LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Rasautou.exe

View source

Windows Remote Access Dialer

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Loads the target .DLL specified in -d and executes the export specified in -p. Options removed in Windows 10.

COMMAND
rasautou -d {PATH:.dll} -p export_name -a a -e e
USE CASE
Execute DLL code
PRIVILEGES
User, Administrator in Windows 8
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1
Execute · DLL
02 / ON DISK

Known paths

C:\Windows\System32\rasautou.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    rasautou.exe command line containing -d and -p

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

FireEye@FireEye