rms | af01ec61317d91bc4ce4b70b972b6a5dd29ddcc18999a937d298d7de8a0cf7af

General

Target

AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe
Size

4.9MB
MD5

4d9350a29c7677374fbb8bc2e96a77f3
SHA1

1fd63c7af6b2397d2f6616935aafef394f2394ed
SHA256

af01ec61317d91bc4ce4b70b972b6a5dd29ddcc18999a937d298d7de8a0cf7af
SHA512

7b69647225ef9d6d38389cc42a680946b85fc097d8681f715a6d0064dd205e3b743c42af163566071bab3f70b71e89a6e9629f540fd3ee1f5be8b5253876c7f0

Score

10^/10

rms rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 4 IoCs

pid	Process
1324	rfusclient.exe
1368	rutserv.exe
756	rutserv.exe
664	rfusclient.exe

Loads dropped DLL 6 IoCs

pid	Process
2004	cmd.exe
1324	rfusclient.exe
1324	rfusclient.exe
1324	rfusclient.exe
1324	rfusclient.exe
756	rutserv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1368	rutserv.exe
1368	rutserv.exe
1368	rutserv.exe
756	rutserv.exe
756	rutserv.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	rutserv.exe
Token: SeTakeOwnershipPrivilege	756	rutserv.exe
Token: SeTcbPrivilege	756	rutserv.exe
Token: SeTcbPrivilege	756	rutserv.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
664	rfusclient.exe
664	rfusclient.exe
664	rfusclient.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
664	rfusclient.exe
664	rfusclient.exe
664	rfusclient.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1368	rutserv.exe
756	rutserv.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2004	1080	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	26
PID 1080 wrote to memory of 2004	1080	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	26
PID 1080 wrote to memory of 2004	1080	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	26
PID 1080 wrote to memory of 2004	1080	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	26
PID 1080 wrote to memory of 2004	1080	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	26
PID 1080 wrote to memory of 2004	1080	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	26
PID 1080 wrote to memory of 2004	1080	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	26
PID 2004 wrote to memory of 1324	2004	cmd.exe	28
PID 2004 wrote to memory of 1324	2004	cmd.exe	28
PID 2004 wrote to memory of 1324	2004	cmd.exe	28
PID 2004 wrote to memory of 1324	2004	cmd.exe	28
PID 1324 wrote to memory of 1368	1324	rfusclient.exe	29
PID 1324 wrote to memory of 1368	1324	rfusclient.exe	29
PID 1324 wrote to memory of 1368	1324	rfusclient.exe	29
PID 1324 wrote to memory of 1368	1324	rfusclient.exe	29
PID 756 wrote to memory of 664	756	rutserv.exe	35
PID 756 wrote to memory of 664	756	rutserv.exe	35
PID 756 wrote to memory of 664	756	rutserv.exe	35
PID 756 wrote to memory of 664	756	rutserv.exe	35

C:\Users\Admin\AppData\Local\Temp\AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe
"C:\Users\Admin\AppData\Local\Temp\AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rfusclient.exe
    rfusclient.exe -run_agent
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe -second
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rfusclient.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rfusclient.exe /tray /user
        6⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-53-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download
memory/1324-66-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing