Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-12-2021 10:49
Static task
static1
Behavioral task
behavioral1
Sample
tmp/RMS2.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
tmp/RMS2.exe
-
Size
8.3MB
-
MD5
73f351beae5c881fafe36f42cde9a47c
-
SHA1
dc1425cfd5569bd59f5d56432df875b59da9300b
-
SHA256
a028816d9741540c6184091b4ae3c4e42b104f90fe3b17a55d0e4aa4c4c43824
-
SHA512
f484b1260e73b3717603cfcfd62e820502480d8be57a7570e6c38612c9ea86b9335c6a42742fbdb369a37fcd5ec4c2b06f426a075582c39639128ad7be92da66
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 3 1072 msiexec.exe 5 1072 msiexec.exe 7 1072 msiexec.exe -
Executes dropped EXE 8 IoCs
pid Process 1428 installer.exe 1532 rutserv.exe 1088 rutserv.exe 1720 rutserv.exe 1788 rutserv.exe 2044 rfusclient.exe 1700 rfusclient.exe 1056 rfusclient.exe -
Loads dropped DLL 4 IoCs
pid Process 1588 RMS2.exe 1092 MsiExec.exe 1788 rutserv.exe 1788 rutserv.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in Program Files directory 53 IoCs
description ioc Process File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms_s.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\srvinst_x64.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms_s.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.ini msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\VPDAgent_x64.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\SampleClient.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\srvinst.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\progress.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\uninstall.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmspm.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui2.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\progress.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui2.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\uninstall.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.hlp msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\English.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmspm.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\install.cmd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.lng msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\fwproc.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.hlp msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\VPDAgent.exe msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.ini msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll msiexec.exe File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\install.cmd msiexec.exe -
Drops file in Windows directory 18 IoCs
description ioc Process File created C:\Windows\Installer\f75e13b.msi msiexec.exe File opened for modification C:\Windows\Installer\f75e13b.msi msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe File opened for modification C:\Windows\Installer\f75e13d.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIED95.tmp msiexec.exe File created C:\Windows\Installer\f75e13f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE7F9.tmp msiexec.exe File created C:\Windows\Installer\f75e13d.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe msiexec.exe File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E msiexec.exe -
Modifies registry class 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\PackageCode = "EE22CCA5812A64F4CB23B29D2A4A798E" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\1 = "DISK1;1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9\RMS msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Version = "115998720" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductIcon = "C:\\Windows\\Installer\\{D9E14363-FD66-419D-9DC9-C62471755C9F}\\ARPPRODUCTICON.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\PackageName = "rms.host6.3ru_mod.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductName = "Remote Manipulator System - Host" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Language = "1049" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1428 installer.exe 1428 installer.exe 1428 installer.exe 1428 installer.exe 1428 installer.exe 1428 installer.exe 1072 msiexec.exe 1072 msiexec.exe 1532 rutserv.exe 1532 rutserv.exe 1532 rutserv.exe 1532 rutserv.exe 1088 rutserv.exe 1088 rutserv.exe 1720 rutserv.exe 1720 rutserv.exe 1788 rutserv.exe 1788 rutserv.exe 1788 rutserv.exe 1788 rutserv.exe 2044 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 3 IoCs
pid Process 1700 rfusclient.exe 1700 rfusclient.exe 1056 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 432 msiexec.exe Token: SeIncreaseQuotaPrivilege 432 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe Token: SeSecurityPrivilege 1072 msiexec.exe Token: SeCreateTokenPrivilege 432 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 432 msiexec.exe Token: SeLockMemoryPrivilege 432 msiexec.exe Token: SeIncreaseQuotaPrivilege 432 msiexec.exe Token: SeMachineAccountPrivilege 432 msiexec.exe Token: SeTcbPrivilege 432 msiexec.exe Token: SeSecurityPrivilege 432 msiexec.exe Token: SeTakeOwnershipPrivilege 432 msiexec.exe Token: SeLoadDriverPrivilege 432 msiexec.exe Token: SeSystemProfilePrivilege 432 msiexec.exe Token: SeSystemtimePrivilege 432 msiexec.exe Token: SeProfSingleProcessPrivilege 432 msiexec.exe Token: SeIncBasePriorityPrivilege 432 msiexec.exe Token: SeCreatePagefilePrivilege 432 msiexec.exe Token: SeCreatePermanentPrivilege 432 msiexec.exe Token: SeBackupPrivilege 432 msiexec.exe Token: SeRestorePrivilege 432 msiexec.exe Token: SeShutdownPrivilege 432 msiexec.exe Token: SeDebugPrivilege 432 msiexec.exe Token: SeAuditPrivilege 432 msiexec.exe Token: SeSystemEnvironmentPrivilege 432 msiexec.exe Token: SeChangeNotifyPrivilege 432 msiexec.exe Token: SeRemoteShutdownPrivilege 432 msiexec.exe Token: SeUndockPrivilege 432 msiexec.exe Token: SeSyncAgentPrivilege 432 msiexec.exe Token: SeEnableDelegationPrivilege 432 msiexec.exe Token: SeManageVolumePrivilege 432 msiexec.exe Token: SeImpersonatePrivilege 432 msiexec.exe Token: SeCreateGlobalPrivilege 432 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe Token: SeRestorePrivilege 1072 msiexec.exe Token: SeTakeOwnershipPrivilege 1072 msiexec.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1428 installer.exe 1532 rutserv.exe 1088 rutserv.exe 1720 rutserv.exe 1788 rutserv.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 1588 wrote to memory of 1428 1588 RMS2.exe 27 PID 1588 wrote to memory of 1428 1588 RMS2.exe 27 PID 1588 wrote to memory of 1428 1588 RMS2.exe 27 PID 1588 wrote to memory of 1428 1588 RMS2.exe 27 PID 1588 wrote to memory of 1428 1588 RMS2.exe 27 PID 1588 wrote to memory of 1428 1588 RMS2.exe 27 PID 1588 wrote to memory of 1428 1588 RMS2.exe 27 PID 1428 wrote to memory of 432 1428 installer.exe 28 PID 1428 wrote to memory of 432 1428 installer.exe 28 PID 1428 wrote to memory of 432 1428 installer.exe 28 PID 1428 wrote to memory of 432 1428 installer.exe 28 PID 1428 wrote to memory of 432 1428 installer.exe 28 PID 1428 wrote to memory of 432 1428 installer.exe 28 PID 1428 wrote to memory of 432 1428 installer.exe 28 PID 1072 wrote to memory of 1092 1072 msiexec.exe 30 PID 1072 wrote to memory of 1092 1072 msiexec.exe 30 PID 1072 wrote to memory of 1092 1072 msiexec.exe 30 PID 1072 wrote to memory of 1092 1072 msiexec.exe 30 PID 1072 wrote to memory of 1092 1072 msiexec.exe 30 PID 1072 wrote to memory of 1092 1072 msiexec.exe 30 PID 1072 wrote to memory of 1092 1072 msiexec.exe 30 PID 1072 wrote to memory of 1532 1072 msiexec.exe 31 PID 1072 wrote to memory of 1532 1072 msiexec.exe 31 PID 1072 wrote to memory of 1532 1072 msiexec.exe 31 PID 1072 wrote to memory of 1532 1072 msiexec.exe 31 PID 1072 wrote to memory of 1088 1072 msiexec.exe 32 PID 1072 wrote to memory of 1088 1072 msiexec.exe 32 PID 1072 wrote to memory of 1088 1072 msiexec.exe 32 PID 1072 wrote to memory of 1088 1072 msiexec.exe 32 PID 1072 wrote to memory of 1720 1072 msiexec.exe 33 PID 1072 wrote to memory of 1720 1072 msiexec.exe 33 PID 1072 wrote to memory of 1720 1072 msiexec.exe 33 PID 1072 wrote to memory of 1720 1072 msiexec.exe 33 PID 1428 wrote to memory of 848 1428 installer.exe 35 PID 1428 wrote to memory of 848 1428 installer.exe 35 PID 1428 wrote to memory of 848 1428 installer.exe 35 PID 1428 wrote to memory of 848 1428 installer.exe 35 PID 1788 wrote to memory of 1700 1788 rutserv.exe 38 PID 1788 wrote to memory of 1700 1788 rutserv.exe 38 PID 1788 wrote to memory of 1700 1788 rutserv.exe 38 PID 1788 wrote to memory of 1700 1788 rutserv.exe 38 PID 1788 wrote to memory of 2044 1788 rutserv.exe 37 PID 1788 wrote to memory of 2044 1788 rutserv.exe 37 PID 1788 wrote to memory of 2044 1788 rutserv.exe 37 PID 1788 wrote to memory of 2044 1788 rutserv.exe 37 PID 2044 wrote to memory of 1056 2044 rfusclient.exe 39 PID 2044 wrote to memory of 1056 2044 rfusclient.exe 39 PID 2044 wrote to memory of 1056 2044 rfusclient.exe 39 PID 2044 wrote to memory of 1056 2044 rfusclient.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp\RMS2.exe"C:\Users\Admin\AppData\Local\Temp\tmp\RMS2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi" /qn3⤵
- Suspicious use of AdjustPrivilegeToken
PID:432
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\killself.bat3⤵PID:848
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3357855EE9C038344D7DDF5363BB0E152⤵
- Loads dropped DLL
PID:1092
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1532
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1088
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1720
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:1056
-
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray2⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:1700
-