Overview

overview

10

Static

static

8e63f9781e...bc.exe

windows7_x64

10

8e63f9781e...bc.exe

windows10_x64

10

Analysis

  • max time kernel
    125s
  • max time network
    120s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    25-11-2021 11:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8e63f9781e37269e3c4aea0f6266aa01154dc3491c5154267fda828d41e23abc.exe

  • Size

    17.1MB

  • MD5

    4998446e6c16d36185faa040c6ea659a

  • SHA1

    18828e72224bff71730ad7e90952d7d3b0a53293

  • SHA256

    8e63f9781e37269e3c4aea0f6266aa01154dc3491c5154267fda828d41e23abc

  • SHA512

    4db58e144acec3471ba9f007577b6e2f296394c520a02527ed5209563b122938214cc3c201021eb53cea49f681203ecf1c8c37629a678bb15e8d1a7ebed78fde

Score
10/10
rmsrattrojan

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e63f9781e37269e3c4aea0f6266aa01154dc3491c5154267fda828d41e23abc.exe
    "C:\Users\Admin\AppData\Local\Temp\8e63f9781e37269e3c4aea0f6266aa01154dc3491c5154267fda828d41e23abc.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2680
    • C:\Users\Admin\AppData\Local\Temp\8e63f9781e37269e3c4aea0f6266aa01154dc3491c5154267fda828d41e23abc.exe
      C:\Users\Admin\AppData\Local\Temp\8e63f9781e37269e3c4aea0f6266aa01154dc3491c5154267fda828d41e23abc.exe -run_agent -second
      2⤵
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3956

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2680-115-0x0000000001D50000-0x0000000001D51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2680-116-0x0000000004E60000-0x0000000004E61000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2680-117-0x0000000004E70000-0x0000000004E71000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3956-118-0x0000000001670000-0x00000000017BA000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3956-119-0x0000000005300000-0x0000000005301000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3956-120-0x0000000005450000-0x0000000005451000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3956-121-0x0000000005460000-0x0000000005461000-memory.dmp

    Filesize

    4KB

    Download