rms | 22ecf75f81c4e67a889f0f89adee960deb071e289b84c4cb6002d744b08f2492

General

Target

SecuriteInfo.com.win_rms_auto.7065.30182.exe
Size

5.7MB
MD5

21234287827ffaf9893ee26bb5904a1c
SHA1

4ce35b410b6a96f00ba57af75cc53a68f90dce3c
SHA256

22ecf75f81c4e67a889f0f89adee960deb071e289b84c4cb6002d744b08f2492
SHA512

2b045e24415958acf4ba33a4b5f986b17500189d6f5834c8bb73c0c7e86a52e14e4d8eb741ebb5dd61928f974f1e1a70469dfdfedd1dee2f76aa15a46b0d5ffb

Score

10^/10

rms rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 2 IoCs

pid	Process
656	Lighsht.exe
908	Lighsht.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Lighsht.exe

Loads dropped DLL 10 IoCs

pid	Process
364	SecuriteInfo.com.win_rms_auto.7065.30182.exe
364	SecuriteInfo.com.win_rms_auto.7065.30182.exe
364	SecuriteInfo.com.win_rms_auto.7065.30182.exe
364	SecuriteInfo.com.win_rms_auto.7065.30182.exe
364	SecuriteInfo.com.win_rms_auto.7065.30182.exe
364	SecuriteInfo.com.win_rms_auto.7065.30182.exe
656	Lighsht.exe
656	Lighsht.exe
908	Lighsht.exe
908	Lighsht.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	Lighsht.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall"	Lighsht.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
656	Lighsht.exe
656	Lighsht.exe
656	Lighsht.exe
656	Lighsht.exe
656	Lighsht.exe
656	Lighsht.exe
656	Lighsht.exe
656	Lighsht.exe
656	Lighsht.exe
656	Lighsht.exe
656	Lighsht.exe
656	Lighsht.exe
908	Lighsht.exe
908	Lighsht.exe
908	Lighsht.exe
908	Lighsht.exe
908	Lighsht.exe
908	Lighsht.exe
908	Lighsht.exe
908	Lighsht.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	656	Lighsht.exe
Token: SeDebugPrivilege	656	Lighsht.exe
Token: SeTakeOwnershipPrivilege	908	Lighsht.exe
Token: SeTcbPrivilege	908	Lighsht.exe
Token: SeTcbPrivilege	908	Lighsht.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
656	Lighsht.exe
656	Lighsht.exe
656	Lighsht.exe
656	Lighsht.exe
908	Lighsht.exe
908	Lighsht.exe
908	Lighsht.exe
908	Lighsht.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 656	364	SecuriteInfo.com.win_rms_auto.7065.30182.exe	73
PID 364 wrote to memory of 656	364	SecuriteInfo.com.win_rms_auto.7065.30182.exe	73
PID 364 wrote to memory of 656	364	SecuriteInfo.com.win_rms_auto.7065.30182.exe	73

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.win_rms_auto.7065.30182.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.win_rms_auto.7065.30182.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Public\Lightshot\Lighsht.exe
  "C:\Users\Public\Lightshot\Lighsht.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:656
- - C:\Users\Public\Lightshot\Lighsht.exe
    C:\Users\Public\Lightshot\Lighsht.exe -run_agent -second
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-123-0x0000000002621000-0x0000000002641000-memory.dmp

Filesize
128KB

Download
memory/364-118-0x0000000002620000-0x0000000002651000-memory.dmp

Filesize
196KB

Download
memory/656-132-0x0000000004F60000-0x0000000004F61000-memory.dmp

Filesize
4KB

Download
memory/656-133-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/656-128-0x0000000003990000-0x0000000003991000-memory.dmp

Filesize
4KB

Download
memory/908-142-0x0000000008140000-0x0000000008141000-memory.dmp

Filesize
4KB

Download
memory/908-143-0x00000000063B0000-0x00000000063B1000-memory.dmp

Filesize
4KB

Download
memory/908-139-0x00000000055B0000-0x00000000055B1000-memory.dmp

Filesize
4KB

Download
memory/908-140-0x00000000055C0000-0x00000000055C1000-memory.dmp

Filesize
4KB

Download
memory/908-141-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download
memory/908-137-0x0000000003750000-0x0000000003751000-memory.dmp

Filesize
4KB

Download
memory/908-144-0x0000000006120000-0x0000000006121000-memory.dmp

Filesize
4KB

Download
memory/908-138-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/908-145-0x0000000006170000-0x0000000006171000-memory.dmp

Filesize
4KB

Download
memory/908-147-0x0000000008150000-0x0000000008151000-memory.dmp

Filesize
4KB

Download
memory/908-146-0x00000000061C0000-0x00000000061C1000-memory.dmp

Filesize
4KB

Download
memory/908-148-0x0000000006210000-0x0000000006211000-memory.dmp

Filesize
4KB

Download
memory/908-149-0x0000000006900000-0x0000000006901000-memory.dmp

Filesize
4KB

Download
memory/908-150-0x00000000081B0000-0x0000000008281000-memory.dmp

Filesize
836KB

Download

Analysis

Sharing