rms | af01ec61317d91bc4ce4b70b972b6a5dd29ddcc18999a937d298d7de8a0cf7af

General

Target

AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe
Size

4.9MB
MD5

4d9350a29c7677374fbb8bc2e96a77f3
SHA1

1fd63c7af6b2397d2f6616935aafef394f2394ed
SHA256

af01ec61317d91bc4ce4b70b972b6a5dd29ddcc18999a937d298d7de8a0cf7af
SHA512

7b69647225ef9d6d38389cc42a680946b85fc097d8681f715a6d0064dd205e3b743c42af163566071bab3f70b71e89a6e9629f540fd3ee1f5be8b5253876c7f0

Score

10^/10

rms rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1188 created 644	1188	svchost.exe	72

Executes dropped EXE 4 IoCs

pid	Process
2540	rfusclient.exe
644	rutserv.exe
864	rutserv.exe
1296	rfusclient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
644	rutserv.exe
644	rutserv.exe
644	rutserv.exe
644	rutserv.exe
864	rutserv.exe
864	rutserv.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	644	rutserv.exe
Token: SeTcbPrivilege	1188	svchost.exe
Token: SeTcbPrivilege	1188	svchost.exe
Token: SeTakeOwnershipPrivilege	864	rutserv.exe
Token: SeTcbPrivilege	864	rutserv.exe
Token: SeTcbPrivilege	864	rutserv.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1296	rfusclient.exe
1296	rfusclient.exe
1296	rfusclient.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1296	rfusclient.exe
1296	rfusclient.exe
1296	rfusclient.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
644	rutserv.exe
864	rutserv.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 4004	2280	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	69
PID 2280 wrote to memory of 4004	2280	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	69
PID 2280 wrote to memory of 4004	2280	AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe	69
PID 4004 wrote to memory of 2540	4004	cmd.exe	71
PID 4004 wrote to memory of 2540	4004	cmd.exe	71
PID 4004 wrote to memory of 2540	4004	cmd.exe	71
PID 2540 wrote to memory of 644	2540	rfusclient.exe	72
PID 2540 wrote to memory of 644	2540	rfusclient.exe	72
PID 2540 wrote to memory of 644	2540	rfusclient.exe	72
PID 1188 wrote to memory of 864	1188	svchost.exe	75
PID 1188 wrote to memory of 864	1188	svchost.exe	75
PID 1188 wrote to memory of 864	1188	svchost.exe	75
PID 864 wrote to memory of 1296	864	rutserv.exe	76
PID 864 wrote to memory of 1296	864	rutserv.exe	76
PID 864 wrote to memory of 1296	864	rutserv.exe	76

C:\Users\Admin\AppData\Local\Temp\AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe
"C:\Users\Admin\AppData\Local\Temp\AF01EC61317D91BC4CE4B70B972B6A5DD29DDCC18999A.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rfusclient.exe
    rfusclient.exe -run_agent
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:644
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rutserv.exe -second
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rfusclient.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rfusclient.exe /tray /user
        6⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1296

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-124-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/864-136-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/1296-142-0x0000000000B10000-0x0000000000C5A000-memory.dmp

Filesize
1.3MB

Download
memory/2540-120-0x0000000000AB0000-0x0000000000BFA000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing