Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    28-01-2022 18:44

General

  • Target

    b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe

  • Size

    3.0MB

  • MD5

    e722b64756034173c98ace2352df1904

  • SHA1

    8d01e508901935f31931fc9503de053f2a967d5c

  • SHA256

    b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111

  • SHA512

    219ba9831b59b206561cd039317e2ac6286dcee7d37fe98865fa40d7234ac664d1a51841dbea63d612ac925a7868e646d27c45efa080754de2638f92a005ef89

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • Blocklisted process makes network request 3 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe
    "C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\wet.vbs"
      2⤵
      • Blocklisted process makes network request
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:1556
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Roaming\Microsoft\install.cmd" /silent"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1864
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 9 localhost
          4⤵
          • Runs ping.exe
          PID:1108
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "sys" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe"
          4⤵
          • Adds Run key to start application
          PID:1260
        • C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:836
          • C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe -second
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:968
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:2024

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\install.cmd

    MD5

    9673756e6ab652046992df62a212d485

    SHA1

    3c8eeae1079d1121b4fadb60236e61c4c3d9e275

    SHA256

    bf626af13cdf1e1e39b498d095ec61c82ed956207317e23197e5d85f6355fa2a

    SHA512

    ead526cf9de7c6c394f88932140486f388b01b7d68a57754e080f175164350fc6bb886373ba51fa5e29016f59ad6c32ee65665b01c75ab00fc8088cb47019eba

  • C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

    MD5

    dd17e8305bc0be4c9d05579e1305c6b4

    SHA1

    9d6416c6e9536ff522c435e9b7e7be417d570b4d

    SHA256

    e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c

    SHA512

    5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d

  • C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

    MD5

    dd17e8305bc0be4c9d05579e1305c6b4

    SHA1

    9d6416c6e9536ff522c435e9b7e7be417d570b4d

    SHA256

    e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c

    SHA512

    5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d

  • C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

    MD5

    dd17e8305bc0be4c9d05579e1305c6b4

    SHA1

    9d6416c6e9536ff522c435e9b7e7be417d570b4d

    SHA256

    e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c

    SHA512

    5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d

  • C:\Users\Admin\AppData\Roaming\Microsoft\settings.dat

    MD5

    404c8d81670c30c9a5d537eb306fef3d

    SHA1

    ff81042232679f55ed0471a5ca735b4d03095624

    SHA256

    326696228d99f62e0c3702262db3d95a5c7169a748b616acaa282be2793baf97

    SHA512

    7fbad0a9d3668f09cf25142436d5386cf44c85147a2f5d075d07c1f0ac51588dce89df76d9b2f9266d5bbe8bd967f281947ec598ef5fcea6faeffecb4e3929fd

  • C:\Users\Admin\AppData\Roaming\Microsoft\wet.vbs

    MD5

    2ebafd87ca849c0e04d7c4cae8780a72

    SHA1

    014a39edd1f28a0ccf77fd80b22050cc4a1a58cd

    SHA256

    a074faad6e540c8b489577b973ac2bbcc364ffb69a6c9f35fc8733795c34f41c

    SHA512

    73fcd7572d34ecc9ecd63f57d2090a67bf0418816ac9f568149bdd569971545fc80b4248c8daddf6f2688bc1b0fec3ff8bdde3d7371f36b662a0b18cb9b18c12

  • \Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

    MD5

    dd17e8305bc0be4c9d05579e1305c6b4

    SHA1

    9d6416c6e9536ff522c435e9b7e7be417d570b4d

    SHA256

    e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c

    SHA512

    5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d

  • memory/756-54-0x0000000075531000-0x0000000075533000-memory.dmp

    Filesize

    8KB

  • memory/836-66-0x0000000000390000-0x0000000000391000-memory.dmp

    Filesize

    4KB

  • memory/836-67-0x0000000000F80000-0x0000000000F81000-memory.dmp

    Filesize

    4KB

  • memory/968-72-0x0000000004290000-0x0000000004291000-memory.dmp

    Filesize

    4KB

  • memory/968-74-0x00000000043B0000-0x00000000043B1000-memory.dmp

    Filesize

    4KB

  • memory/968-73-0x00000000042A0000-0x00000000042A1000-memory.dmp

    Filesize

    4KB

  • memory/968-70-0x00000000002F0000-0x00000000002F1000-memory.dmp

    Filesize

    4KB

  • memory/968-75-0x00000000056F0000-0x00000000056F1000-memory.dmp

    Filesize

    4KB

  • memory/968-79-0x0000000005580000-0x0000000005581000-memory.dmp

    Filesize

    4KB

  • memory/968-78-0x0000000005530000-0x0000000005531000-memory.dmp

    Filesize

    4KB

  • memory/968-77-0x00000000054E0000-0x00000000054E1000-memory.dmp

    Filesize

    4KB

  • memory/968-76-0x0000000005490000-0x0000000005491000-memory.dmp

    Filesize

    4KB

  • memory/968-81-0x0000000005990000-0x0000000005991000-memory.dmp

    Filesize

    4KB

  • memory/968-80-0x0000000005850000-0x0000000005870000-memory.dmp

    Filesize

    128KB

  • memory/968-82-0x0000000005A80000-0x0000000005A81000-memory.dmp

    Filesize

    4KB