bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d

General

Target

rdmr_svchost.exe
Size

1.8MB
MD5

e37a0ece30267233f1dddf3c2300393f
SHA1

27610367c41c1b8d3a26885b40fd7aac748189b2
SHA256

bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d
SHA512

a0e5ceafb39f9ad3774d6a250646bae5f5595c1330bef3df7d448778ee519bc35ce221526c1a4d3db88107b5ccf1b465eef11e5b00cfc680bcdb9cea92ba87c2

Score

9^/10

evasion ransomware spyware stealer

Malware Config

Signatures

Clears Windows event logs 1 TTPs
evasion ransomware

Indicator Removal on Host
T1070
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 1 IoCs

Processes:

conhost.exe

pid process

1292 conhost.exe

pid	process
1292	conhost.exe

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

conhost.exe

description	ioc	process
File created	C:\Users\Admin\Pictures\SkipHide.crw.redeem	conhost.exe
File created	C:\Users\Admin\Pictures\SkipInitialize.tiff.redeem	conhost.exe
File created	C:\Users\Admin\Pictures\InitializeMount.crw.redeem	conhost.exe
File opened for modification	C:\Users\Admin\Pictures\SkipInitialize.tiff	conhost.exe
File opened for modification	C:\Users\Admin\Pictures\UseShow.tiff	conhost.exe
File created	C:\Users\Admin\Pictures\FormatRename.png.redeem	conhost.exe
File created	C:\Users\Admin\Pictures\UseShow.tiff.redeem	conhost.exe
File created	C:\Users\Admin\Pictures\WatchBackup.tif.redeem	conhost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rdmr_svchost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	rdmr_svchost.exe

Deletes itself 1 IoCs

Processes:

conhost.exe

pid process

1292 conhost.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1292	conhost.exe

Drops desktop.ini file(s) 5 IoCs

Processes:

conhost.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	conhost.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	conhost.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	conhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	conhost.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	conhost.exe

Drops file in Windows directory 3 IoCs

Processes:

rdmr_svchost.exe

description	ioc	process
File opened for modification	C:\Windows\WIN_TEMP\	rdmr_svchost.exe
File created	C:\Windows\WIN_TEMP\conhost.exe	rdmr_svchost.exe
File opened for modification	C:\Windows\WIN_TEMP\conhost.exe	rdmr_svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

3332 vssadmin.exe
Modifies registry class 1 IoCs

Processes:

rdmr_svchost.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance rdmr_svchost.exe

pid	process
3332	vssadmin.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	rdmr_svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exewevtutil.exewevtutil.exewevtutil.exewevtutil.execonhost.exe

description	pid	process
Token: SeBackupPrivilege	592	vssvc.exe
Token: SeRestorePrivilege	592	vssvc.exe
Token: SeAuditPrivilege	592	vssvc.exe
Token: SeSecurityPrivilege	2624	wevtutil.exe
Token: SeBackupPrivilege	2624	wevtutil.exe
Token: SeSecurityPrivilege	1448	wevtutil.exe
Token: SeBackupPrivilege	1448	wevtutil.exe
Token: SeSecurityPrivilege	2168	wevtutil.exe
Token: SeBackupPrivilege	2168	wevtutil.exe
Token: SeSecurityPrivilege	1444	wevtutil.exe
Token: SeBackupPrivilege	1444	wevtutil.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe
Token: SeTakeOwnershipPrivilege	1292	conhost.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

rdmr_svchost.execonhost.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2188 wrote to memory of 1292	2188	rdmr_svchost.exe	conhost.exe
PID 2188 wrote to memory of 1292	2188	rdmr_svchost.exe	conhost.exe
PID 2188 wrote to memory of 1292	2188	rdmr_svchost.exe	conhost.exe
PID 1292 wrote to memory of 1916	1292	conhost.exe	cmd.exe
PID 1292 wrote to memory of 1916	1292	conhost.exe	cmd.exe
PID 1292 wrote to memory of 1916	1292	conhost.exe	cmd.exe
PID 1916 wrote to memory of 3332	1916	cmd.exe	vssadmin.exe
PID 1916 wrote to memory of 3332	1916	cmd.exe	vssadmin.exe
PID 1916 wrote to memory of 3332	1916	cmd.exe	vssadmin.exe
PID 1292 wrote to memory of 364	1292	conhost.exe	cmd.exe
PID 1292 wrote to memory of 364	1292	conhost.exe	cmd.exe
PID 1292 wrote to memory of 364	1292	conhost.exe	cmd.exe
PID 364 wrote to memory of 2624	364	cmd.exe	wevtutil.exe
PID 364 wrote to memory of 2624	364	cmd.exe	wevtutil.exe
PID 364 wrote to memory of 2624	364	cmd.exe	wevtutil.exe
PID 1292 wrote to memory of 2524	1292	conhost.exe	cmd.exe
PID 1292 wrote to memory of 2524	1292	conhost.exe	cmd.exe
PID 1292 wrote to memory of 2524	1292	conhost.exe	cmd.exe
PID 2524 wrote to memory of 1448	2524	cmd.exe	wevtutil.exe
PID 2524 wrote to memory of 1448	2524	cmd.exe	wevtutil.exe
PID 2524 wrote to memory of 1448	2524	cmd.exe	wevtutil.exe
PID 1292 wrote to memory of 3956	1292	conhost.exe	cmd.exe
PID 1292 wrote to memory of 3956	1292	conhost.exe	cmd.exe
PID 1292 wrote to memory of 3956	1292	conhost.exe	cmd.exe
PID 3956 wrote to memory of 2168	3956	cmd.exe	wevtutil.exe
PID 3956 wrote to memory of 2168	3956	cmd.exe	wevtutil.exe
PID 3956 wrote to memory of 2168	3956	cmd.exe	wevtutil.exe
PID 1292 wrote to memory of 1268	1292	conhost.exe	cmd.exe
PID 1292 wrote to memory of 1268	1292	conhost.exe	cmd.exe
PID 1292 wrote to memory of 1268	1292	conhost.exe	cmd.exe
PID 1268 wrote to memory of 1444	1268	cmd.exe	wevtutil.exe
PID 1268 wrote to memory of 1444	1268	cmd.exe	wevtutil.exe
PID 1268 wrote to memory of 1444	1268	cmd.exe	wevtutil.exe

C:\Users\Admin\AppData\Local\Temp\rdmr_svchost.exe
"C:\Users\Admin\AppData\Local\Temp\rdmr_svchost.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\WIN_TEMP\conhost.exe
"C:\Windows\WIN_TEMP\conhost.exe" C:\Users\Admin\AppData\Local\Temp\rdmr_svchost.exe
2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Deletes itself
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c vssadmin delete shadows /All /Quiet
3⤵
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:3332

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wevtutil clear-log Application
3⤵
- Suspicious use of WriteProcessMemory
PID:364

C:\Windows\SysWOW64\wevtutil.exe
wevtutil clear-log Application
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wevtutil clear-log Security
3⤵
- Suspicious use of WriteProcessMemory
PID:2524

C:\Windows\SysWOW64\wevtutil.exe
wevtutil clear-log Security
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wevtutil clear-log Setup
3⤵
- Suspicious use of WriteProcessMemory
PID:3956

C:\Windows\SysWOW64\wevtutil.exe
wevtutil clear-log Setup
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wevtutil clear-log System
3⤵
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\wevtutil.exe
wevtutil clear-log System
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:592

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal on Host

1

T1070

File Deletion

2

T1107

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\WIN_TEMP\conhost.exe
MD5
e37a0ece30267233f1dddf3c2300393f

SHA1
27610367c41c1b8d3a26885b40fd7aac748189b2

SHA256
bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d

SHA512
a0e5ceafb39f9ad3774d6a250646bae5f5595c1330bef3df7d448778ee519bc35ce221526c1a4d3db88107b5ccf1b465eef11e5b00cfc680bcdb9cea92ba87c2

Download Submit
C:\Windows\WIN_TEMP\conhost.exe
MD5
e37a0ece30267233f1dddf3c2300393f

SHA1
27610367c41c1b8d3a26885b40fd7aac748189b2

SHA256
bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d

SHA512
a0e5ceafb39f9ad3774d6a250646bae5f5595c1330bef3df7d448778ee519bc35ce221526c1a4d3db88107b5ccf1b465eef11e5b00cfc680bcdb9cea92ba87c2

Download Submit
memory/364-120-0x0000000000000000-mapping.dmp

Download
memory/1268-126-0x0000000000000000-mapping.dmp

Download
memory/1292-115-0x0000000000000000-mapping.dmp

Download
memory/1444-127-0x0000000000000000-mapping.dmp

Download
memory/1448-123-0x0000000000000000-mapping.dmp

Download
memory/1916-118-0x0000000000000000-mapping.dmp

Download
memory/2168-125-0x0000000000000000-mapping.dmp

Download
memory/2524-122-0x0000000000000000-mapping.dmp

Download
memory/2624-121-0x0000000000000000-mapping.dmp

Download
memory/3332-119-0x0000000000000000-mapping.dmp

Download
memory/3956-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads