141952ad420f60b93e47c760c9d1d266b5f8401f62a99cdafdec7f0e418a24e9b2f2a0c66a6927526bed94035136faea6371a7ae8ad1c5163072a56066ced7e18f6e3ec6473a66d08368baf0f99ae756b172bc24d6ac351464156e98fc28dff13719bdaed9ed39fabe545a612c5145a524197a3060008c5e61cea27823c3bdbe646c4ef2d003513cd367d9de5aa270805cccec0360e4b194fd0639a6dbfc529533122db75507786d0f2f86aee6b061b3e85232b97c87e7a99410cdd587f0ea8c3123d3a359be09d2c8c17815444a87a1d989d967f5958a65465ff51420bf847ebcff8e5bf	rustdesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	rustdesk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 6b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd20f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	rustdesk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254836b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd22000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	rustdesk.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2444	rustdesk.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1352	rustdesk.exe
1352	rustdesk.exe
2444	rustdesk.exe
2444	rustdesk.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	244	taskkill.exe
Token: SeDebugPrivilege	1352	rustdesk.exe
Token: SeDebugPrivilege	2316	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	rustdesk.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2444	rustdesk.exe
2444	rustdesk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 244	4568	rustdesk-1.4.9-x86_64.exe	89
PID 4568 wrote to memory of 2444	4568	rustdesk-1.4.9-x86_64.exe	92
PID 2444 wrote to memory of 1352	2444	rustdesk.exe	93
PID 2444 wrote to memory of 2192	2444	rustdesk.exe	94
PID 2444 wrote to memory of 3936	2444	rustdesk.exe	97
PID 2192 wrote to memory of 2316	2192	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\rustdesk-1.4.9-x86_64.exe
"C:\Users\Admin\AppData\Local\Temp\rustdesk-1.4.9-x86_64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM RuntimeBroker_rustdesk.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:244
- C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
  "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
    "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service --portable-service-shmem-name=_portable_service_2444_1caad64e
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1352
  - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
      "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system --portable-service-shmem-name=_portable_service_2444_1caad64e
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      PID:4512
- - C:\Windows\system32\cmd.exe
    "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM RuntimeBroker_rustdesk.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2316
- - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
    "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.so

Path C:\Users\Admin\AppData\Local\rustdesk\data\app.so
Size 12.7MB
SHA256 a84705c3be6be7a580319a59cd7c57c9a96b0750884f6464200bfcc71ac11fda
MD5 a49df9135a8318f106a7fdf8a0fbdb6f
SHA1 75ae0cde1b77167087fb726dc448c1ab82332206
SHA512 6b36840f0149ed281a56cc43bb2c00fda7cb00c483132a3c489b3ce9d2daf89a84e70ce0ce4520b7049f8715a8a61277e0415f3564102d863dccca5cb44b9592
SSDEEP 393216:24P9xyn4VkiVydmJbmHUofbTxbHyMMMNa6e2Kh4xBpoa:ppVZZmTjTxjyANbe2Kupoa
TLSH
T16DD63B5FD0B943A0C025B6B5F79EAFB95E1878D85E70A18656DC0B623E97C600BCF072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssetManifest.bin

Path C:\Users\Admin\AppData\Local\rustdesk\data\flutter_assets\AssetManifest.bin
Size 4KB
SHA256 5ff1849d2dfcedb6c994c116105f3b816559e3ce71bee1ec9aca3c265e2d4651
MD5 917644686808dc844d51a83e4d00a519
SHA1 84126e9459aed8e2a413262610f68699bd83ebd8
SHA512 bf8b025af83cdff803af3f13549e503c2f7b52b9cb07d19b941b305fdb2af5ba763401fad631858d96a26a6358ce381f7b2a88898f464d100529d98e1d368693
SSDEEP 96:12fMzo5d9I/SVqMk24bfiKhwzNZnvjEkviyeyXU2:y9VqMk24bfiKhwzNZbEkviyeyXU2
TLSH
T1EF918A2842B11ACD6875B4B26CD255CA181A4F855D98F2FF233AC9287185C7B48FFCB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FontManifest.json

Path C:\Users\Admin\AppData\Local\rustdesk\data\flutter_assets\FontManifest.json
Size 483B
SHA256 068f1cc96816fab157a6813ce233731e46bf661ad84d0018381fb58b19396886
MD5 f4f31d18ca443c7bfb50340e84b860d5
SHA1 f97538077e02122cf0377211bba8a4ab0bbbe4f3
SHA512 3da40b86ad28f41e29b44112601a910e4d2def19a0da8de3c272fb59227b025f7d25e713a3f89d22069f5799bf68fa4ac5647e85a71344925d664a61ac3e6ffe
TLSH
T1DDF0540F052519F890DDC595B0E3649370542B47528DE81EE7751FA4ABF0B0027286F3
MD5 SHA1 SHA512 TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\rustdesk\data\icudtl.dat
Size 760KB
SHA256 c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c
MD5 692337664e861ad322138061132dddc6
SHA1 8a99bc860eda0772f3b1f4a125fa4d474410e21c
SHA512 3e2e6adb651e37e530734f999634d7c101fa1c45ae380be8ad169bbfb0a047f2878ff6c8d1428d6b9e7301b447ab2f8839484322ddb3831984be71d442829a55
SSDEEP 12288:HMlhw771h0jM7ykPG07+r4c8w0P4N48RkjtYdPHz982VT50q:ahw3zVtjsbGu4RjgPHzfCq
TLSH
T18CF47C03B1D79C9FE0D48636C9A1E37A9A33978C5B7311D67E6D45887F4A0D70282BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_drop_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\desktop_drop_plugin.dll
Size 330KB
SHA256 8390d51178a8a8b9b2ec978579f9196b6d5608a875a1ab95f215330381e88620
MD5 9a375f8ca9ed509ca001bedfa7f9e1d2
SHA1 cafa3f13a7eef1e12d763a5563c017475ed27186
SHA512 fe0c25d83c0c03469c125bd38c78b5931dbb16926ce586b311e92a9434c21cb522348070568717eff55a539d63a13ef7c5df56b13d4c8819e609fddb86c64290
SSDEEP 6144:JRd/9uC6PoqJivCriaariRxiKPl0Ryn7SGIU:JRaC6xi6DaGTiKPloy7SGIU
TLSH
T15B745B19B7A554BAE167C53CC9A34945EBF2BC560BA0DACB1390075A3F33BE0493E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_multi_window_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\desktop_multi_window_plugin.dll
Size 394KB
SHA256 03335bb8c4c341fdaf4824a24ca8a7af3054c3afe159fadf7400cb72520fa6c0
MD5 a9aec194a16cdffa3a39962cc3d548c9
SHA1 c6cf9bf8d9c38b9fc13feb8332de458b0119095c
SHA512 16a07181cac7e4e7ccecaa462a017cca92cf5a4305ff92ce2a54633293fbf0d04cd7a07273bb33c086021b3671510d4cf09bb85f727c3cf50f7e921e9789e5b4
SSDEEP 6144:xEHBL7tynClpbXh3mkPBBN2IGdkemLEgxEPwltvXT0unMIK:G1iCl7FvN2DdCxEPwltvXouMIK
TLSH
T1B1846C2AFB6504B5E167C138C9B74646DA727C894B609BCF2394075A6F33FE04A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_selector_windows_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\file_selector_windows_plugin.dll
Size 357KB
SHA256 585e7452e5ceedd5865215166ccad52df440f6561e8c6b961b1e32acb345462d
MD5 8fcf3e2fb05204632874777148eb54b3
SHA1 56ce73aa7d201e29db175f4fa6bb83814c6c9876
SHA512 71e8c77615a30cdb6bf73f59c4f2bde2abfbeeedff0f12ce8f1ce49d1a539588b41b44d2478dae83328eb2ff0a9113f45a49abb21401139534e7e4e776e9fdbb
SSDEEP 6144:HRDPe8/ArrCObbV7jMiW0zBOHpxI9z63dx7x/sTE7BI5c:xCrrCQVjW0UpChE7x/smBIi
TLSH
T1A9746D1AFBA854B5E167C178CDA78945EBB27C460B6096CF23A0075A2F33FE0593E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_custom_cursor_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\flutter_custom_cursor_plugin.dll
Size 320KB
SHA256 fff1deb1700232f53dc8e035df565a5bfb3b8f77d055303499fa120d387effd5
MD5 9c5cf51b659b0f42946f6c6627b41ddb
SHA1 5162d1ba09ff6062839e4262e8791c4ed66c86e8
SHA512 8c51aea6762e0815cc877e9c4638732a443dcc3a7a5b1219a44dbad177630766af6169c93883f1a489058ab0ed4de93a7c068d4b8c826613b5427b7baf592baf
SSDEEP 6144:iwYCGjdkOMK38qsYp+G9pF9Z7qaEWgaX7MIP:pYCGjnl3G03pfZ7qaEWgnIP
TLSH
T1D7646C19F7A454BAE167813CCD974945EBF278420BA4E6CB1390069A3F37BE14A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_gpu_texture_renderer_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\flutter_gpu_texture_renderer_plugin.dll
Size 352KB
SHA256 bc6b81e8dd2c26c55f354b8c194729314a5a3c5e89b00657d0f173fc40282641
MD5 98ddf6ff589c6365a704b16257821b46
SHA1 dc55da88203b237f50513106006610bb3a4f6c55
SHA512 9ed6805a1810c32dfbe7527e2dbf53f2645af2d7bb46b1f9f9c217d4129cec02f7cb940ed947624912e9792aa31b298f428f0c31a141dc0c217a47afb6eaeec1
SSDEEP 6144:ZIqQRCxIDdJ9kzqMeOtvQVSUiOASg7Tio+irIy:lQRCxyJ+zUOWVSUiOG7TiodIy
TLSH
T132747D1AFBA454B9E167C138C9674946E7B27C460B609BCF13A40B5A2F37FE0893E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Users\Admin\AppData\Local\rustdesk\flutter_windows.dll
Size 17.2MB
SHA256 a5f97552c3b65ea2f3b661730cd1028518dac8f3c876e523bde6388460e004d0
MD5 742d50e9e119d8e169c0be2e0017efd1
SHA1 8500a21613f516864f3b953bd131287a10210aa0
SHA512 a97ed55e9e3d9be9e841200fd265248de9f5d189b34ce7148f04d06d3dbc4b37310b99b24a9cf9d59fdf805d2c4887fdebd3a9119b324e594b6e3ee7d3e99be2
SSDEEP 98304:dr9tjMEbhsb464T36lgzqbka78FKAWS3rpUJkUNZ3phDJ8cpSq6nYriNtZ356rXf:jffggz7Q35r36YriN707e4
TLSH
T15F078C03E59640FDC48DD2B89B5B9A27F671B8490621B5DF238827263F67BB01B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

librustdesk.dll

Path C:\Users\Admin\AppData\Local\rustdesk\librustdesk.dll
Size 34.5MB
SHA256 e301faa89ff987bfde010ef286e9b90a9a251a77f1d843d71c370b58f3970f02
MD5 6701fbf8f57916c4c296fe1b0d20d659
SHA1 82a0f2fa6e2305aaa6aeedd8c5b0384c8d704d72
SHA512 decaf74e2966483e1d74e83902fbbcdc1287e0f8a9fdcea23700e58b48c8a2494c420d6ec7cc4b73bbce2970adaf7dbc889f17edf1d36155df578fec3dc7459b
SSDEEP 393216:NxQ6Scx7TkL7o2JEtKapfgOtUnoALOq+duy+QPFyED5CAHG4GPomYaowrHd2ZWzG:NG6DUAgyduuXPZ5
TLSH
T157877C46F36651A8C02AE474826B6E22FAB17C4D43316BEB17D44A213E63BD05B3F7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

printer_driver_adapter.dll

Path C:\Users\Admin\AppData\Local\rustdesk\printer_driver_adapter.dll
Size 1.3MB
SHA256 3b26e3e8fe82bca48241c16bb7b64c02a2b0d8b691bd1355cc5baa95cacd0162
MD5 4e6366996620135ffff0d54a42c6d7a2
SHA1 3429561bca2345f087dd413bb9768af9a2f3de06
SHA512 1d0a1701f9803c0cbca7bbc33c5be9adce7f9cf79c3f186f02a99d41c255ef17b9788b5677a1becb28eeb4bd25de5188233529c6fb4c3f111d8563d5bafa88f9
SSDEEP 24576:TUzwii98X0HkTYjW1JXp2gX9N8WdAov2Efq/FBIA:YzwLHOa4Xp2vWdfqdd
TLSH
T123557C62FA95897DC06BC07482574BB6AA7174CA0B30A9FF419896383E25FF51F3C394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rustdesk.exe

Path C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
Size 358KB
SHA256 3ccd9d5e1f14d1013d12e79c8426a07cc057510fe6d6676309771f03db2bfbdd
MD5 67c6517649180470bd162656542a7c9c
SHA1 9fdf732da96a4a18888692ee2bb8756a78ece2ca
SHA512 be35db473044fdabac92e80ab8365d9768704a9498c95897f2700973a294059b77a85c6bd9248371c9a90a56a4cd334b813d03ec9f32a1f52d6b92cb235c2382
SSDEEP 6144:UebSY1I7C/UpanQo06Up3Qou01bvcFm0EjW0VqS2F4I/p:CC/DL0r3QCbUm0EjW0VqS+4Ih
TLSH
T1B3747E19FBA414F9E1678538CD664945EA727C4A0BB1D7CF23940B9A2F33AE04D3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\screen_retriever_plugin.dll
Size 524KB
SHA256 1a697ecc0c7103985eafb47bb540d65dcde62722c8ef3de0b079843c15406c3b
MD5 7754c4a0dbbbf55384ec5518810ca5a5
SHA1 86b5e4b7bb6981fbe961844927ba9ec0cd44e992
SHA512 55f967348a86f5c09990e4a6e5ade7768ba66130894201f9083a8ee460621e2e6b0ae0ff89331f8c84b3e49950a9d5d54377611e815089b421b653c3fd7de628
SSDEEP 6144:QvM4CN74yApJ245VAhLQzzBzXjEUmo1wOerpzQSUJ+LDf82Aroz7wzfhPbVIL:QpCNkTAizXjjT3+LDfaoz7wzfpbVIL
TLSH
T1E9B46C2AE7A843B5E167D138C9534606F7B1B84A576196CF43E00AAE2F677F04A3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

texture_rgba_renderer_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\texture_rgba_renderer_plugin.dll
Size 329KB
SHA256 86422ea280c8e7832580e09c9b621ea47728c9c69e12482f2227661f19831ef4
MD5 77d5cb0ae6c909785f5e09e0e0eecee8
SHA1 a6a34bc6954c7ccc8c9412f183d37e9ff97e5a49
SHA512 99fbdd2c73cfcf240249159556b1356e05774b21ae15c15628ca8201b952c62ce720b6c0a8f6b77728ba4740457ef15e698c950c2ed4dc0af3747d354cfe303a
SSDEEP 6144:8K6gpCyvo6xlody6G1iYpCyb7Vuhu4nqaIIW:8YCyghybroyb7VuhhIIW
TLSH
T155745B1AF7A514B5E167853CC9A34A46EBF27C460BA1DACF13A0065A3F33BE0593E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uni_links_desktop_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\uni_links_desktop_plugin.dll
Size 527KB
SHA256 e3d82b056d29a083106319d620015afc2ffe1750d0ec31e5b3562806b978da56
MD5 01069a3aeff67ff7f82bcfaefc326750
SHA1 4a86c97e62085ac509bb01b404227d7267ad3eb4
SHA512 cb4c9ca2a5690f80b1d4cf443d96e4a7b1f7e4b89f3f897dfeb29078ededc4aa7a6dd402b4b01cfb4963df5c9616ae9ee850fcdfa699e49248f7b305735ca5d9
SSDEEP 6144:QT8UknWtCV/HZFfulbfzHlvnCN3WZlAgNSAWUSXYFs+F1EkMdNVQ7qaEXhYLhcFa:QT8NMCV8lvnljhF1EkMdfQ7qaEXhjFIx
TLSH
T116B47D29F7AC43B5E167D178C9534906E7B1B84A5761A7CF43E006AA2F277E04A3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_launcher_windows_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\url_launcher_windows_plugin.dll
Size 333KB
SHA256 e5753d4fdc8c07c2012c2abd201a1c509aaaa64a4d0908745bcd4ac990a4763b
MD5 47e9fa036c379c610aaf6debe63c9a22
SHA1 a2a7322cf2adde904afcb960b880ed2a49aa1081
SHA512 bbc96487c9244cb184cf3eaca521e5dcdc60db498a04e2bc0e5ae556f503f4ba024da21cd289b5cf4d71fa4903acc2db171824232bbd1740e467d8999c4c27af
SSDEEP 6144:T7uWnIdCDOlYgxWprJc0XuM5J7VAbzhIe:mWnIdChgUpO0+M5J7VAb9Ie
TLSH
T1BB746B1AF7A554B9E167C13CC9634945EBB2BC524BA0D6CF1390065A3F37BE08A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\window_manager_plugin.dll
Size 553KB
SHA256 7a4a074cd90de3f65ee6a9fa9db7fc21417dfa1959c154f5aa0d4cdd0259e728
MD5 f2f0085dce96c2042048468169ebdc3d
SHA1 4b2c444735c4d9f05721ba05d1e6a2b714e41cb3
SHA512 0f2a11c8e48a3e1f81215e0302f11ff8bea3ce7a5e907cb7d280d1458fa66bc5f09d7416dcbb508aac8fb18fd46a36f71874aacb1dfaca4b8cbf2c56b5957680
SSDEEP 6144:zhljoCpiGgCP3CB0+rx9GhawM/3zuc37gvOJwzZ/4t1GdjS2QMEUcOzdCR7l+0Pf:FgCPyBdz1Z8jpQTc0PqaEOLT9IwJ
TLSH
T13FC48D1AB6A843B5E167D138C9874606EBB1B8465761A7CF03E056AF2F277F04A3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_size_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\window_size_plugin.dll
Size 522KB
SHA256 084613f3450272ffa4d9932f234fcfad690fee8385655fdb8c41b1956cd23bc5
MD5 dee76b243848ca7eb1e08951a5eb53a5
SHA1 73f8871635c7f108f44e72cbdcc12988b3aa3b0e
SHA512 ae8e3938a8a559da45750950b277478997d4e8ed88b1cd75ae7139a2a0586d25495fa401b4cd83793a5f801d9b1bd51c1ce3842fe09c2223a77063bdfc22f80c
SSDEEP 6144:/thj2BCUMPI7HV0nUBD5P9noC+yCIz3JjjoI1ZiQfKxY8CAj8PqaqAPG3XeeMI7:/CCUPNnoIF13KxY8Z8PqaqAPtI7
TLSH
T16BB46D29E7AC43B6F167D178C9574502EBB1784A176197CF03E046BA2F277E04A3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RustDesk.toml

Path C:\Users\Admin\AppData\Roaming\RustDesk\config\RustDesk.toml
Size 209B
SHA256 22c10e85de994ffa3d14b208646776976d9809b95c97f48bdbe471e0ffc9a6a4
MD5 adec64feae7c9716781722b87dd8fe70
SHA1 76e953ab0799492b7f0445b53549bcc36b0916fe
SHA512 57c932d20bf5ef348d52acd9df42db5bdb3d1613b8d40ce3a14f8da1c9c947538c01b985c9b42009ba8ff63e641b4a369376f80a4499b0c7ab2fd38d43d2c500
TLSH
T1D0D0220B1CBEAD8A08A05632C25BD20A8692123B269A0A186A0A44DCBDD683C1AB440F
MD5 SHA1 SHA512 TLSH

Submit Download

RustDesk2.toml

Path C:\Users\Admin\AppData\Roaming\RustDesk\config\RustDesk2.toml
Size 125B
SHA256 889997ab04d6bd96f2efae27e602aeb9452b00a0396656b1b062ce401aee4324
MD5 11951cdc84ec9d7a4e4b836cf56d9cd6
SHA1 b23f545aa1bbb23d03adc6d75d66b0a9a05a9e8d
SHA512 6207fd1d0edea2ed648f4a857ba5f0568bd66ce33e58231e7c9f33a9efae72caa7630200d2c68ad97180d4765496784e5097ba3f72b7df300da4835668c97ede
TLSH
T13AB02B40C6B3328011C500C00C3B1015CC2C8332194A05D03383C30060CC509CF18D17
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2444-160-0x000001CCEBA60000-0x000001CCEC719000-memory.dmp

Download

memory/2444-162-0x000001CCEB560000-0x000001CCEB561000-memory.dmp

Download

memory/2444-158-0x000001CCEB550000-0x000001CCEB551000-memory.dmp

Download

memory/2444-159-0x000001CCEBA60000-0x000001CCEC719000-memory.dmp

Download

memory/2444-161-0x000001CCEBA60000-0x000001CCEC719000-memory.dmp

Download