Analysis

  • max time kernel
    141s
  • max time network
    167s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    28-01-2022 18:21

General

  • Target

    c986dc49d32ba8f0a0580ee06163562d9f6c5ad1969e21aa77db1641a819eab4.exe

  • Size

    3.0MB

  • MD5

    82b0862419c79ee25b934be588c7ce87

  • SHA1

    4da3cc133932f5e1b73e131d53b5fc4af642ba95

  • SHA256

    c986dc49d32ba8f0a0580ee06163562d9f6c5ad1969e21aa77db1641a819eab4

  • SHA512

    c75aa017af6dbe6ee3231e4abea4fb9a6ff9e7a38d23ffcabfafb85019307577279c9d1fc4e85e7540e4c1f0d7e3cfc276f3aab78b9d758f8b5e1dc8749b888e

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c986dc49d32ba8f0a0580ee06163562d9f6c5ad1969e21aa77db1641a819eab4.exe
    "C:\Users\Admin\AppData\Local\Temp\c986dc49d32ba8f0a0580ee06163562d9f6c5ad1969e21aa77db1641a819eab4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\wet.vbs"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:856
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Roaming\Microsoft\install.cmd" /silent"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1160
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 9 localhost
          4⤵
          • Runs ping.exe
          PID:1696
        • C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1180
          • C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe -second
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1480
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "sys" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe"
          4⤵
          • Adds Run key to start application
          PID:328

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\install.cmd

    MD5

    ad508eb4095f5a6041eb3cf37bd0e7d6

    SHA1

    6501ce523df29802bfc2c81e32bc8e98033958d6

    SHA256

    f2ecaefeee8b594292a7b5e64afc1f4f5dcc1c21aa7ad8a910dccbc0f5385876

    SHA512

    e0a64721ffd2bb30dec61bc1b63c148bb7289a63d5c1c6f151b0e79d6cf7181b22e76bea0c89b4882d83423727866e24087d9ee690ec3d939aca55666bc71ce5

  • C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

    MD5

    133852043c5bc42337579df1377dc425

    SHA1

    ae49521602846df51c8c5a9d08a4d3de8c207aee

    SHA256

    7b24f3dad3d4e9c0474ff34a98160ae52b3c9134757b834bebaeca6efa013493

    SHA512

    a5291691f625b369f5e75f24299dd2ac716f26ec5aa176d14bb765a1d732849565af60c652305b5b4c390694db2a8b61fb6a3d65665f6a4e9fab559a5a4ce327

  • C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

    MD5

    133852043c5bc42337579df1377dc425

    SHA1

    ae49521602846df51c8c5a9d08a4d3de8c207aee

    SHA256

    7b24f3dad3d4e9c0474ff34a98160ae52b3c9134757b834bebaeca6efa013493

    SHA512

    a5291691f625b369f5e75f24299dd2ac716f26ec5aa176d14bb765a1d732849565af60c652305b5b4c390694db2a8b61fb6a3d65665f6a4e9fab559a5a4ce327

  • C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

    MD5

    133852043c5bc42337579df1377dc425

    SHA1

    ae49521602846df51c8c5a9d08a4d3de8c207aee

    SHA256

    7b24f3dad3d4e9c0474ff34a98160ae52b3c9134757b834bebaeca6efa013493

    SHA512

    a5291691f625b369f5e75f24299dd2ac716f26ec5aa176d14bb765a1d732849565af60c652305b5b4c390694db2a8b61fb6a3d65665f6a4e9fab559a5a4ce327

  • C:\Users\Admin\AppData\Roaming\Microsoft\settings.dat

    MD5

    6e4dfa11271182f559b54e4d8fd496ab

    SHA1

    3265a9b2f3386f1b9a1904b7d674a4aee9937470

    SHA256

    96abb6e4fcb9d6ad3500fcc17c4f428fcb7dee3ec8074d8e5a278ce186989aa8

    SHA512

    3ce5a910fb6df23ea846cfbe859a40b36d32ad091d9b7cb86070f594de29c45736df8a9d7150c964f369cf1bcca23a07822c1a88936020572260829e01123d47

  • C:\Users\Admin\AppData\Roaming\Microsoft\wet.vbs

    MD5

    0d3eed47d75c9c7d3185e7b61d06652a

    SHA1

    ae2e913135d03cbc8f853321ef6b96906e1f6962

    SHA256

    0c592272859379c675f4f5f741fe3cb44c22ee137a7d601ac712c59e1a0f6041

    SHA512

    328766ce9996c34a740e8853f3df4fe384fa56a6032f6480e5e422daef87ddb957872a31b91174c4f2de13580f6e0669854b3b38d1536b62b02093fc1e14cae7

  • \Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

    MD5

    133852043c5bc42337579df1377dc425

    SHA1

    ae49521602846df51c8c5a9d08a4d3de8c207aee

    SHA256

    7b24f3dad3d4e9c0474ff34a98160ae52b3c9134757b834bebaeca6efa013493

    SHA512

    a5291691f625b369f5e75f24299dd2ac716f26ec5aa176d14bb765a1d732849565af60c652305b5b4c390694db2a8b61fb6a3d65665f6a4e9fab559a5a4ce327

  • memory/1180-66-0x0000000000400000-0x0000000000D80000-memory.dmp

    Filesize

    9.5MB

  • memory/1180-67-0x0000000002930000-0x0000000002931000-memory.dmp

    Filesize

    4KB

  • memory/1480-74-0x0000000004E40000-0x0000000004E41000-memory.dmp

    Filesize

    4KB

  • memory/1480-78-0x0000000005490000-0x0000000005491000-memory.dmp

    Filesize

    4KB

  • memory/1480-72-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

    Filesize

    4KB

  • memory/1480-84-0x0000000005CB0000-0x0000000005CB1000-memory.dmp

    Filesize

    4KB

  • memory/1480-73-0x0000000004BC0000-0x0000000004CD0000-memory.dmp

    Filesize

    1.1MB

  • memory/1480-76-0x0000000005550000-0x0000000005551000-memory.dmp

    Filesize

    4KB

  • memory/1480-75-0x00000000056A0000-0x00000000056A1000-memory.dmp

    Filesize

    4KB

  • memory/1480-70-0x0000000000D80000-0x0000000000D81000-memory.dmp

    Filesize

    4KB

  • memory/1480-77-0x0000000005440000-0x0000000005441000-memory.dmp

    Filesize

    4KB

  • memory/1480-79-0x00000000054E0000-0x00000000054E1000-memory.dmp

    Filesize

    4KB

  • memory/1480-80-0x00000000054F0000-0x00000000054F1000-memory.dmp

    Filesize

    4KB

  • memory/1480-81-0x0000000005540000-0x0000000005541000-memory.dmp

    Filesize

    4KB

  • memory/1480-82-0x0000000005900000-0x0000000005901000-memory.dmp

    Filesize

    4KB

  • memory/1480-83-0x00000000058B0000-0x00000000058B1000-memory.dmp

    Filesize

    4KB

  • memory/1660-55-0x0000000076141000-0x0000000076143000-memory.dmp

    Filesize

    8KB