rms | af01ec61317d91bc4ce4b70b972b6a5dd29ddcc18999a937d298d7de8a0cf7af

General

Target

AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe
Size

4.9MB
MD5

4d9350a29c7677374fbb8bc2e96a77f3
SHA1

1fd63c7af6b2397d2f6616935aafef394f2394ed
SHA256

af01ec61317d91bc4ce4b70b972b6a5dd29ddcc18999a937d298d7de8a0cf7af
SHA512

7b69647225ef9d6d38389cc42a680946b85fc097d8681f715a6d0064dd205e3b743c42af163566071bab3f70b71e89a6e9629f540fd3ee1f5be8b5253876c7f0

Score

10^/10

rms rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1128 created 660	1128	svchost.exe	71

Executes dropped EXE 4 IoCs

pid	Process
2240	rfusclient.exe
660	rutserv.exe
1304	rutserv.exe
1908	rfusclient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
660	rutserv.exe
660	rutserv.exe
660	rutserv.exe
660	rutserv.exe
1304	rutserv.exe
1304	rutserv.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	660	rutserv.exe
Token: SeTcbPrivilege	1128	svchost.exe
Token: SeTcbPrivilege	1128	svchost.exe
Token: SeTakeOwnershipPrivilege	1304	rutserv.exe
Token: SeTcbPrivilege	1304	rutserv.exe
Token: SeTcbPrivilege	1304	rutserv.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1908	rfusclient.exe
1908	rfusclient.exe
1908	rfusclient.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1908	rfusclient.exe
1908	rfusclient.exe
1908	rfusclient.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
660	rutserv.exe
1304	rutserv.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 3088	1832	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	68
PID 1832 wrote to memory of 3088	1832	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	68
PID 1832 wrote to memory of 3088	1832	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	68
PID 3088 wrote to memory of 2240	3088	cmd.exe	70
PID 3088 wrote to memory of 2240	3088	cmd.exe	70
PID 3088 wrote to memory of 2240	3088	cmd.exe	70
PID 2240 wrote to memory of 660	2240	rfusclient.exe	71
PID 2240 wrote to memory of 660	2240	rfusclient.exe	71
PID 2240 wrote to memory of 660	2240	rfusclient.exe	71
PID 1128 wrote to memory of 1304	1128	svchost.exe	74
PID 1128 wrote to memory of 1304	1128	svchost.exe	74
PID 1128 wrote to memory of 1304	1128	svchost.exe	74
PID 1304 wrote to memory of 1908	1304	rutserv.exe	75
PID 1304 wrote to memory of 1908	1304	rutserv.exe	75
PID 1304 wrote to memory of 1908	1304	rutserv.exe	75

C:\Users\Admin\AppData\Local\Temp\AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe
"C:\Users\Admin\AppData\Local\Temp\AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rfusclient.exe
    rfusclient.exe -run_agent
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:660
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe -second
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rfusclient.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rfusclient.exe /tray /user
        6⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1908

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/660-125-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/1304-126-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/1908-139-0x0000000000AD0000-0x0000000000C1A000-memory.dmp

Filesize
1.3MB

Download
memory/2240-121-0x0000000000AB0000-0x0000000000AD3000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing