Analysis

  • max time kernel
    163s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    28-01-2022 17:49

General

  • Target

    e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe

  • Size

    2.7MB

  • MD5

    dd17e8305bc0be4c9d05579e1305c6b4

  • SHA1

    9d6416c6e9536ff522c435e9b7e7be417d570b4d

  • SHA256

    e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c

  • SHA512

    5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d

Score
10/10

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe
    "C:\Users\Admin\AppData\Local\Temp\e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3620
    • C:\Users\Admin\AppData\Local\Temp\e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe
      C:\Users\Admin\AppData\Local\Temp\e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c.exe -second
      2⤵
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4188

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3620-118-0x0000000001100000-0x0000000001101000-memory.dmp

    Filesize

    4KB

  • memory/3620-119-0x0000000001510000-0x0000000001511000-memory.dmp

    Filesize

    4KB

  • memory/4188-120-0x00000000012C0000-0x00000000012C1000-memory.dmp

    Filesize

    4KB

  • memory/4188-122-0x0000000004600000-0x0000000004601000-memory.dmp

    Filesize

    4KB

  • memory/4188-123-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

    Filesize

    4KB

  • memory/4188-121-0x00000000045F0000-0x00000000045F1000-memory.dmp

    Filesize

    4KB

  • memory/4188-124-0x0000000005010000-0x0000000005011000-memory.dmp

    Filesize

    4KB

  • memory/4188-125-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

    Filesize

    4KB

  • memory/4188-126-0x0000000004E00000-0x0000000004E01000-memory.dmp

    Filesize

    4KB

  • memory/4188-127-0x0000000004E50000-0x0000000004E51000-memory.dmp

    Filesize

    4KB

  • memory/4188-128-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

    Filesize

    4KB

  • memory/4188-129-0x0000000006DB0000-0x0000000006DB1000-memory.dmp

    Filesize

    4KB

  • memory/4188-130-0x0000000007380000-0x0000000007381000-memory.dmp

    Filesize

    4KB

  • memory/4188-131-0x0000000007230000-0x0000000007301000-memory.dmp

    Filesize

    836KB