rms | 22ecf75f81c4e67a889f0f89adee960deb071e289b84c4cb6002d744b08f2492

General

Target

SecuriteInfo.com.win_rms_auto.7065.30182.exe
Size

5.7MB
MD5

21234287827ffaf9893ee26bb5904a1c
SHA1

4ce35b410b6a96f00ba57af75cc53a68f90dce3c
SHA256

22ecf75f81c4e67a889f0f89adee960deb071e289b84c4cb6002d744b08f2492
SHA512

2b045e24415958acf4ba33a4b5f986b17500189d6f5834c8bb73c0c7e86a52e14e4d8eb741ebb5dd61928f974f1e1a70469dfdfedd1dee2f76aa15a46b0d5ffb

Score

10^/10

rms rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 2 IoCs

pid	Process
800	Lighsht.exe
984	Lighsht.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Lighsht.exe

Loads dropped DLL 9 IoCs

pid	Process
1128	SecuriteInfo.com.win_rms_auto.7065.30182.exe
1128	SecuriteInfo.com.win_rms_auto.7065.30182.exe
1128	SecuriteInfo.com.win_rms_auto.7065.30182.exe
1128	SecuriteInfo.com.win_rms_auto.7065.30182.exe
1128	SecuriteInfo.com.win_rms_auto.7065.30182.exe
800	Lighsht.exe
800	Lighsht.exe
984	Lighsht.exe
984	Lighsht.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
800	Lighsht.exe
800	Lighsht.exe
800	Lighsht.exe
800	Lighsht.exe
800	Lighsht.exe
800	Lighsht.exe
800	Lighsht.exe
800	Lighsht.exe
984	Lighsht.exe
984	Lighsht.exe
984	Lighsht.exe
984	Lighsht.exe
984	Lighsht.exe
984	Lighsht.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	800	Lighsht.exe
Token: SeDebugPrivilege	800	Lighsht.exe
Token: SeTakeOwnershipPrivilege	984	Lighsht.exe
Token: SeTcbPrivilege	984	Lighsht.exe
Token: SeTcbPrivilege	984	Lighsht.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
800	Lighsht.exe
800	Lighsht.exe
800	Lighsht.exe
800	Lighsht.exe
984	Lighsht.exe
984	Lighsht.exe
984	Lighsht.exe
984	Lighsht.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 800	1128	SecuriteInfo.com.win_rms_auto.7065.30182.exe	27
PID 1128 wrote to memory of 800	1128	SecuriteInfo.com.win_rms_auto.7065.30182.exe	27
PID 1128 wrote to memory of 800	1128	SecuriteInfo.com.win_rms_auto.7065.30182.exe	27
PID 1128 wrote to memory of 800	1128	SecuriteInfo.com.win_rms_auto.7065.30182.exe	27

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.win_rms_auto.7065.30182.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.win_rms_auto.7065.30182.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Public\Lightshot\Lighsht.exe
  "C:\Users\Public\Lightshot\Lighsht.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:800
- - C:\Users\Public\Lightshot\Lighsht.exe
    C:\Users\Public\Lightshot\Lighsht.exe -run_agent -second
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-75-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/800-68-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/800-73-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download
memory/984-79-0x0000000005A40000-0x0000000005A41000-memory.dmp

Filesize
4KB

Download
memory/984-87-0x0000000005E60000-0x0000000005E61000-memory.dmp

Filesize
4KB

Download
memory/984-91-0x00000000076C0000-0x000000000781C000-memory.dmp

Filesize
1.4MB

Download
memory/984-81-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

Filesize
4KB

Download
memory/984-80-0x0000000005AC0000-0x0000000005AC1000-memory.dmp

Filesize
4KB

Download
memory/984-90-0x0000000006090000-0x0000000006091000-memory.dmp

Filesize
4KB

Download
memory/984-88-0x0000000005EF0000-0x0000000005EF1000-memory.dmp

Filesize
4KB

Download
memory/984-76-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/984-86-0x0000000005D90000-0x0000000005D91000-memory.dmp

Filesize
4KB

Download
memory/984-85-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/984-89-0x0000000006070000-0x0000000006071000-memory.dmp

Filesize
4KB

Download
memory/984-84-0x0000000005AB0000-0x0000000005AB1000-memory.dmp

Filesize
4KB

Download
memory/984-83-0x0000000005A30000-0x0000000005A31000-memory.dmp

Filesize
4KB

Download
memory/984-82-0x0000000005AA0000-0x0000000005AA1000-memory.dmp

Filesize
4KB

Download
memory/1128-54-0x0000000074B41000-0x0000000074B43000-memory.dmp

Filesize
8KB

Download
memory/1128-58-0x00000000006F0000-0x0000000000721000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing