Overview

overview

9

Static

static

rdmr_svchost.exe

windows7_x64

9

rdmr_svchost.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rdmr_svchost.exe

  • Size

    1.8MB

  • Sample

    211019-ynlr8shccj

  • MD5

    e37a0ece30267233f1dddf3c2300393f

  • SHA1

    27610367c41c1b8d3a26885b40fd7aac748189b2

  • SHA256

    bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d

  • SHA512

    a0e5ceafb39f9ad3774d6a250646bae5f5595c1330bef3df7d448778ee519bc35ce221526c1a4d3db88107b5ccf1b465eef11e5b00cfc680bcdb9cea92ba87c2

Score
9/10
evasionransomwarespywarestealer

Malware Config

Targets

    • Target

      rdmr_svchost.exe

    • Size

      1.8MB

    • MD5

      e37a0ece30267233f1dddf3c2300393f

    • SHA1

      27610367c41c1b8d3a26885b40fd7aac748189b2

    • SHA256

      bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d

    • SHA512

      a0e5ceafb39f9ad3774d6a250646bae5f5595c1330bef3df7d448778ee519bc35ce221526c1a4d3db88107b5ccf1b465eef11e5b00cfc680bcdb9cea92ba87c2

    Score
    9/10
    evasionransomwarespywarestealer

    • Clears Windows event logs

      evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal on Host

1
T1070

File Deletion

2
T1107

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks