Sauron Loader Registration Beacon Following Keyroll DLL Side-Load

Ibrahim Saud@tektrix

•updated 13 days ago•0•0•0

Detects the execution of rnpkeys.exe from a specific path, followed by the loading of expected DLLs (rnp.dll or tdwp.dll) from the same directory, and a subsequent network connection on port 443. This behavior pattern is consistent with DLL side-loading used to establish a network-based command and control channel.