Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    27-12-2021 15:22

General

  • Target

    10165E27E0DB0A6708F346DDEA657AB0409499F93EB84.exe

  • Size

    8.3MB

  • MD5

    cb2ffac2a251378cda3f91cd613f453d

  • SHA1

    3a028761638f5aa93b0719c5650c83a138e8abc9

  • SHA256

    10165e27e0db0a6708f346ddea657ab0409499f93eb8426a80864a966f0f401e

  • SHA512

    1d203540fde5074f0d57e1ecbd9af2ee862b940f8fb58c3e55ad9db5ba029aff82a4468eee24c760b5e55cc96e61244af0fd6f3c46db857824e13e45ec1e802f

Score
10/10

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 53 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10165E27E0DB0A6708F346DDEA657AB0409499F93EB84.exe
    "C:\Users\Admin\AppData\Local\Temp\10165E27E0DB0A6708F346DDEA657AB0409499F93EB84.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2784
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:760
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3.4ru_mod_mod.msi" /qn
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3084
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\killself.bat
        3⤵
          PID:400
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 215C803B90427C4D097C1CA5DB5D963F
        2⤵
        • Loads dropped DLL
        PID:4064
      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:504
      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall
        2⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2752
      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1204
    • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
      "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
        "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
        2⤵
        • Executes dropped EXE
        PID:1352
      • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
        "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1156
        • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
          "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: SetClipboardViewer
          PID:3100
    • C:\Windows\system32\compattelrunner.exe
      C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
      1⤵
        PID:1448

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Remote Manipulator System - Host\English.lg

        MD5

        bc25377ade68750b834c81fa71c233b8

        SHA1

        84dbb465dd2125f47668e2508e18af9bd6db2fd8

        SHA256

        9a48a7ea7ba2c2f33280d1e1722ebbc59bf81bc6c5a1f97edca53ea641ffd8e3

        SHA512

        205ab195339d7108adbe6dfabd48e4e21c5956ded587d7213a44618f0d34a43f7b8abaa7765b9d31695efacfc44beeb69fbaa3cb27c141b6a653713fdf5ebce5

      • C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll

        MD5

        2ddfa39f5c2fd3f00681ef2970617e4b

        SHA1

        8152aa18afbacf398b92168995ec8696d3fe3659

        SHA256

        f938bdc741ef1d2738b532aef001a160e3a3627ed8a27158b7017ee49fc65791

        SHA512

        f89f0f02cda650c138e4ebaef198f0762dfd571ef7d46a6b3710cd93d76bc52a79055c55afca46128a9a84a795a5cb946ca93c492e07cfb503c9b27d96211e20

      • C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll

        MD5

        3d0b27b3f8aa22575aa0faf0b2d67216

        SHA1

        39fc787538849692ed7352418616f467b7a86a1d

        SHA256

        d7782488ef29bf0fd7e8faf0bd24414a6540bf7366434692a5a485d5ae2d7d44

        SHA512

        19f0785d3cecce0dbbb7da1be640bffebe4daedc65a513d1db0b5e533eb96aaa0588831de74c88e5013c00405e03ca4188c4b633e39e6c49ab5c1d1b42191ca8

      • C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg

        MD5

        e44e34bc285b709f08f967325d9c8be1

        SHA1

        e73f05c6a980ec9d006930c5343955f89579b409

        SHA256

        1d99a7b5f7b3daa61fa773972b1e335aa09b92411484f6ddc99d2b2894455a5b

        SHA512

        576b292b6e9cf022822443e050994462a6cbd9a3c60063bae9f54c78a84e75e17bb5eddf7e259a22a9d93f757cb6536c503762e2a30e75091e40c2756cde8727

      • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

        MD5

        76ebe5fd077a62161d0ab560208b9f94

        SHA1

        614c218d35ba531f0bad791d52e5dcf57df5c742

        SHA256

        f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

        SHA512

        baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

      • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

        MD5

        76ebe5fd077a62161d0ab560208b9f94

        SHA1

        614c218d35ba531f0bad791d52e5dcf57df5c742

        SHA256

        f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

        SHA512

        baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

      • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

        MD5

        76ebe5fd077a62161d0ab560208b9f94

        SHA1

        614c218d35ba531f0bad791d52e5dcf57df5c742

        SHA256

        f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

        SHA512

        baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

      • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

        MD5

        76ebe5fd077a62161d0ab560208b9f94

        SHA1

        614c218d35ba531f0bad791d52e5dcf57df5c742

        SHA256

        f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b

        SHA512

        baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

        MD5

        c9704931d887685d96ce92d637d84045

        SHA1

        0875a71e9118ded121d92f3f46a3af1ec8380f8b

        SHA256

        0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

        SHA512

        3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

        MD5

        c9704931d887685d96ce92d637d84045

        SHA1

        0875a71e9118ded121d92f3f46a3af1ec8380f8b

        SHA256

        0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

        SHA512

        3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

        MD5

        c9704931d887685d96ce92d637d84045

        SHA1

        0875a71e9118ded121d92f3f46a3af1ec8380f8b

        SHA256

        0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

        SHA512

        3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

        MD5

        c9704931d887685d96ce92d637d84045

        SHA1

        0875a71e9118ded121d92f3f46a3af1ec8380f8b

        SHA256

        0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

        SHA512

        3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

        MD5

        c9704931d887685d96ce92d637d84045

        SHA1

        0875a71e9118ded121d92f3f46a3af1ec8380f8b

        SHA256

        0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

        SHA512

        3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

      • C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

        MD5

        292a1748850d1fdc91d4ec23b02d6902

        SHA1

        8f15f1c24e11c0b45b19c82a78f7b79b1e7f932d

        SHA256

        acf354ad6ed94e876b29a60c5870dd91e7b3f76cc82c1a862c92024a12404a9f

        SHA512

        cf7579f1169ec21d9bf3c666d416d3fe2a4f9953d4d328b182452e40043f91055d301fd4b4a21454b847dbdb0af6a61c52657caded7d6fd7e88812aceeacf704

      • C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

        MD5

        4570f7a40357016c97afe0dd4faf749b

        SHA1

        ebc8a1660f1103c655559caab3a70ec23ca187f1

        SHA256

        a5f008bf852d4c73e001f840d6f8b233c7d9bc9570cee639d40c1c8723bf99f8

        SHA512

        6b16979d004adc04259f2ce043cde6f7b57f2ddf5f4cea7bb390fd6b9fb273d22355b837f1b5c2eae77ea7df792de8e6db43e31d7246f044935a8187dace493b

      • C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll

        MD5

        038bf9f3a58560ad1130eeb85cdc1a87

        SHA1

        3571eb7293a2a3a5bf6eb21e1569cd151d995d1a

        SHA256

        d247afa3bd1ccc18e11eb099280802a61d3792a2018c476d95debf2091e9707d

        SHA512

        8ffa52b358841600b9122974079d22d4e11bc4214316cd85ac4d4af0e369112b6827029f74a9a9d3918db00c7fed3a9a1985e0b43da39783a748d78752ae2385

      • C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll

        MD5

        eeb2c52abbc7eb1c029b7fec45a7f22e

        SHA1

        8bfeb412614e3db0a2bf0122f4d68cc27b8c3a61

        SHA256

        c0f0b84d587066af8f80f41a7be63b4c01547af3f1e011602ac1b6ee0ac54a2c

        SHA512

        0b5b83335c6f602b8397a3c2ae6d1e661d744eb27114463d53e344bf18774ccb38853d314ebe05536d4c28c29fe3fdaba041a6a46983789f064ca70881cfcb85

      • C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll

        MD5

        e38372f576d927f525ef8e1a34b54664

        SHA1

        26af9d1db0a3f91d7fe13147e55f06c302d59389

        SHA256

        4046bd0b93909a41d0fd96f0405a864c79a47f493165546569251c1f73db6b0b

        SHA512

        78b7477b000407990304ec37624b873514d4ed9daa1b42fd988707b7374ffab442ba28fe19884724867f3f0f7a5f12f7fc8c228c050115c902d1569e4a3b13c7

      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

        MD5

        c9704931d887685d96ce92d637d84045

        SHA1

        0875a71e9118ded121d92f3f46a3af1ec8380f8b

        SHA256

        0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

        SHA512

        3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

        MD5

        c9704931d887685d96ce92d637d84045

        SHA1

        0875a71e9118ded121d92f3f46a3af1ec8380f8b

        SHA256

        0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826

        SHA512

        3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3.4ru_mod_mod.msi

        MD5

        998f9b9eefeddbfc898356139220bab3

        SHA1

        324bb9170598a73ce7f1359da7a35a6065f22f8e

        SHA256

        0230d36dc995c5fa25b6dd3f33c670fdf5f06c014a0b2d1012c064d733e9d81c

        SHA512

        efea0f628fca55733a29cd6c05aab11b8b4e49153d9ae94340daa00e5cb47f1ce4c2c2a3d9fea6108205fcb3a13ca13a4d533f47c561e8785f529d58c95f08e7

      • C:\Users\Admin\AppData\Local\Temp\killself.bat

        MD5

        2fe7ba7d9103012d8593f220508eaf6a

        SHA1

        fce4c84da7d0d97b46d494b15acbcd992b04f06a

        SHA256

        874044e21f5b7c8a7a2286f1a5c61693515153e73c019451f32a0df1bb910708

        SHA512

        9fb05799d464f26097c84d4b6dbb18de6de360f62a4373849fc6c7bc7348dc0738f702bcd3dbfa3bde4e1cb9275898ee33eb03706d419d2029a4a8fd3f983678

      • C:\Windows\Installer\MSIA51A.tmp

        MD5

        b0bcc622f1fff0eec99e487fa1a4ddd9

        SHA1

        49aa392454bd5869fa23794196aedc38e8eea6f5

        SHA256

        b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

        SHA512

        1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

      • \Windows\Installer\MSIA51A.tmp

        MD5

        b0bcc622f1fff0eec99e487fa1a4ddd9

        SHA1

        49aa392454bd5869fa23794196aedc38e8eea6f5

        SHA256

        b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

        SHA512

        1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

      • memory/400-142-0x0000000000000000-mapping.dmp

      • memory/504-135-0x00000000026C0000-0x00000000026C1000-memory.dmp

        Filesize

        4KB

      • memory/504-130-0x0000000000000000-mapping.dmp

      • memory/760-118-0x0000000000C40000-0x0000000000C63000-memory.dmp

        Filesize

        140KB

      • memory/760-115-0x0000000000000000-mapping.dmp

      • memory/1156-158-0x0000000000B10000-0x0000000000B11000-memory.dmp

        Filesize

        4KB

      • memory/1156-155-0x0000000000000000-mapping.dmp

      • memory/1160-141-0x00000000001F0000-0x00000000001F1000-memory.dmp

        Filesize

        4KB

      • memory/1204-140-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

        Filesize

        4KB

      • memory/1204-137-0x0000000000000000-mapping.dmp

      • memory/1352-154-0x0000000000000000-mapping.dmp

      • memory/1352-159-0x0000000000C70000-0x0000000000C71000-memory.dmp

        Filesize

        4KB

      • memory/2752-136-0x0000000000BE0000-0x0000000000D2A000-memory.dmp

        Filesize

        1.3MB

      • memory/2752-133-0x0000000000000000-mapping.dmp

      • memory/3036-124-0x000001D2269D0000-0x000001D2269D2000-memory.dmp

        Filesize

        8KB

      • memory/3036-123-0x000001D2269D0000-0x000001D2269D2000-memory.dmp

        Filesize

        8KB

      • memory/3084-119-0x0000000000000000-mapping.dmp

      • memory/3084-120-0x0000000000E10000-0x0000000000E11000-memory.dmp

        Filesize

        4KB

      • memory/3084-121-0x0000000000E10000-0x0000000000E11000-memory.dmp

        Filesize

        4KB

      • memory/3100-160-0x0000000000000000-mapping.dmp

      • memory/3100-162-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

        Filesize

        4KB

      • memory/4064-125-0x0000000000000000-mapping.dmp

      • memory/4064-126-0x0000000000140000-0x0000000000141000-memory.dmp

        Filesize

        4KB

      • memory/4064-127-0x0000000000140000-0x0000000000141000-memory.dmp

        Filesize

        4KB