rurat | e780d9132b814b9ee7514918da9badd98afc454a01bb5233e13e0db8f192e888

Resubmissions

09/08/2021, 11:21

210809-2c9n85h9fn10

09/08/2021, 07:05

210809-hl3vm1w22n10

Analysis

max time kernel
146s
max time network
151s
platform
windows7_x64
resource
win7v20210410
submitted
09/08/2021, 07:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
до судового запиту.docx.exe
Size 20.6MB
Sample210809-hl3vm1w22n
SHA256 e780d9132b814b9ee7514918da9badd98afc454a01bb5233e13e0db8f192e888
MD5 d7084b169082cd511badf160d4f74c33
SHA1 6ab02d048b706167808e98bbda4a86367ab26f6f
SHA512 c562710f56b0b4a6900edc1f14c7b3e7541976e5c31af81a70b41e237ecd6bfd7f7d78054e49481073fb2f39a316bd3f7257a13291351861992cb05ce395f03f
MD5 SHA1 SHA512

Score

10^/10

rurat backdoor discovery trojan upx

Malware Config

Signatures

RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
trojan backdoor rurat

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	916	msiexec.exe
6	916	msiexec.exe

Executes dropped EXE 10 IoCs

pid	Process
1424	2.exe
1872	rfusclient.exe
1968	rutserv.exe
1832	rutserv.exe
1824	rutserv.exe
1208	rutserv.exe
1216	rfusclient.exe
1364	rfusclient.exe
1836	rfusclient.exe
1756	rutserv.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00040000000130f1-62.dat	upx
behavioral1/files/0x00040000000130f1-64.dat	upx
behavioral1/files/0x00040000000130f1-65.dat	upx
behavioral1/files/0x00040000000130f1-63.dat	upx
behavioral1/files/0x00040000000130f1-68.dat	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation	rfusclient.exe

Loads dropped DLL 15 IoCs

pid	Process
1888	до судового запиту.docx.exe
1888	до судового запиту.docx.exe
1888	до судового запиту.docx.exe
1888	до судового запиту.docx.exe
1300	MsiExec.exe
1968	rutserv.exe
1968	rutserv.exe
1832	rutserv.exe
1832	rutserv.exe
1824	rutserv.exe
1824	rutserv.exe
1208	rutserv.exe
1208	rutserv.exe
1756	rutserv.exe
1756	rutserv.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\German.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Czech.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Danish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Japanese.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Norwegian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Hebrew.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Turkish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Logs\rut_log_2021-08.html	rutserv.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Greek.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Dutch.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Korean.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Swedish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Portuguese.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\printer.ico	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\French.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Chinese Traditional.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Remote Utilities - Host\Logs\rut_log_2021-08.html	rutserv.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Spanish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\English.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Portuguese, Brazilian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Chinese Simplified.lg	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\Installer\f743c26.msi	msiexec.exe
File created	C:\Windows\Installer\f743c28.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B02.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File created	C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File created	C:\Windows\Installer\f743c26.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI472A.tmp	msiexec.exe
File created	C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File created	C:\Windows\Installer\f743c2a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f743c28.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\AuthorizedLUAApp = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RUT_{9E72C04F-B2A1-48BB-87CC-87E800BDD1D0}\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2FC14047F4EBB114788DC1F0AA671D1F\RMS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\ProductName = "Remote Utilities - Host"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\Version = "117440512"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\ProductIcon = "C:\\Windows\\Installer\\{74041CF2-BE4F-411B-87D8-1C0FAA76D1F1}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\PackageCode = "452F584C78591D24EA42B93A1EB17D2C"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RUT_{9E72C04F-B2A1-48BB-87CC-87E800BDD1D0}\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2FC14047F4EBB114788DC1F0AA671D1F	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\2FC14047F4EBB114788DC1F0AA671D1F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList\PackageName = "host7.0.0.3_unsigned.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FC14047F4EBB114788DC1F0AA671D1F\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1380	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
1424	2.exe
1424	2.exe
1872	rfusclient.exe
1872	rfusclient.exe
1968	rutserv.exe
1968	rutserv.exe
1968	rutserv.exe
1968	rutserv.exe
1968	rutserv.exe
1968	rutserv.exe
1968	rutserv.exe
1832	rutserv.exe
1832	rutserv.exe
1832	rutserv.exe
1832	rutserv.exe
1832	rutserv.exe
1824	rutserv.exe
1824	rutserv.exe
1824	rutserv.exe
1824	rutserv.exe
1824	rutserv.exe
1208	rutserv.exe
1208	rutserv.exe
1208	rutserv.exe
1208	rutserv.exe
1208	rutserv.exe
1208	rutserv.exe
1208	rutserv.exe
1208	rutserv.exe
1216	rfusclient.exe
1216	rfusclient.exe
1364	rfusclient.exe
1364	rfusclient.exe
1216	rfusclient.exe
1836	rfusclient.exe
1836	rfusclient.exe
1756	rutserv.exe
1756	rutserv.exe
1756	rutserv.exe
1756	rutserv.exe
1756	rutserv.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
1836	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	568	msiexec.exe
Token: SeIncreaseQuotaPrivilege	568	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe
Token: SeSecurityPrivilege	916	msiexec.exe
Token: SeCreateTokenPrivilege	568	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	568	msiexec.exe
Token: SeLockMemoryPrivilege	568	msiexec.exe
Token: SeIncreaseQuotaPrivilege	568	msiexec.exe
Token: SeMachineAccountPrivilege	568	msiexec.exe
Token: SeTcbPrivilege	568	msiexec.exe
Token: SeSecurityPrivilege	568	msiexec.exe
Token: SeTakeOwnershipPrivilege	568	msiexec.exe
Token: SeLoadDriverPrivilege	568	msiexec.exe
Token: SeSystemProfilePrivilege	568	msiexec.exe
Token: SeSystemtimePrivilege	568	msiexec.exe
Token: SeProfSingleProcessPrivilege	568	msiexec.exe
Token: SeIncBasePriorityPrivilege	568	msiexec.exe
Token: SeCreatePagefilePrivilege	568	msiexec.exe
Token: SeCreatePermanentPrivilege	568	msiexec.exe
Token: SeBackupPrivilege	568	msiexec.exe
Token: SeRestorePrivilege	568	msiexec.exe
Token: SeShutdownPrivilege	568	msiexec.exe
Token: SeDebugPrivilege	568	msiexec.exe
Token: SeAuditPrivilege	568	msiexec.exe
Token: SeSystemEnvironmentPrivilege	568	msiexec.exe
Token: SeChangeNotifyPrivilege	568	msiexec.exe
Token: SeRemoteShutdownPrivilege	568	msiexec.exe
Token: SeUndockPrivilege	568	msiexec.exe
Token: SeSyncAgentPrivilege	568	msiexec.exe
Token: SeEnableDelegationPrivilege	568	msiexec.exe
Token: SeManageVolumePrivilege	568	msiexec.exe
Token: SeImpersonatePrivilege	568	msiexec.exe
Token: SeCreateGlobalPrivilege	568	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe
Token: SeRestorePrivilege	916	msiexec.exe
Token: SeTakeOwnershipPrivilege	916	msiexec.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1364	rfusclient.exe
1364	rfusclient.exe
1364	rfusclient.exe
1364	rfusclient.exe
1364	rfusclient.exe
1364	rfusclient.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1364	rfusclient.exe
1364	rfusclient.exe
1364	rfusclient.exe
1364	rfusclient.exe
1364	rfusclient.exe
1364	rfusclient.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
1380	WINWORD.EXE
1380	WINWORD.EXE
1968	rutserv.exe
1968	rutserv.exe
1968	rutserv.exe
1968	rutserv.exe
1832	rutserv.exe
1832	rutserv.exe
1832	rutserv.exe
1832	rutserv.exe
1824	rutserv.exe
1824	rutserv.exe
1824	rutserv.exe
1824	rutserv.exe
1208	rutserv.exe
1208	rutserv.exe
1208	rutserv.exe
1208	rutserv.exe
1756	rutserv.exe
1756	rutserv.exe
1756	rutserv.exe
1756	rutserv.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1380	1888	до судового запиту.docx.exe	26
PID 1888 wrote to memory of 1380	1888	до судового запиту.docx.exe	26
PID 1888 wrote to memory of 1380	1888	до судового запиту.docx.exe	26
PID 1888 wrote to memory of 1380	1888	до судового запиту.docx.exe	26
PID 1888 wrote to memory of 1424	1888	до судового запиту.docx.exe	27
PID 1888 wrote to memory of 1424	1888	до судового запиту.docx.exe	27
PID 1888 wrote to memory of 1424	1888	до судового запиту.docx.exe	27
PID 1888 wrote to memory of 1424	1888	до судового запиту.docx.exe	27
PID 1380 wrote to memory of 1664	1380	WINWORD.EXE	31
PID 1380 wrote to memory of 1664	1380	WINWORD.EXE	31
PID 1380 wrote to memory of 1664	1380	WINWORD.EXE	31
PID 1380 wrote to memory of 1664	1380	WINWORD.EXE	31
PID 1424 wrote to memory of 568	1424	2.exe	33
PID 1424 wrote to memory of 568	1424	2.exe	33
PID 1424 wrote to memory of 568	1424	2.exe	33
PID 1424 wrote to memory of 568	1424	2.exe	33
PID 1424 wrote to memory of 568	1424	2.exe	33
PID 1424 wrote to memory of 568	1424	2.exe	33
PID 1424 wrote to memory of 568	1424	2.exe	33
PID 916 wrote to memory of 1300	916	msiexec.exe	35
PID 916 wrote to memory of 1300	916	msiexec.exe	35
PID 916 wrote to memory of 1300	916	msiexec.exe	35
PID 916 wrote to memory of 1300	916	msiexec.exe	35
PID 916 wrote to memory of 1300	916	msiexec.exe	35
PID 916 wrote to memory of 1300	916	msiexec.exe	35
PID 916 wrote to memory of 1300	916	msiexec.exe	35
PID 916 wrote to memory of 1872	916	msiexec.exe	37
PID 916 wrote to memory of 1872	916	msiexec.exe	37
PID 916 wrote to memory of 1872	916	msiexec.exe	37
PID 916 wrote to memory of 1872	916	msiexec.exe	37
PID 916 wrote to memory of 1968	916	msiexec.exe	38
PID 916 wrote to memory of 1968	916	msiexec.exe	38
PID 916 wrote to memory of 1968	916	msiexec.exe	38
PID 916 wrote to memory of 1968	916	msiexec.exe	38
PID 916 wrote to memory of 1832	916	msiexec.exe	39
PID 916 wrote to memory of 1832	916	msiexec.exe	39
PID 916 wrote to memory of 1832	916	msiexec.exe	39
PID 916 wrote to memory of 1832	916	msiexec.exe	39
PID 916 wrote to memory of 1824	916	msiexec.exe	40
PID 916 wrote to memory of 1824	916	msiexec.exe	40
PID 916 wrote to memory of 1824	916	msiexec.exe	40
PID 916 wrote to memory of 1824	916	msiexec.exe	40
PID 1208 wrote to memory of 1216	1208	rutserv.exe	42
PID 1208 wrote to memory of 1216	1208	rutserv.exe	42
PID 1208 wrote to memory of 1216	1208	rutserv.exe	42
PID 1208 wrote to memory of 1216	1208	rutserv.exe	42
PID 1208 wrote to memory of 1364	1208	rutserv.exe	43
PID 1208 wrote to memory of 1364	1208	rutserv.exe	43
PID 1208 wrote to memory of 1364	1208	rutserv.exe	43
PID 1208 wrote to memory of 1364	1208	rutserv.exe	43
PID 1216 wrote to memory of 1836	1216	rfusclient.exe	44
PID 1216 wrote to memory of 1836	1216	rfusclient.exe	44
PID 1216 wrote to memory of 1836	1216	rfusclient.exe	44
PID 1216 wrote to memory of 1836	1216	rfusclient.exe	44
PID 1208 wrote to memory of 1756	1208	rutserv.exe	45
PID 1208 wrote to memory of 1756	1208	rutserv.exe	45
PID 1208 wrote to memory of 1756	1208	rutserv.exe	45
PID 1208 wrote to memory of 1756	1208	rutserv.exe	45

C:\Users\Admin\AppData\Local\Temp\до судового запиту.docx.exe
"C:\Users\Admin\AppData\Local\Temp\до судового запиту.docx.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1.docx"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:1664
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RUT_{9E72C04F-B2A1-48BB-87CC-87E800BDD1D0}\host7.0.0.3_unsigned.msi" /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:568

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A32700FCC4F874D95C3415FC6EB75EC1
  2⤵
  - Loads dropped DLL
  PID:1300
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\RUT_{9E72C04F-B2A1-48BB-87CC-87E800BDD1D0}\host7.0.0.3_unsigned.msi"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:1872
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1968
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1832
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1824

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: SetClipboardViewer
    PID:1836
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1364
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-153-0x0000000003670000-0x0000000003671000-memory.dmp

Download

memory/1208-161-0x00000000036E0000-0x00000000036E1000-memory.dmp

Download

memory/1208-183-0x0000000004170000-0x0000000004171000-memory.dmp

Download

memory/1208-182-0x0000000004160000-0x0000000004161000-memory.dmp

Download

memory/1208-154-0x0000000003640000-0x0000000003641000-memory.dmp

Download

memory/1208-158-0x0000000003870000-0x0000000003871000-memory.dmp

Download

memory/1208-159-0x0000000003910000-0x0000000003911000-memory.dmp

Download

memory/1208-167-0x0000000003FD0000-0x0000000003FD1000-memory.dmp

Download

memory/1208-166-0x0000000003680000-0x0000000003681000-memory.dmp

Download

memory/1208-160-0x0000000003DE0000-0x0000000003DE1000-memory.dmp

Download

memory/1208-165-0x0000000003660000-0x0000000003661000-memory.dmp

Download

memory/1208-164-0x0000000003FC0000-0x0000000003FC1000-memory.dmp

Download

memory/1208-162-0x00000000038C0000-0x00000000038C1000-memory.dmp

Download

memory/1208-163-0x0000000003DF0000-0x0000000003DF1000-memory.dmp

Download

memory/1208-144-0x0000000000270000-0x0000000000271000-memory.dmp

Download

memory/1208-147-0x00000000038B0000-0x00000000038B1000-memory.dmp

Download

memory/1208-156-0x0000000003690000-0x0000000003691000-memory.dmp

Download

memory/1208-146-0x00000000036D0000-0x00000000036D1000-memory.dmp

Download

memory/1216-170-0x0000000004F00000-0x0000000004F01000-memory.dmp

Download

memory/1216-171-0x0000000004F10000-0x0000000004F11000-memory.dmp

Download

memory/1216-172-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Download

memory/1216-155-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/1364-169-0x0000000002D50000-0x0000000002D51000-memory.dmp

Download

memory/1364-168-0x0000000002A60000-0x0000000002A61000-memory.dmp

Download

memory/1364-157-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/1364-173-0x0000000004520000-0x0000000004521000-memory.dmp

Download

memory/1380-67-0x0000000072121000-0x0000000072124000-memory.dmp

Download

memory/1380-70-0x000000006FBA1000-0x000000006FBA3000-memory.dmp

Download

memory/1380-72-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/1424-71-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/1664-76-0x000007FEFB571000-0x000007FEFB573000-memory.dmp

Download

memory/1756-181-0x00000000002F0000-0x00000000002F1000-memory.dmp

Download

memory/1824-111-0x00000000002F0000-0x00000000002F1000-memory.dmp

Download

memory/1832-103-0x0000000001690000-0x0000000001691000-memory.dmp

Download

memory/1836-177-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Download

memory/1872-92-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Download

memory/1888-60-0x0000000075161000-0x0000000075163000-memory.dmp

Download

memory/1968-94-0x0000000000330000-0x0000000000331000-memory.dmp

Download