rms | af01ec61317d91bc4ce4b70b972b6a5dd29ddcc18999a937d298d7de8a0cf7af

General

Target

AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe
Size

4.9MB
MD5

4d9350a29c7677374fbb8bc2e96a77f3
SHA1

1fd63c7af6b2397d2f6616935aafef394f2394ed
SHA256

af01ec61317d91bc4ce4b70b972b6a5dd29ddcc18999a937d298d7de8a0cf7af
SHA512

7b69647225ef9d6d38389cc42a680946b85fc097d8681f715a6d0064dd205e3b743c42af163566071bab3f70b71e89a6e9629f540fd3ee1f5be8b5253876c7f0

Score

10^/10

rms rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 4 IoCs

pid	Process
1296	rfusclient.exe
1364	rutserv.exe
844	rutserv.exe
1128	rfusclient.exe

Loads dropped DLL 6 IoCs

pid	Process
1576	cmd.exe
1296	rfusclient.exe
1296	rfusclient.exe
1296	rfusclient.exe
1296	rfusclient.exe
844	rutserv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1364	rutserv.exe
1364	rutserv.exe
1364	rutserv.exe
844	rutserv.exe
844	rutserv.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1364	rutserv.exe
Token: SeTakeOwnershipPrivilege	844	rutserv.exe
Token: SeTcbPrivilege	844	rutserv.exe
Token: SeTcbPrivilege	844	rutserv.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1128	rfusclient.exe
1128	rfusclient.exe
1128	rfusclient.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1128	rfusclient.exe
1128	rfusclient.exe
1128	rfusclient.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1364	rutserv.exe
844	rutserv.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1576	2008	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	26
PID 2008 wrote to memory of 1576	2008	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	26
PID 2008 wrote to memory of 1576	2008	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	26
PID 2008 wrote to memory of 1576	2008	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	26
PID 2008 wrote to memory of 1576	2008	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	26
PID 2008 wrote to memory of 1576	2008	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	26
PID 2008 wrote to memory of 1576	2008	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	26
PID 1576 wrote to memory of 1296	1576	cmd.exe	28
PID 1576 wrote to memory of 1296	1576	cmd.exe	28
PID 1576 wrote to memory of 1296	1576	cmd.exe	28
PID 1576 wrote to memory of 1296	1576	cmd.exe	28
PID 1296 wrote to memory of 1364	1296	rfusclient.exe	33
PID 1296 wrote to memory of 1364	1296	rfusclient.exe	33
PID 1296 wrote to memory of 1364	1296	rfusclient.exe	33
PID 1296 wrote to memory of 1364	1296	rfusclient.exe	33
PID 844 wrote to memory of 1128	844	rutserv.exe	35
PID 844 wrote to memory of 1128	844	rutserv.exe	35
PID 844 wrote to memory of 1128	844	rutserv.exe	35
PID 844 wrote to memory of 1128	844	rutserv.exe	35

C:\Users\Admin\AppData\Local\Temp\AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe
"C:\Users\Admin\AppData\Local\Temp\AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rfusclient.exe
    rfusclient.exe -run_agent
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe -second
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rfusclient.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rfusclient.exe /tray /user
        6⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-88-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1128-89-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1296-60-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1364-69-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2008-52-0x00000000761B1000-0x00000000761B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing