Malware Analysis Report

2024-11-30 19:46

Sample ID 220128-xdq4jabae6
Target b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111
SHA256 b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111
Tags
rms persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111

Threat Level: Known bad

The file b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111 was found to be: Known bad.

Malicious Activity Summary

rms persistence rat trojan upx

RMS

Executes dropped EXE

Blocklisted process makes network request

UPX packed file

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Enumerates physical storage devices

Runs ping.exe

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-28 18:44

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-28 18:44

Reported

2022-01-28 19:00

Platform

win7-en-20211208

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe"

Signatures

RMS

trojan rat rms

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\sys = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\rutserv.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Windows\SysWOW64\WScript.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Windows\SysWOW64\WScript.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Windows\SysWOW64\WScript.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 756 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe C:\Windows\SysWOW64\WScript.exe
PID 756 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe C:\Windows\SysWOW64\WScript.exe
PID 756 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe C:\Windows\SysWOW64\WScript.exe
PID 756 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe C:\Windows\SysWOW64\WScript.exe
PID 756 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe C:\Windows\SysWOW64\WScript.exe
PID 756 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe C:\Windows\SysWOW64\WScript.exe
PID 756 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe C:\Windows\SysWOW64\WScript.exe
PID 1556 wrote to memory of 1864 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1556 wrote to memory of 1864 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1556 wrote to memory of 1864 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1556 wrote to memory of 1864 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1556 wrote to memory of 1864 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1556 wrote to memory of 1864 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1556 wrote to memory of 1864 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1864 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1864 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1864 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1864 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1864 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1864 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1864 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1864 wrote to memory of 1260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1864 wrote to memory of 1260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1864 wrote to memory of 1260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1864 wrote to memory of 1260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1864 wrote to memory of 1260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1864 wrote to memory of 1260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1864 wrote to memory of 1260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1864 wrote to memory of 836 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
PID 1864 wrote to memory of 836 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
PID 1864 wrote to memory of 836 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
PID 1864 wrote to memory of 836 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
PID 1864 wrote to memory of 836 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
PID 1864 wrote to memory of 836 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
PID 1864 wrote to memory of 836 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
PID 1864 wrote to memory of 2024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1864 wrote to memory of 2024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1864 wrote to memory of 2024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1864 wrote to memory of 2024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1864 wrote to memory of 2024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1864 wrote to memory of 2024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1864 wrote to memory of 2024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe

"C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\wet.vbs"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\Microsoft\install.cmd" /silent"

C:\Windows\SysWOW64\PING.EXE

ping -n 9 localhost

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "sys" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe -second

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

memory/756-54-0x0000000075531000-0x0000000075533000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\wet.vbs

MD5 2ebafd87ca849c0e04d7c4cae8780a72
SHA1 014a39edd1f28a0ccf77fd80b22050cc4a1a58cd
SHA256 a074faad6e540c8b489577b973ac2bbcc364ffb69a6c9f35fc8733795c34f41c
SHA512 73fcd7572d34ecc9ecd63f57d2090a67bf0418816ac9f568149bdd569971545fc80b4248c8daddf6f2688bc1b0fec3ff8bdde3d7371f36b662a0b18cb9b18c12

C:\Users\Admin\AppData\Roaming\Microsoft\install.cmd

MD5 9673756e6ab652046992df62a212d485
SHA1 3c8eeae1079d1121b4fadb60236e61c4c3d9e275
SHA256 bf626af13cdf1e1e39b498d095ec61c82ed956207317e23197e5d85f6355fa2a
SHA512 ead526cf9de7c6c394f88932140486f388b01b7d68a57754e080f175164350fc6bb886373ba51fa5e29016f59ad6c32ee65665b01c75ab00fc8088cb47019eba

\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

MD5 dd17e8305bc0be4c9d05579e1305c6b4
SHA1 9d6416c6e9536ff522c435e9b7e7be417d570b4d
SHA256 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c
SHA512 5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d

C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

MD5 dd17e8305bc0be4c9d05579e1305c6b4
SHA1 9d6416c6e9536ff522c435e9b7e7be417d570b4d
SHA256 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c
SHA512 5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d

C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

MD5 dd17e8305bc0be4c9d05579e1305c6b4
SHA1 9d6416c6e9536ff522c435e9b7e7be417d570b4d
SHA256 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c
SHA512 5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d

memory/836-66-0x0000000000390000-0x0000000000391000-memory.dmp

memory/836-67-0x0000000000F80000-0x0000000000F81000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

MD5 dd17e8305bc0be4c9d05579e1305c6b4
SHA1 9d6416c6e9536ff522c435e9b7e7be417d570b4d
SHA256 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c
SHA512 5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d

memory/968-70-0x00000000002F0000-0x00000000002F1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\settings.dat

MD5 404c8d81670c30c9a5d537eb306fef3d
SHA1 ff81042232679f55ed0471a5ca735b4d03095624
SHA256 326696228d99f62e0c3702262db3d95a5c7169a748b616acaa282be2793baf97
SHA512 7fbad0a9d3668f09cf25142436d5386cf44c85147a2f5d075d07c1f0ac51588dce89df76d9b2f9266d5bbe8bd967f281947ec598ef5fcea6faeffecb4e3929fd

memory/968-74-0x00000000043B0000-0x00000000043B1000-memory.dmp

memory/968-73-0x00000000042A0000-0x00000000042A1000-memory.dmp

memory/968-72-0x0000000004290000-0x0000000004291000-memory.dmp

memory/968-75-0x00000000056F0000-0x00000000056F1000-memory.dmp

memory/968-79-0x0000000005580000-0x0000000005581000-memory.dmp

memory/968-78-0x0000000005530000-0x0000000005531000-memory.dmp

memory/968-77-0x00000000054E0000-0x00000000054E1000-memory.dmp

memory/968-76-0x0000000005490000-0x0000000005491000-memory.dmp

memory/968-81-0x0000000005990000-0x0000000005991000-memory.dmp

memory/968-80-0x0000000005850000-0x0000000005870000-memory.dmp

memory/968-82-0x0000000005A80000-0x0000000005A81000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-28 18:44

Reported

2022-01-28 19:00

Platform

win10-en-20211208

Max time kernel

157s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe"

Signatures

RMS

trojan rat rms

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\sys = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\rutserv.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall" C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2700 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe C:\Windows\SysWOW64\WScript.exe
PID 2700 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe C:\Windows\SysWOW64\WScript.exe
PID 2700 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe C:\Windows\SysWOW64\WScript.exe
PID 1336 wrote to memory of 896 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 896 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 896 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 896 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 896 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 896 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 896 wrote to memory of 2060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 896 wrote to memory of 2060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 896 wrote to memory of 2060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 896 wrote to memory of 1404 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
PID 896 wrote to memory of 1404 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
PID 896 wrote to memory of 1404 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
PID 896 wrote to memory of 2148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 896 wrote to memory of 2148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 896 wrote to memory of 2148 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe

"C:\Users\Admin\AppData\Local\Temp\b841d57bbf97cca0445878b8c938c3f6978dc52a42418c3e1db73a77c3cc3111.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\wet.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Microsoft\install.cmd" /silent"

C:\Windows\SysWOW64\PING.EXE

ping -n 9 localhost

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "sys" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe -second

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\wet.vbs

MD5 2ebafd87ca849c0e04d7c4cae8780a72
SHA1 014a39edd1f28a0ccf77fd80b22050cc4a1a58cd
SHA256 a074faad6e540c8b489577b973ac2bbcc364ffb69a6c9f35fc8733795c34f41c
SHA512 73fcd7572d34ecc9ecd63f57d2090a67bf0418816ac9f568149bdd569971545fc80b4248c8daddf6f2688bc1b0fec3ff8bdde3d7371f36b662a0b18cb9b18c12

C:\Users\Admin\AppData\Roaming\Microsoft\install.cmd

MD5 9673756e6ab652046992df62a212d485
SHA1 3c8eeae1079d1121b4fadb60236e61c4c3d9e275
SHA256 bf626af13cdf1e1e39b498d095ec61c82ed956207317e23197e5d85f6355fa2a
SHA512 ead526cf9de7c6c394f88932140486f388b01b7d68a57754e080f175164350fc6bb886373ba51fa5e29016f59ad6c32ee65665b01c75ab00fc8088cb47019eba

C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

MD5 dd17e8305bc0be4c9d05579e1305c6b4
SHA1 9d6416c6e9536ff522c435e9b7e7be417d570b4d
SHA256 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c
SHA512 5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d

C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

MD5 dd17e8305bc0be4c9d05579e1305c6b4
SHA1 9d6416c6e9536ff522c435e9b7e7be417d570b4d
SHA256 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c
SHA512 5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d

C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe

MD5 dd17e8305bc0be4c9d05579e1305c6b4
SHA1 9d6416c6e9536ff522c435e9b7e7be417d570b4d
SHA256 e300c4e9541550a95100b59b2b72a1652916b516b36b83d4a77b758e949c861c
SHA512 5bada9396df7381d511d0843ba744a15db02f1142166f184db2fcdd7dae384ffbf299c2735a7f358daa4a8f79ede6ce33cfa19a81a289278f6b5eb72cda8126d

memory/1880-204-0x00000000010C0000-0x00000000010C1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\settings.dat

MD5 404c8d81670c30c9a5d537eb306fef3d
SHA1 ff81042232679f55ed0471a5ca735b4d03095624
SHA256 326696228d99f62e0c3702262db3d95a5c7169a748b616acaa282be2793baf97
SHA512 7fbad0a9d3668f09cf25142436d5386cf44c85147a2f5d075d07c1f0ac51588dce89df76d9b2f9266d5bbe8bd967f281947ec598ef5fcea6faeffecb4e3929fd

memory/1880-211-0x0000000004700000-0x0000000004701000-memory.dmp

memory/1880-210-0x00000000045F0000-0x00000000045F1000-memory.dmp

memory/1880-213-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

memory/1880-212-0x0000000004D60000-0x0000000004D61000-memory.dmp

memory/1880-214-0x0000000005000000-0x0000000005001000-memory.dmp

memory/1880-217-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

memory/1880-216-0x0000000004D90000-0x0000000004D91000-memory.dmp

memory/1880-218-0x0000000004E40000-0x0000000004E41000-memory.dmp

memory/1880-219-0x0000000004E90000-0x0000000004E91000-memory.dmp

memory/1880-220-0x0000000006DA0000-0x0000000006DA1000-memory.dmp

memory/1880-221-0x0000000007220000-0x00000000072F1000-memory.dmp

memory/1880-222-0x0000000007300000-0x00000000073D1000-memory.dmp