Overview

overview

10

Static

static

tmp/f82a89...MS.exe

windows7_x64

10

tmp/f82a89...MS.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    21-12-2021 11:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp/f82a8911-166d-479a-ade5-cfedc321e48d_RMS.exe

  • Size

    8.3MB

  • MD5

    cb2ffac2a251378cda3f91cd613f453d

  • SHA1

    3a028761638f5aa93b0719c5650c83a138e8abc9

  • SHA256

    10165e27e0db0a6708f346ddea657ab0409499f93eb8426a80864a966f0f401e

  • SHA512

    1d203540fde5074f0d57e1ecbd9af2ee862b940f8fb58c3e55ad9db5ba029aff82a4468eee24c760b5e55cc96e61244af0fd6f3c46db857824e13e45ec1e802f

Score
10/10
rmsdiscoveryrattrojan

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • Blocklisted process makes network request 4 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 53 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp\f82a8911-166d-479a-ade5-cfedc321e48d_RMS.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp\f82a8911-166d-479a-ade5-cfedc321e48d_RMS.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1284
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3.4ru_mod_mod.msi" /qn
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:684
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\killself.bat
        3⤵
          PID:1952
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:636
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 29F1B350180F826E89C7A7009D888FE6
        2⤵
        • Loads dropped DLL
        PID:956
      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3664
      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall
        2⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1192
      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1576
    • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
      "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2408
      • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
        "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
        2⤵
        • Executes dropped EXE
        PID:4068
      • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
        "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4064
        • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
          "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: SetClipboardViewer
          PID:4008
    • C:\Windows\system32\compattelrunner.exe
      C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
      1⤵
        PID:3548

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/636-123-0x000001B97BBC0000-0x000001B97BBC2000-memory.dmp

        Filesize

        8KB

        Download

      • memory/636-124-0x000001B97BBC0000-0x000001B97BBC2000-memory.dmp

        Filesize

        8KB

        Download

      • memory/684-121-0x0000000000220000-0x0000000000221000-memory.dmp

        Filesize

        4KB

        Download

      • memory/684-120-0x0000000000220000-0x0000000000221000-memory.dmp

        Filesize

        4KB

        Download

      • memory/956-127-0x0000000000D10000-0x0000000000D11000-memory.dmp

        Filesize

        4KB

        Download

      • memory/956-126-0x0000000000D10000-0x0000000000D11000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1192-136-0x00000000025C0000-0x00000000025C1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1284-118-0x0000000002800000-0x0000000002801000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1576-152-0x0000000000C10000-0x0000000000C11000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2408-153-0x00000000001E0000-0x00000000001E1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3664-135-0x0000000000AB0000-0x0000000000B5E000-memory.dmp

        Filesize

        696KB

        Download

      • memory/4008-162-0x0000000000AA0000-0x0000000000BEA000-memory.dmp

        Filesize

        1.3MB

        Download

      • memory/4064-158-0x00000000009B0000-0x0000000000A5E000-memory.dmp

        Filesize

        696KB

        Download

      • memory/4068-159-0x0000000000B50000-0x0000000000B51000-memory.dmp

        Filesize

        4KB

        Download