supershell | c685032015152dd6f91b5ec2036e2da240a190911b87b1f7fdeba1440070c37d

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tacticalagent.exe
Size 5.0MB
Sample261022-pl81baac65
SHA256 c685032015152dd6f91b5ec2036e2da240a190911b87b1f7fdeba1440070c37d
MD5 e131b75f9a08bc4af25eed2bee6ec040
SHA1 f429470ed1c2bb9ea0154fceb06fb5e22407bebd
SHA512 3c76277f219fc647c9ca70a0b5f796901de4090702b678376f3275973a5fb9f97ba5e7c7b6f806e105206143e013fbcbb992b90868407d9b04b59c50c44d5633
SSDEEP 98304:IxHXsCBOHmvSqeKcNSoL1ttaFYhi2/1hg/z7sDf9SQAIbC4qf:wsCBgmaqeKcHHUFYQK1S789Sl48
TLSH
T18236122372CB613FF07A4A3A49B6D236453B6E6065128C669BF45C6FFE260D11D3F242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution supershell installer

Malware Config

Signatures

Family: Supershell
Supershell is a cross-platfrom reverse shell written in Golang.
backdoor supershell

Executes dropped EXE 3 IoCs

pid	Process
5416	tacticalagent.tmp
1112	tacticalrmm.exe
2488	tacticalrmm.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\TacticalAgent\unins000.dat	tacticalagent.tmp
File created	C:\Program Files\TacticalAgent\is-MQ15C.tmp	tacticalagent.tmp
File created	C:\Program Files\TacticalAgent\is-M7R4P.tmp	tacticalagent.tmp
File opened for modification	C:\Program Files\TacticalAgent\unins000.dat	tacticalagent.tmp
File opened for modification	C:\Program Files\TacticalAgent\agent.log	tacticalrmm.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5992	cmd.exe
3968	cmd.exe
248	cmd.exe
4548	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	tacticalrmm.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tacticalagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tacticalagent.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4796	PING.EXE
4548	cmd.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/6116-1-0x00000000000D0000-0x00000000001B2000-memory.dmp	innosetup
behavioral2/memory/6116-16-0x00000000000D0000-0x00000000001B2000-memory.dmp	innosetup
behavioral2/memory/6116-26-0x00000000000D0000-0x00000000001B2000-memory.dmp	innosetup

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4252	taskkill.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4796	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1112	tacticalrmm.exe
2488	tacticalrmm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	taskkill.exe
Token: SeDebugPrivilege	1112	tacticalrmm.exe
Token: SeDebugPrivilege	2488	tacticalrmm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5416	tacticalagent.tmp

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 5416	6116	tacticalagent.exe	89
PID 5416 wrote to memory of 4548	5416	tacticalagent.tmp	90
PID 4548 wrote to memory of 4796	4548	cmd.exe	92
PID 4548 wrote to memory of 4488	4548	cmd.exe	93
PID 4488 wrote to memory of 1680	4488	net.exe	94
PID 5416 wrote to memory of 5992	5416	tacticalagent.tmp	95
PID 5992 wrote to memory of 4252	5992	cmd.exe	97
PID 5416 wrote to memory of 1112	5416	tacticalagent.tmp	99
PID 5416 wrote to memory of 3968	5416	tacticalagent.tmp	101
PID 3968 wrote to memory of 2488	3968	cmd.exe	103
PID 5416 wrote to memory of 248	5416	tacticalagent.tmp	104
PID 248 wrote to memory of 5500	248	cmd.exe	106
PID 5500 wrote to memory of 3120	5500	net.exe	107

C:\Users\Admin\AppData\Local\Temp\tacticalagent.exe
"C:\Users\Admin\AppData\Local\Temp\tacticalagent.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Users\Admin\AppData\Local\Temp\is-3T8JU.tmp\tacticalagent.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3T8JU.tmp\tacticalagent.tmp" /SL5="$400AE,4211567,861184,C:\Users\Admin\AppData\Local\Temp\tacticalagent.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5416
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4796
  - - C:\Windows\SysWOW64\net.exe
      net stop tacticalrmm
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4488
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop tacticalrmm
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1680
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c taskkill /F /IM tacticalrmm.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM tacticalrmm.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4252
- - C:\Program Files\TacticalAgent\tacticalrmm.exe
    "C:\Program Files\TacticalAgent\tacticalrmm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1112
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c tacticalrmm.exe -m installsvc
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Program Files\TacticalAgent\tacticalrmm.exe
      tacticalrmm.exe -m installsvc
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2488
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c net start tacticalrmm
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\Windows\SysWOW64\net.exe
      net start tacticalrmm
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5500
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start tacticalrmm
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tacticalrmm.exe

Path C:\Program Files\TacticalAgent\tacticalrmm.exe
Size 11.7MB
SHA256 920f59baa49244152f72495a6bab0f801621ef8ae44d73654e7af26bb8abe57e
MD5 5ee2755ff79aadaa27c98b77d7ec6069
SHA1 ee81763b014482af2a6ab246e80c8ce61eb13db6
SHA512 013e50596187ee0d1fdddb0b14ddd2e69b68e0add1f59e9cd15710eabda86de7484a86c137b7ece83f229ed6bbf557d38b6909941fc1abeefa6195e0768df499
SSDEEP 98304:iI3j/UYn30X1kTDVvCXjMbvO/E4QZBRABbgFxfvr:1QYEFK1EuOch/Cpofvr
TLSH
T127C64B07F85551E8C5AED174CA659222BA713C890B3067D72BA0F7B83F33BD46A7A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tacticalagent.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-3T8JU.tmp\tacticalagent.tmp
Size 3.4MB
SHA256 4e50d7fcd52abdf13c2159b53b6a4fa7c6483c3eaebf3bf792db129e6fd80e73
MD5 f6b0c1231af7693ae81b0db9f49ae666
SHA1 0a67071ce00758cc28d00ed1c2bd4b9ab8e70e47
SHA512 2a6b41df2def3d29fecffd601edc2dc25094ec1f073d9d4b6d4707139849ace99f0e5653942260f96670d319e8f37cf4ef48f672b840ae2810be29c9df2cb423
SSDEEP 49152:2WwGHAkqMu7ot6SCiGogq5i18ue5TEhkq2nV9oNq3Z52gu3cfcW333dKR:29GdkS5i181E2V9oKdu3W333dy
TLSH
T126F55C23F24D693ED05B3E3D663792B0987B7A602D128C576AEC3E4C5F355802E2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5416-6-0x0000000002F00000-0x0000000002F01000-memory.dmp

Download

memory/5416-18-0x0000000002F00000-0x0000000002F01000-memory.dmp

Download

memory/5416-17-0x00000000004D0000-0x000000000083E000-memory.dmp

Download

memory/5416-25-0x00000000004D0000-0x000000000083E000-memory.dmp

Download

memory/6116-1-0x00000000000D0000-0x00000000001B2000-memory.dmp

Download

memory/6116-16-0x00000000000D0000-0x00000000001B2000-memory.dmp

Download

memory/6116-26-0x00000000000D0000-0x00000000001B2000-memory.dmp

Download