rms | a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd

General

Target

a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe
Size

14.6MB
MD5

c4890d57d4156c67975949591292e636
SHA1

f9b5e4bda938ca6caa483954ae898fed96b21892
SHA256

a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd
SHA512

b3680886615dbd586a77c8a9006de6df71710fb23f16d44450073234b8b5579ea01439bc9e81847baf6940f4eccf1a875135a6863e8de8e02d1fafb5316390dd

Score

10^/10

rms evasion persistence rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Executes dropped EXE 2 IoCs

pid	Process
608	sysdisk.exe
3984	sysdisk.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\International\Geo\Nation	sysdisk.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation = "C:\\Windows\\System64\\sysdisk.exe"	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System64\vp8encoder.dll	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe
File created	C:\Windows\System64\vp8decoder.dll	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe
File created	C:\Windows\System64\sysdisk.exe	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	sysdisk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall"	sysdisk.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3000	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
608	sysdisk.exe
608	sysdisk.exe
608	sysdisk.exe
608	sysdisk.exe
608	sysdisk.exe
608	sysdisk.exe
3984	sysdisk.exe
3984	sysdisk.exe
3984	sysdisk.exe
3984	sysdisk.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2804	powercfg.exe
Token: SeCreatePagefilePrivilege	2804	powercfg.exe
Token: SeShutdownPrivilege	2804	powercfg.exe
Token: SeCreatePagefilePrivilege	2804	powercfg.exe
Token: SeDebugPrivilege	608	sysdisk.exe
Token: SeTakeOwnershipPrivilege	3984	sysdisk.exe
Token: SeTcbPrivilege	3984	sysdisk.exe
Token: SeTcbPrivilege	3984	sysdisk.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe
2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe
608	sysdisk.exe
608	sysdisk.exe
608	sysdisk.exe
608	sysdisk.exe
3984	sysdisk.exe
3984	sysdisk.exe
3984	sysdisk.exe
3984	sysdisk.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 3200	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	71
PID 2240 wrote to memory of 3200	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	71
PID 2240 wrote to memory of 3200	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	71
PID 2240 wrote to memory of 3204	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	72
PID 2240 wrote to memory of 3204	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	72
PID 2240 wrote to memory of 3204	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	72
PID 2240 wrote to memory of 3000	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	75
PID 2240 wrote to memory of 3000	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	75
PID 2240 wrote to memory of 3000	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	75
PID 2240 wrote to memory of 2804	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	77
PID 2240 wrote to memory of 2804	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	77
PID 2240 wrote to memory of 2804	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	77
PID 2240 wrote to memory of 608	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	79
PID 2240 wrote to memory of 608	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	79
PID 2240 wrote to memory of 608	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	79
PID 2240 wrote to memory of 3100	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	82
PID 2240 wrote to memory of 3100	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	82
PID 2240 wrote to memory of 3100	2240	a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe	82

C:\Users\Admin\AppData\Local\Temp\a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe
"C:\Users\Admin\AppData\Local\Temp\a7bf090c6c00f0ed0aaaf53aa84ef1c08a2a85a59e4f3cc7d447178f284429dd.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall set opmode mode=disable
  2⤵
  PID:3200
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  PID:3204
- C:\Windows\SysWOW64\reg.exe
  reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:3000
- C:\Windows\SysWOW64\powercfg.exe
  powercfg.exe -h off
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2804
- C:\Windows\System64\sysdisk.exe
  "C:\Windows\System64\sysdisk.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:608
- - C:\Windows\System64\sysdisk.exe
    C:\Windows\System64\sysdisk.exe -second
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.cmd" "
  2⤵
  PID:3100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/608-122-0x0000000004660000-0x0000000004661000-memory.dmp

Filesize
4KB

Download
memory/608-121-0x0000000002DA3000-0x0000000003000000-memory.dmp

Filesize
2.4MB

Download
memory/2240-118-0x0000000003010000-0x0000000003011000-memory.dmp

Filesize
4KB

Download
memory/3984-130-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/3984-136-0x0000000006EA0000-0x0000000006EA1000-memory.dmp

Filesize
4KB

Download
memory/3984-129-0x0000000004930000-0x0000000004931000-memory.dmp

Filesize
4KB

Download
memory/3984-128-0x00000000045D0000-0x00000000045D1000-memory.dmp

Filesize
4KB

Download
memory/3984-127-0x0000000004580000-0x0000000004581000-memory.dmp

Filesize
4KB

Download
memory/3984-132-0x00000000045A0000-0x00000000045A1000-memory.dmp

Filesize
4KB

Download
memory/3984-133-0x00000000045B0000-0x00000000045B1000-memory.dmp

Filesize
4KB

Download
memory/3984-131-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/3984-135-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/3984-134-0x00000000045C0000-0x00000000045C1000-memory.dmp

Filesize
4KB

Download
memory/3984-137-0x00000000070A0000-0x00000000070A1000-memory.dmp

Filesize
4KB

Download
memory/3984-138-0x0000000007330000-0x0000000007331000-memory.dmp

Filesize
4KB

Download
memory/3984-139-0x0000000007340000-0x0000000007341000-memory.dmp

Filesize
4KB

Download
memory/3984-124-0x0000000002C74000-0x0000000002EB0000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads