Analysis

  • max time kernel
    157s
  • max time network
    155s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    28-01-2022 18:44

General

  • Target

    b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe

  • Size

    3.0MB

  • MD5

    e722b64756034173c98ace2352df1904

  • SHA1

    8d01e508901935f31931fc9503de053f2a967d5c

  • SHA256

    b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111

  • SHA512

    219ba9831b59b206561cd039317e2ac6286dcee7d37fe98865fa40d7234ac664d1a51841dbea63d612ac925a7868e646d27c45efa080754de2638f92a005ef89

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe
    "C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\wet.vbs"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:1336
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Microsoft\install.cmd" /silent"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:896
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 9 localhost
          4⤵
          • Runs ping.exe
          PID:1800
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "sys" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe"
          4⤵
          • Adds Run key to start application
          PID:2060
        • C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1404
          • C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe -second
            5⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1880
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:2148

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\install.cmd

    MD5

    9673756e6ab652046992df62a212d485

    SHA1

    3c8eeae1079d1121b4fadb60236e61c4c3d9e275

    SHA256

    bf626af13cdf1e1e39b498d095ec61c82ed956207317e23197e5d85f6355fa2a

    SHA512

    ead526cf9de7c6c394f88932140486f388b01b7d68a57754e080f175164350fc6bb886373ba51fa5e29016f59ad6c32ee65665b01c75ab00fc8088cb47019eba

  • C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

    MD5

    dd17e8305bc0be4c9d05579e1305c6b4

    SHA1

    9d6416c6e9536ff522c435e9b7e7be417d570b4d

    SHA256

    e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c

    SHA512

    5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d

  • C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

    MD5

    dd17e8305bc0be4c9d05579e1305c6b4

    SHA1

    9d6416c6e9536ff522c435e9b7e7be417d570b4d

    SHA256

    e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c

    SHA512

    5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d

  • C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

    MD5

    dd17e8305bc0be4c9d05579e1305c6b4

    SHA1

    9d6416c6e9536ff522c435e9b7e7be417d570b4d

    SHA256

    e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c

    SHA512

    5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d

  • C:\Users\Admin\AppData\Roaming\Microsoft\settings.dat

    MD5

    404c8d81670c30c9a5d537eb306fef3d

    SHA1

    ff81042232679f55ed0471a5ca735b4d03095624

    SHA256

    326696228d99f62e0c3702262db3d95a5c7169a748b616acaa282be2793baf97

    SHA512

    7fbad0a9d3668f09cf25142436d5386cf44c85147a2f5d075d07c1f0ac51588dce89df76d9b2f9266d5bbe8bd967f281947ec598ef5fcea6faeffecb4e3929fd

  • C:\Users\Admin\AppData\Roaming\Microsoft\wet.vbs

    MD5

    2ebafd87ca849c0e04d7c4cae8780a72

    SHA1

    014a39edd1f28a0ccf77fd80b22050cc4a1a58cd

    SHA256

    a074faad6e540c8b489577b973ac2bbcc364ffb69a6c9f35fc8733795c34f41c

    SHA512

    73fcd7572d34ecc9ecd63f57d2090a67bf0418816ac9f568149bdd569971545fc80b4248c8daddf6f2688bc1b0fec3ff8bdde3d7371f36b662a0b18cb9b18c12

  • memory/1880-210-0x00000000045F0000-0x00000000045F1000-memory.dmp

    Filesize

    4KB

  • memory/1880-211-0x0000000004700000-0x0000000004701000-memory.dmp

    Filesize

    4KB

  • memory/1880-204-0x00000000010C0000-0x00000000010C1000-memory.dmp

    Filesize

    4KB

  • memory/1880-213-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

    Filesize

    4KB

  • memory/1880-212-0x0000000004D60000-0x0000000004D61000-memory.dmp

    Filesize

    4KB

  • memory/1880-214-0x0000000005000000-0x0000000005001000-memory.dmp

    Filesize

    4KB

  • memory/1880-217-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

    Filesize

    4KB

  • memory/1880-216-0x0000000004D90000-0x0000000004D91000-memory.dmp

    Filesize

    4KB

  • memory/1880-218-0x0000000004E40000-0x0000000004E41000-memory.dmp

    Filesize

    4KB

  • memory/1880-219-0x0000000004E90000-0x0000000004E91000-memory.dmp

    Filesize

    4KB

  • memory/1880-220-0x0000000006DA0000-0x0000000006DA1000-memory.dmp

    Filesize

    4KB

  • memory/1880-221-0x0000000007220000-0x00000000072F1000-memory.dmp

    Filesize

    836KB

  • memory/1880-222-0x0000000007300000-0x00000000073D1000-memory.dmp

    Filesize

    836KB