rurat | ecf33d6d92b17040d558a7ad711be7e0b47fa2a09c99d9709b4a5324dca46e58

Analysis

max time kernel
157s
max time network
153s
platform
windows10_x64
resource
win10-en-20211208
submitted
28/01/2022, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ecf33d6d92b17040d558a7ad711be7e0b47fa2a09c99d9709b4a5324dca46e58.exe
Size 16.0MB
Sample220128-v793dshdgn
SHA256 ecf33d6d92b17040d558a7ad711be7e0b47fa2a09c99d9709b4a5324dca46e58
MD5 2abc0df260fa5f5f7950917d7e9c933e
SHA1 b5b61833088b6da6d0e86be17268d82272330981
SHA512 85afa11c7382a008b90a245fe2eb226721d82023a3efa8c0c2efafda6e5be7080d386778d49d17a3515666ec723ab03b10cac9c020a0ecd87f99d5108a674456
MD5 SHA1 SHA512

Score

10^/10

rurat backdoor discovery trojan

Malware Config

Signatures

RuRAT
RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.
trojan backdoor rurat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
17	3580	msiexec.exe

Executes dropped EXE 9 IoCs

pid	Process
3376	installer.exe
920	rfusclient.exe
372	rutserv.exe
1204	rutserv.exe
1536	rutserv.exe
2180	rutserv.exe
1336	rfusclient.exe
3556	rfusclient.exe
60	rfusclient.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation	installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation	rfusclient.exe

Loads dropped DLL 9 IoCs

pid	Process
1268	MsiExec.exe
372	rutserv.exe
372	rutserv.exe
1204	rutserv.exe
1204	rutserv.exe
1536	rutserv.exe
1536	rutserv.exe
2180	rutserv.exe
2180	rutserv.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_6D5B8E0D46046FC4C98A958D41A4CFB6	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_6D5B8E0D46046FC4C98A958D41A4CFB6	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C86BD7751D53F10F65AAAD66BBDF33C7	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	rutserv.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Remote Utilities - Host\Dutch.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupui.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Portuguese, Brazilian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\progress.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\VPDAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ruppm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rup.hlp	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\drvinstaller64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Chinese Simplified.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rup.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Italian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\English.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Spanish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Czech.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rup.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\uninstall.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rup.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\drvinstaller32.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup_s.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Logs\rut_log_2022-01.html	rutserv.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Hebrew.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\French.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupui2.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\lockscr.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Portuguese.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\srvinst.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup.ini	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\fwproc_x64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\install.cmd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Arabic.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\RWLN.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupui2.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rup.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x86\lockscr.cat	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rup.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Monitor\x64\lockscr.cat	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Swedish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Danish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\progress.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rup.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\German.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Norwegian.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\VPDAgent_x64.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rup.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Korean.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Turkish.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Chinese Traditional.lg	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rup_s.lng	msiexec.exe
File created	C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\srvinst_x64.exe	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f760a1e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1113.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File created	C:\Windows\Installer\{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	msiexec.exe
File created	C:\Windows\Installer\f760a1e.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1E4AB2FC-B243-45C2-BF6A-A027213183CD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1877.tmp	msiexec.exe
File created	C:\Windows\Installer\f760a21.msi	msiexec.exe
File created	C:\Windows\Installer\{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E	rutserv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RUT_{7EE4E7C0-2DC4-468D-AFA9-56E9E838E2E5}\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\Net\2 = "C:\\ProgramData\\Remote Utilities\\msi\\69014_{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CF2BA4E1342B2C54FBA60A72121338DC\RMS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\ProductName = "Remote Utilities - Host"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\AuthorizedLUAApp = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RUT_{7EE4E7C0-2DC4-468D-AFA9-56E9E838E2E5}\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CF2BA4E1342B2C54FBA60A72121338DC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\CF2BA4E1342B2C54FBA60A72121338DC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\PackageName = "host6.9_unsig6ned.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\PackageCode = "3C6C8D9720EF0DE47B255F5ABE742407"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\Version = "117381916"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\ProductIcon = "C:\\Windows\\Installer\\{1E4AB2FC-B243-45C2-BF6A-A027213183CD}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CF2BA4E1342B2C54FBA60A72121338DC\SourceList\Media\1 = "DISK1;1"	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
3376	installer.exe
3376	installer.exe
3376	installer.exe
3376	installer.exe
3376	installer.exe
3376	installer.exe
3376	installer.exe
3376	installer.exe
3580	msiexec.exe
3580	msiexec.exe
372	rutserv.exe
372	rutserv.exe
372	rutserv.exe
372	rutserv.exe
372	rutserv.exe
372	rutserv.exe
372	rutserv.exe
372	rutserv.exe
372	rutserv.exe
372	rutserv.exe
1204	rutserv.exe
1204	rutserv.exe
1204	rutserv.exe
1204	rutserv.exe
1204	rutserv.exe
1204	rutserv.exe
1536	rutserv.exe
1536	rutserv.exe
1536	rutserv.exe
1536	rutserv.exe
1536	rutserv.exe
1536	rutserv.exe
2180	rutserv.exe
2180	rutserv.exe
2180	rutserv.exe
2180	rutserv.exe
2180	rutserv.exe
2180	rutserv.exe
2180	rutserv.exe
2180	rutserv.exe
2180	rutserv.exe
2180	rutserv.exe
2180	rutserv.exe
2180	rutserv.exe
1336	rfusclient.exe
1336	rfusclient.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
60	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3164	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3164	msiexec.exe
Token: SeSecurityPrivilege	3580	msiexec.exe
Token: SeCreateTokenPrivilege	3164	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3164	msiexec.exe
Token: SeLockMemoryPrivilege	3164	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3164	msiexec.exe
Token: SeMachineAccountPrivilege	3164	msiexec.exe
Token: SeTcbPrivilege	3164	msiexec.exe
Token: SeSecurityPrivilege	3164	msiexec.exe
Token: SeTakeOwnershipPrivilege	3164	msiexec.exe
Token: SeLoadDriverPrivilege	3164	msiexec.exe
Token: SeSystemProfilePrivilege	3164	msiexec.exe
Token: SeSystemtimePrivilege	3164	msiexec.exe
Token: SeProfSingleProcessPrivilege	3164	msiexec.exe
Token: SeIncBasePriorityPrivilege	3164	msiexec.exe
Token: SeCreatePagefilePrivilege	3164	msiexec.exe
Token: SeCreatePermanentPrivilege	3164	msiexec.exe
Token: SeBackupPrivilege	3164	msiexec.exe
Token: SeRestorePrivilege	3164	msiexec.exe
Token: SeShutdownPrivilege	3164	msiexec.exe
Token: SeDebugPrivilege	3164	msiexec.exe
Token: SeAuditPrivilege	3164	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3164	msiexec.exe
Token: SeChangeNotifyPrivilege	3164	msiexec.exe
Token: SeRemoteShutdownPrivilege	3164	msiexec.exe
Token: SeUndockPrivilege	3164	msiexec.exe
Token: SeSyncAgentPrivilege	3164	msiexec.exe
Token: SeEnableDelegationPrivilege	3164	msiexec.exe
Token: SeManageVolumePrivilege	3164	msiexec.exe
Token: SeImpersonatePrivilege	3164	msiexec.exe
Token: SeCreateGlobalPrivilege	3164	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe
Token: SeRestorePrivilege	3580	msiexec.exe
Token: SeTakeOwnershipPrivilege	3580	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3556	rfusclient.exe
3556	rfusclient.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3556	rfusclient.exe
3556	rfusclient.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
3376	installer.exe
3376	installer.exe
3376	installer.exe
3376	installer.exe
372	rutserv.exe
372	rutserv.exe
372	rutserv.exe
372	rutserv.exe
1204	rutserv.exe
1204	rutserv.exe
1204	rutserv.exe
1204	rutserv.exe
1536	rutserv.exe
1536	rutserv.exe
1536	rutserv.exe
1536	rutserv.exe
2180	rutserv.exe
2180	rutserv.exe
2180	rutserv.exe
2180	rutserv.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 3376	2600	ecf33d6d92b17040d558a7ad711be7e0b47fa2a09c99d9709b4a5324dca46e58.exe	68
PID 2600 wrote to memory of 3376	2600	ecf33d6d92b17040d558a7ad711be7e0b47fa2a09c99d9709b4a5324dca46e58.exe	68
PID 2600 wrote to memory of 3376	2600	ecf33d6d92b17040d558a7ad711be7e0b47fa2a09c99d9709b4a5324dca46e58.exe	68
PID 3376 wrote to memory of 3164	3376	installer.exe	70
PID 3376 wrote to memory of 3164	3376	installer.exe	70
PID 3376 wrote to memory of 3164	3376	installer.exe	70
PID 3580 wrote to memory of 1268	3580	msiexec.exe	72
PID 3580 wrote to memory of 1268	3580	msiexec.exe	72
PID 3580 wrote to memory of 1268	3580	msiexec.exe	72
PID 3580 wrote to memory of 920	3580	msiexec.exe	73
PID 3580 wrote to memory of 920	3580	msiexec.exe	73
PID 3580 wrote to memory of 920	3580	msiexec.exe	73
PID 3580 wrote to memory of 372	3580	msiexec.exe	74
PID 3580 wrote to memory of 372	3580	msiexec.exe	74
PID 3580 wrote to memory of 372	3580	msiexec.exe	74
PID 3580 wrote to memory of 1204	3580	msiexec.exe	75
PID 3580 wrote to memory of 1204	3580	msiexec.exe	75
PID 3580 wrote to memory of 1204	3580	msiexec.exe	75
PID 3580 wrote to memory of 1536	3580	msiexec.exe	76
PID 3580 wrote to memory of 1536	3580	msiexec.exe	76
PID 3580 wrote to memory of 1536	3580	msiexec.exe	76
PID 3376 wrote to memory of 1824	3376	installer.exe	77
PID 3376 wrote to memory of 1824	3376	installer.exe	77
PID 3376 wrote to memory of 1824	3376	installer.exe	77
PID 2180 wrote to memory of 1336	2180	rutserv.exe	82
PID 2180 wrote to memory of 1336	2180	rutserv.exe	82
PID 2180 wrote to memory of 1336	2180	rutserv.exe	82
PID 2180 wrote to memory of 3556	2180	rutserv.exe	83
PID 2180 wrote to memory of 3556	2180	rutserv.exe	83
PID 2180 wrote to memory of 3556	2180	rutserv.exe	83
PID 1336 wrote to memory of 60	1336	rfusclient.exe	84
PID 1336 wrote to memory of 60	1336	rfusclient.exe	84
PID 1336 wrote to memory of 60	1336	rfusclient.exe	84

C:\Users\Admin\AppData\Local\Temp\ecf33d6d92b17040d558a7ad711be7e0b47fa2a09c99d9709b4a5324dca46e58.exe
"C:\Users\Admin\AppData\Local\Temp\ecf33d6d92b17040d558a7ad711be7e0b47fa2a09c99d9709b4a5324dca46e58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\RUT_{7EE4E7C0-2DC4-468D-AFA9-56E9E838E2E5}\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\RUT_{7EE4E7C0-2DC4-468D-AFA9-56E9E838E2E5}\installer.exe" -rsetup
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RUT_{7EE4E7C0-2DC4-468D-AFA9-56E9E838E2E5}\host6.9_unsig6ned.msi" /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\killself.bat
    3⤵
    PID:1824

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DBB975200E1D98514FEE571D16C59C8B
  2⤵
  - Loads dropped DLL
  PID:1268
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\RUT_{7EE4E7C0-2DC4-468D-AFA9-56E9E838E2E5}\host6.9_unsig6ned.msi"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:920
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:372
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1204
- C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1536

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious behavior: SetClipboardViewer
    PID:60
- C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3556

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:3236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/60-235-0x0000000000B70000-0x0000000000CBA000-memory.dmp

Download

memory/372-173-0x00000000015B0000-0x00000000015B1000-memory.dmp

Download

memory/920-152-0x0000000000C30000-0x0000000000C31000-memory.dmp

Download

memory/1204-177-0x0000000002E00000-0x00000000031D0000-memory.dmp

Download

memory/1336-229-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download

memory/1536-181-0x0000000002F63000-0x00000000030E0000-memory.dmp

Download

memory/2180-224-0x0000000004150000-0x0000000004151000-memory.dmp

Download

memory/2180-227-0x0000000002270000-0x0000000003670000-memory.dmp

Download

memory/2180-220-0x0000000002270000-0x0000000003670000-memory.dmp

Download

memory/2180-237-0x0000000003F10000-0x0000000003F11000-memory.dmp

Download

memory/2180-223-0x0000000004100000-0x0000000004101000-memory.dmp

Download

memory/2180-222-0x0000000002270000-0x00000000034C0000-memory.dmp

Download

memory/2180-186-0x0000000001270000-0x0000000001271000-memory.dmp

Download

memory/2180-225-0x0000000002270000-0x00000000034C0000-memory.dmp

Download

memory/2180-226-0x0000000002270000-0x0000000003670000-memory.dmp

Download

memory/2180-219-0x0000000002270000-0x00000000034C0000-memory.dmp

Download

memory/2180-228-0x0000000003A60000-0x0000000003A61000-memory.dmp

Download

memory/2180-217-0x0000000002270000-0x00000000034C0000-memory.dmp

Download

memory/2180-230-0x00000000041E0000-0x00000000041E1000-memory.dmp

Download

memory/2180-231-0x0000000004C80000-0x0000000004C81000-memory.dmp

Download

memory/2180-232-0x0000000004230000-0x0000000004231000-memory.dmp

Download

memory/2180-233-0x0000000005050000-0x0000000005051000-memory.dmp

Download

memory/2180-236-0x0000000003E80000-0x0000000003E86000-memory.dmp

Download

memory/2180-215-0x0000000002270000-0x00000000034C0000-memory.dmp

Download

memory/3376-117-0x0000000002F60000-0x00000000032F0000-memory.dmp

Download

memory/3556-221-0x0000000000B30000-0x0000000000C7A000-memory.dmp

Download