RMM
Splashtop
Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.
Tool overview
- Category
- RMM
- Research authors
- Nasreddine Bencherchali
- Created
- 2024-08-02
- Last modified
- 2024-08-02
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
- Not recorded
Executables & installation paths
- Filename
- Not recorded
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
C:\Program Files (x86)\Splashtop\*
*\Splashtop\Splashtop Remote\Client for RMM\*
strwinclt.exe
Code signing
- signer name
- Splashtop Inc.
- certificate thumbprint
- D458B32F6946DBB682A9687076EB9209979BDF76
- src file sha256
- 31333b18ca5cf8f09bc6a8464b34b17f415afee14b6eed877f48ebb7a7191d57
- src file path
- downloaded_files/splashtop/31333b18ca5cf8f09bc6a8464b34b17f415afee14b6eed877f48ebb7a7191d57
- src file company
- Splashtop Inc.
FORENSIC EVIDENCE
Disk artifacts
- File
- C:\windows\System32\winevt\Logs\Splashtop-Splashtop Streamer-Status%4Operational.evtx
- Description
- N/A
- OS
- Windows
- File
- C:\windows\System32\winevt\Logs\Splashtop-Splashtop Streamer-Remote Session%4Operational.evtx
- Description
- N/A
- OS
- Windows
- File
- %PROGRAMDATA%\Splashtop\Temp\log\FTCLog.txt
- Description
- N/A
- OS
- Windows
- File
- C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\log\agent_log.txt
- Description
- N/A
- OS
- Windows
- File
- C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\log\SPLog.txt
- Description
- N/A
- OS
- Windows
- File
- C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\log\svcinfo.txt
- Description
- N/A
- OS
- Windows
- File
- C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\log\sysinfo.txt
- Description
- N/A
- OS
- Windows
- File
- C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
- Description
- Splashtop Remote Service
- OS
- Windows
- File
- C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
- Description
- SplashTop Remote Agent
- OS
- Windows
- File
- C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUAgent.exe
- Description
- Splashtop Updater
- OS
- Windows
- File
- C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
- Description
- N/A
- OS
- Windows
- File
- C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
- Description
- N/A
- OS
- Windows
- File
- C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
- Description
- N/A
- OS
- Windows
FORENSIC EVIDENCE
Event log artifacts
- EventID
- 7045
- ProviderName
- Service Control Manager
- LogFile
- System.evtx
- ServiceName
- Splashtop Software Updater Service
- ImagePath
- "C:\\Program Files (x86)\\Splashtop\\Splashtop Software Updater\\SSUService.exe"
- Description
- Service installation event as result of Splashtop Software Updater Service installation.
- EventID
- 7045
- ProviderName
- Service Control Manager
- LogFile
- System.evtx
- ServiceName
- Splashtop® Remote Service
- ImagePath
- "C:\\Program Files (x86)\\Splashtop\\Splashtop Remote\\Server\\SRService.exe"
- Description
- Service installation event as result of Splashtop Remote Service installation.
- EventID
- 7045
- ProviderName
- Service Control Manager
- LogFile
- System.evtx
- ServiceName
- SplashtopRemoteService
- ImagePath
- "C:\\Program Files (x86)\\Splashtop\\Splashtop Remote\\Server\\SRService.exe"
- Description
- Service installation event as result of Splashtop Remote Service installation.
FORENSIC EVIDENCE
Registry artifacts
- Path
- KLM\SOFTWARE\WOW6432Node\Splashtop Inc.\*
- Description
- Splashtop Inc. registry key
- Path
- HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Splashtop Software Updater
- Description
- Splashtop Software Updater uninstall key
- Path
- HKLM\SYSTEM\CurrentControlSet\Services\SplashtopRemoteService
- Description
- Splashtop Remote Service registry key
- Path
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Splashtop-Splashtop Streamer-Remote Session/Operational
- Description
- Splashtop Streamer Remote Session event log channel
- Path
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Splashtop-Splashtop Streamer-Status/Operational
- Description
- Splashtop Streamer Status event log channel
- Path
- HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Splashtop Software Updater\InstallRefCount
- Description
- Splashtop Software Updater install reference count
- Path
- HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SplashtopRemoteService
- Description
- Splashtop Remote Service safe boot configuration
- Path
- HKU\.DEFAULT\Software\Splashtop Inc.\*
- Description
- Default user Splashtop Inc. registry key
- Path
- HKU\SID\Software\Splashtop Inc.\*
- Description
- User-specific Splashtop Inc. registry key
- Path
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\Splashtop PDF Remote Printer
- Description
- Splashtop PDF Remote Printer configuration
- Path
- HKLM\SOFTWARE\WOW6432Node\Splashtop Inc.\Splashtop Remote Server\ClientInfo\*
- Description
- Splashtop Remote Server client information
FORENSIC EVIDENCE
Network artifacts
- Description
- N/A
- Domains
- *.splashtop.com
- Ports
- Not recorded
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/splashtop_registry_sigma.yml
- Description
- Detects potential registry activity of Splashtop RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/splashtop_network_sigma.yml
- Description
- Detects potential network activity of Splashtop RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/splashtop_files_sigma.yml
- Description
- Detects potential files activity of Splashtop RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/splashtop_processes_sigma.yml
- Description
- Detects potential processes activity of Splashtop RMM tool
References
Acknowledgements
- Person
- Théo Letailleur
- Handle
- in/theosyn