rms | 47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b

General

Target

47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe
Size

10.2MB
MD5

3da9ce1b9a0f22a68dc27c5050babcef
SHA1

20d50ae4b134f224b5c033888521f0bd62ccb712
SHA256

47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b
SHA512

ac888321de4c9e27d71d20cdba3b44114406add039393c5b244fdf2b29198c16dfdf53387a77a63abd87d959fc6d84eb3cbb19e4d5a7a5f12f63268856fc73ec

Score

10^/10

rms evasion rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 2 IoCs

pid	Process
688	sysdisk.exe
976	sysdisk.exe

Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00060000000125f3-56.dat	upx
behavioral1/files/0x00060000000125f3-57.dat	upx
behavioral1/files/0x00060000000125f3-59.dat	upx
behavioral1/files/0x00060000000125f3-60.dat	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\International\Geo\Nation	sysdisk.exe

Loads dropped DLL 3 IoCs

pid	Process
1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe
1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe
1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System64\vp8encoder.dll	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe
File created	C:\Windows\System64\vp8decoder.dll	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe
File created	C:\Windows\System64\sysdisk.exe	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
688	sysdisk.exe
688	sysdisk.exe
688	sysdisk.exe
688	sysdisk.exe
688	sysdisk.exe
976	sysdisk.exe
976	sysdisk.exe
976	sysdisk.exe
976	sysdisk.exe
1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe
1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	688	sysdisk.exe
Token: SeTakeOwnershipPrivilege	976	sysdisk.exe
Token: SeTcbPrivilege	976	sysdisk.exe
Token: SeTcbPrivilege	976	sysdisk.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe
1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe
688	sysdisk.exe
688	sysdisk.exe
688	sysdisk.exe
688	sysdisk.exe
976	sysdisk.exe
976	sysdisk.exe
976	sysdisk.exe
976	sysdisk.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 688	1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe	27
PID 1220 wrote to memory of 688	1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe	27
PID 1220 wrote to memory of 688	1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe	27
PID 1220 wrote to memory of 688	1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe	27
PID 1220 wrote to memory of 1484	1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe	29
PID 1220 wrote to memory of 1484	1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe	29
PID 1220 wrote to memory of 1484	1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe	29
PID 1220 wrote to memory of 1484	1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe	29
PID 1220 wrote to memory of 1400	1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe	30
PID 1220 wrote to memory of 1400	1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe	30
PID 1220 wrote to memory of 1400	1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe	30
PID 1220 wrote to memory of 1400	1220	47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe	30
PID 1484 wrote to memory of 1016	1484	cmd.exe	34
PID 1484 wrote to memory of 1016	1484	cmd.exe	34
PID 1484 wrote to memory of 1016	1484	cmd.exe	34
PID 1484 wrote to memory of 1016	1484	cmd.exe	34
PID 1400 wrote to memory of 1460	1400	cmd.exe	33
PID 1400 wrote to memory of 1460	1400	cmd.exe	33
PID 1400 wrote to memory of 1460	1400	cmd.exe	33
PID 1400 wrote to memory of 1460	1400	cmd.exe	33

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1460	attrib.exe
1016	attrib.exe

C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe
"C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\System64\sysdisk.exe
  "C:\Windows\System64\sysdisk.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:688
- - C:\Windows\System64\sysdisk.exe
    C:\Windows\System64\sysdisk.exe -second
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /K attrib +r +a +s +h C:\Users\Admin\AppData\Local\Temp\libeay32.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\attrib.exe
    attrib +r +a +s +h C:\Users\Admin\AppData\Local\Temp\libeay32.dll
    3⤵
    - Views/modifies file attributes
    PID:1016
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /K attrib +r +a +s +h C:\Users\Admin\AppData\Local\Temp\ssleay32.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\attrib.exe
    attrib +r +a +s +h C:\Users\Admin\AppData\Local\Temp\ssleay32.dll
    3⤵
    - Views/modifies file attributes
    PID:1460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/976-63-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1220-54-0x0000000076C61000-0x0000000076C63000-memory.dmp

Filesize
8KB

Download
memory/1220-55-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads