rms | 8b4e974a65677792d97fdcb35bba28c1e961b6b32c99b4baa81bfdd7c85348bd

General

Target

00349c28a5f82e5617e4ca2410cc4b21.exe
Size

5.4MB
MD5

00349c28a5f82e5617e4ca2410cc4b21
SHA1

916eacdc0c0b2c7f7d1ebae963d8edda8631e424
SHA256

8b4e974a65677792d97fdcb35bba28c1e961b6b32c99b4baa81bfdd7c85348bd
SHA512

f93ce4a93204e4a7410f553bf2af3ade1d6afb3d8509a2b1bb01bfef3645a1e68c6b3594142ed8b2681003941aa8913822d0910652e4da4dbbe8f42b5495a89e

Score

10^/10

rms rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 2 IoCs

pid	Process
1472	biztool.exe
108	biztool.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	biztool.exe

Loads dropped DLL 9 IoCs

pid	Process
612	00349c28a5f82e5617e4ca2410cc4b21.exe
612	00349c28a5f82e5617e4ca2410cc4b21.exe
612	00349c28a5f82e5617e4ca2410cc4b21.exe
612	00349c28a5f82e5617e4ca2410cc4b21.exe
612	00349c28a5f82e5617e4ca2410cc4b21.exe
1472	biztool.exe
1472	biztool.exe
108	biztool.exe
108	biztool.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\hardware\description\system\centralProcessor\2	biztool.exe
Key opened	\REGISTRY\MACHINE\hardware\description\system\centralProcessor\0	biztool.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	biztool.exe
Key opened	\REGISTRY\MACHINE\hardware\description\system\centralProcessor\16	biztool.exe
Key opened	\REGISTRY\MACHINE\hardware\description\system\centralProcessor\1	biztool.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	biztool.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1472	biztool.exe
1472	biztool.exe
1472	biztool.exe
1472	biztool.exe
1472	biztool.exe
1472	biztool.exe
1472	biztool.exe
1472	biztool.exe
108	biztool.exe
108	biztool.exe
108	biztool.exe
108	biztool.exe
108	biztool.exe
108	biztool.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	biztool.exe
Token: SeDebugPrivilege	1472	biztool.exe
Token: SeTakeOwnershipPrivilege	108	biztool.exe
Token: SeTcbPrivilege	108	biztool.exe
Token: SeTcbPrivilege	108	biztool.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1472	biztool.exe
1472	biztool.exe
1472	biztool.exe
1472	biztool.exe
108	biztool.exe
108	biztool.exe
108	biztool.exe
108	biztool.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 1472	612	00349c28a5f82e5617e4ca2410cc4b21.exe	28
PID 612 wrote to memory of 1472	612	00349c28a5f82e5617e4ca2410cc4b21.exe	28
PID 612 wrote to memory of 1472	612	00349c28a5f82e5617e4ca2410cc4b21.exe	28
PID 612 wrote to memory of 1472	612	00349c28a5f82e5617e4ca2410cc4b21.exe	28

C:\Users\Admin\AppData\Local\Temp\00349c28a5f82e5617e4ca2410cc4b21.exe
"C:\Users\Admin\AppData\Local\Temp\00349c28a5f82e5617e4ca2410cc4b21.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:612
- C:\Users\Public\Business Utilities\biztool.exe
  "C:\Users\Public\Business Utilities\biztool.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1472
- - C:\Users\Public\Business Utilities\biztool.exe
    "C:\Users\Public\Business Utilities\biztool.exe" -run_agent -second
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-88-0x0000000006180000-0x0000000006181000-memory.dmp

Filesize
4KB

Download
memory/108-84-0x0000000005A70000-0x0000000005A71000-memory.dmp

Filesize
4KB

Download
memory/108-79-0x0000000004B60000-0x0000000004B61000-memory.dmp

Filesize
4KB

Download
memory/108-91-0x0000000003640000-0x000000000379C000-memory.dmp

Filesize
1.4MB

Download
memory/108-81-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download
memory/108-87-0x0000000006710000-0x0000000006711000-memory.dmp

Filesize
4KB

Download
memory/108-78-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/108-83-0x0000000005A60000-0x0000000005A61000-memory.dmp

Filesize
4KB

Download
memory/108-90-0x00000000073B0000-0x00000000073B1000-memory.dmp

Filesize
4KB

Download
memory/108-89-0x0000000007210000-0x0000000007211000-memory.dmp

Filesize
4KB

Download
memory/108-80-0x0000000004B80000-0x0000000004B81000-memory.dmp

Filesize
4KB

Download
memory/108-82-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/108-85-0x0000000005E60000-0x0000000005E61000-memory.dmp

Filesize
4KB

Download
memory/108-86-0x0000000005E70000-0x0000000005E71000-memory.dmp

Filesize
4KB

Download
memory/612-58-0x0000000000620000-0x0000000000651000-memory.dmp

Filesize
196KB

Download
memory/612-54-0x0000000075821000-0x0000000075823000-memory.dmp

Filesize
8KB

Download
memory/1472-67-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1472-74-0x00000000031F0000-0x00000000031F1000-memory.dmp

Filesize
4KB

Download
memory/1472-77-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads