Analysis
-
max time kernel
143s -
max time network
174s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 19:59
General
-
Target
7fe0d96783f4abc9a0204a9ce7e80e989b0a33678e1370e741d3ec6617fa1408.exe
-
Size
9.0MB
-
MD5
ff8470db2ed2f3804d46623e7167e9af
-
SHA1
44950816f281a32b13e271623de53c9e681b35a1
-
SHA256
7fe0d96783f4abc9a0204a9ce7e80e989b0a33678e1370e741d3ec6617fa1408
-
SHA512
2e52d11d23db8ea21f4715dc42d608d5a8a98d8a32375c89198292c207288f99a33fa1c805a6035d92cfc3ce2375c4c55c39df5dc3bd0848032f46525871af5f
Score
10/10
Malware Config
Signatures
-
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fe0d96783f4abc9a0204a9ce7e80e989b0a33678e1370e741d3ec6617fa1408.exe"C:\Users\Admin\AppData\Local\Temp\7fe0d96783f4abc9a0204a9ce7e80e989b0a33678e1370e741d3ec6617fa1408.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7fe0d96783f4abc9a0204a9ce7e80e989b0a33678e1370e741d3ec6617fa1408.exeC:\Users\Admin\AppData\Local\Temp\7fe0d96783f4abc9a0204a9ce7e80e989b0a33678e1370e741d3ec6617fa1408.exe -second2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB