Analysis

  • max time kernel
    158s
  • max time network
    156s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    28-01-2022 18:08

General

  • Target

    d3fdb4a525aaf8ba71d1afaa92271e33f609239e9bbd7995e47cb6081c924f45.exe

  • Size

    2.6MB

  • MD5

    88ab90e6a16bc6ce4bbe4e180bcc1cac

  • SHA1

    36380cf7e01662c1c83b7cce8b221334d10dc0dc

  • SHA256

    d3fdb4a525aaf8ba71d1afaa92271e33f609239e9bbd7995e47cb6081c924f45

  • SHA512

    6c749660f4e0ed9d403ec03259e44e3228016f57e5c93124becc07815b7c27aa27d737a3a2c8d8086e8233af590e99116e818a3175a983c41c690a0e023521ae

Score
10/10

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3fdb4a525aaf8ba71d1afaa92271e33f609239e9bbd7995e47cb6081c924f45.exe
    "C:\Users\Admin\AppData\Local\Temp\d3fdb4a525aaf8ba71d1afaa92271e33f609239e9bbd7995e47cb6081c924f45.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3704
    • C:\Users\Admin\AppData\Local\Temp\d3fdb4a525aaf8ba71d1afaa92271e33f609239e9bbd7995e47cb6081c924f45.exe
      C:\Users\Admin\AppData\Local\Temp\d3fdb4a525aaf8ba71d1afaa92271e33f609239e9bbd7995e47cb6081c924f45.exe -second
      2⤵
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:776

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/776-116-0x00000000010B0000-0x00000000010B1000-memory.dmp

    Filesize

    4KB

  • memory/3704-115-0x0000000002E80000-0x00000000030B0000-memory.dmp

    Filesize

    2.2MB