rms | bbc131fda4a9d5d10d774f609a121390bb56456f358420db95d35ef9760acad9

General

Target

BBC131FDA4A9D5D10D774F609A121390BB56456F35842.exe
Size

16.2MB
MD5

9d8fd3044460f6a4b876755ab299c634
SHA1

67e66edb8ec5fdbd4662541e57800ba4a5e6b229
SHA256

bbc131fda4a9d5d10d774f609a121390bb56456f358420db95d35ef9760acad9
SHA512

c642098a6affcffda92bb05813482228e5304e1975a75f98ba92f66522b2109dc0d95a988dfc3a4b8621ca86702af9b74288f0996b467b235fff8e4b6a87ab8c

Score

10^/10

rms rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 4 IoCs

pid	Process
1656	rfusclient.exe
1768	rutserv.exe
676	rutserv.exe
432	rfusclient.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	rutserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	rfusclient.exe

Loads dropped DLL 9 IoCs

pid	Process
1116	BBC131FDA4A9D5D10D774F609A121390BB56456F35842.exe
1656	rfusclient.exe
1656	rfusclient.exe
1656	rfusclient.exe
1656	rfusclient.exe
1768	rutserv.exe
1768	rutserv.exe
676	rutserv.exe
676	rutserv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1656	rfusclient.exe
1656	rfusclient.exe
1768	rutserv.exe
1768	rutserv.exe
1768	rutserv.exe
1768	rutserv.exe
1768	rutserv.exe
1768	rutserv.exe
676	rutserv.exe
676	rutserv.exe
676	rutserv.exe
676	rutserv.exe
676	rutserv.exe
676	rutserv.exe
432	rfusclient.exe
432	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	rutserv.exe
Token: SeTakeOwnershipPrivilege	676	rutserv.exe
Token: SeTcbPrivilege	676	rutserv.exe
Token: SeTcbPrivilege	676	rutserv.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
432	rfusclient.exe
432	rfusclient.exe
432	rfusclient.exe
432	rfusclient.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
432	rfusclient.exe
432	rfusclient.exe
432	rfusclient.exe
432	rfusclient.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1768	rutserv.exe
1768	rutserv.exe
1768	rutserv.exe
1768	rutserv.exe
676	rutserv.exe
676	rutserv.exe
676	rutserv.exe
676	rutserv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1656	1116	BBC131FDA4A9D5D10D774F609A121390BB56456F35842.exe	27
PID 1116 wrote to memory of 1656	1116	BBC131FDA4A9D5D10D774F609A121390BB56456F35842.exe	27
PID 1116 wrote to memory of 1656	1116	BBC131FDA4A9D5D10D774F609A121390BB56456F35842.exe	27
PID 1116 wrote to memory of 1656	1116	BBC131FDA4A9D5D10D774F609A121390BB56456F35842.exe	27
PID 1656 wrote to memory of 1768	1656	rfusclient.exe	28
PID 1656 wrote to memory of 1768	1656	rfusclient.exe	28
PID 1656 wrote to memory of 1768	1656	rfusclient.exe	28
PID 1656 wrote to memory of 1768	1656	rfusclient.exe	28
PID 676 wrote to memory of 432	676	rutserv.exe	30
PID 676 wrote to memory of 432	676	rutserv.exe	30
PID 676 wrote to memory of 432	676	rutserv.exe	30
PID 676 wrote to memory of 432	676	rutserv.exe	30

C:\Users\Admin\AppData\Local\Temp\BBC131FDA4A9D5D10D774F609A121390BB56456F35842.exe
"C:\Users\Admin\AppData\Local\Temp\BBC131FDA4A9D5D10D774F609A121390BB56456F35842.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Users\Admin\AppData\Roaming\RMS Agent\70020\2BF24577ED\rfusclient.exe
  "C:\Users\Admin\AppData\Roaming\RMS Agent\70020\2BF24577ED\rfusclient.exe" -run_agent
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Users\Admin\AppData\Roaming\RMS Agent\70020\2BF24577ED\rutserv.exe
    "C:\Users\Admin\AppData\Roaming\RMS Agent\70020\2BF24577ED\rutserv.exe" -run_agent
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1768
  - - C:\Users\Admin\AppData\Roaming\RMS Agent\70020\2BF24577ED\rutserv.exe
      "C:\Users\Admin\AppData\Roaming\RMS Agent\70020\2BF24577ED\rutserv.exe" -run_agent -second
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:676
    - - C:\Users\Admin\AppData\Roaming\RMS Agent\70020\2BF24577ED\rfusclient.exe
        
        "C:\Users\Admin\AppData\Roaming\RMS Agent\70020\2BF24577ED\rfusclient.exe" /tray /user
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-106-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/432-102-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/432-109-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/432-107-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/676-101-0x0000000006250000-0x0000000006251000-memory.dmp

Filesize
4KB

Download
memory/676-105-0x00000000075D0000-0x00000000075D1000-memory.dmp

Filesize
4KB

Download
memory/676-87-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/676-89-0x0000000005730000-0x0000000005731000-memory.dmp

Filesize
4KB

Download
memory/676-108-0x00000000063B0000-0x00000000063B1000-memory.dmp

Filesize
4KB

Download
memory/676-95-0x0000000005C60000-0x0000000005C61000-memory.dmp

Filesize
4KB

Download
memory/676-97-0x0000000005C50000-0x0000000005C51000-memory.dmp

Filesize
4KB

Download
memory/676-100-0x00000000060B0000-0x00000000060B1000-memory.dmp

Filesize
4KB

Download
memory/676-103-0x00000000071F0000-0x00000000071F1000-memory.dmp

Filesize
4KB

Download
memory/676-99-0x0000000005780000-0x0000000005781000-memory.dmp

Filesize
4KB

Download
memory/676-98-0x0000000006240000-0x0000000006241000-memory.dmp

Filesize
4KB

Download
memory/676-104-0x0000000007240000-0x0000000007241000-memory.dmp

Filesize
4KB

Download
memory/676-88-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/676-91-0x0000000005C40000-0x0000000005C41000-memory.dmp

Filesize
4KB

Download
memory/1116-53-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

Filesize
8KB

Download
memory/1116-54-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1656-61-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1768-69-0x0000000002E20000-0x0000000002E21000-memory.dmp

Filesize
4KB

Download
memory/1768-74-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Filesize
4KB

Download
memory/1768-75-0x0000000004B20000-0x0000000004B21000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing