Analysis
-
max time kernel
123s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
08-10-2021 17:30
General
-
Target
Device/HarddiskVolume2/Program Files/VMware/tools/lib/vmaxsvc.exe
-
Size
17.1MB
-
MD5
383d6a55625a81ead08705003a6ac105
-
SHA1
ade79797e95eb9487a272530e9e17f2181e81a45
-
SHA256
e8b73d39c58fef2b571505bdd69e371c8ff095541528c7bcbbf4120e024a19bb
-
SHA512
31d1d32d1fdc030a336d6f85a7111ae690f0f740f1a0a9683193faf0e13686d72ae5fb4e6963a57972ec19c9f195b4bab2453b80e25e07ab2da26f5a95bda394
Score
10/10
Malware Config
Signatures
-
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Program Files\VMware\tools\lib\vmaxsvc.exe"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Program Files\VMware\tools\lib\vmaxsvc.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Program Files\VMware\tools\lib\vmaxsvc.exe"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Program Files\VMware\tools\lib\vmaxsvc.exe" -run_agent -second2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB