rms | 36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216

Analysis

max time kernel
161s
max time network
151s
platform
windows7_x64
resource
win7-en-20211208
submitted
28-01-2022 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216.exe
Size

4.2MB
MD5

946142c3d34b736bbc890fa64ae09efe
SHA1

421f52733d334be32c899670426c06cb72d92cde
SHA256

36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216
SHA512

e9088eea723f732ba1a19ee1d81b09b0c5e3442a6c8cd2f537c86060548acb936bdcfa4c14ecde34a223bd72ed3776c887691af2afa781950a26181b13906d54

Score

10^/10

rms rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 9 IoCs

pid	Process
900	winchk32.exe
660	winchk32.exe
956	winchk32.exe
1388	winchk32.exe
1732	winchk64.exe
1200	Explorer.EXE
756	rutserv.exe
1548	rutserv.exe
1588	rfusclient.exe

Loads dropped DLL 9 IoCs

pid	Process
1568	36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216.exe
1568	36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216.exe
1568	36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216.exe
900	winchk32.exe
1048	cmd.exe
956	winchk32.exe
848	cmd.exe
1860	cmd.exe
1548	rutserv.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 660	900	winchk32.exe	28
PID 956 set thread context of 1388	956	winchk32.exe	35

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
660	winchk32.exe
660	winchk32.exe
660	winchk32.exe
660	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe
1388	winchk32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1264	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	660	winchk32.exe
Token: SeDebugPrivilege	1388	winchk32.exe
Token: SeDebugPrivilege	1732	winchk64.exe
Token: SeDebugPrivilege	756	rutserv.exe
Token: SeTakeOwnershipPrivilege	1548	rutserv.exe
Token: SeTcbPrivilege	1548	rutserv.exe
Token: SeTcbPrivilege	1548	rutserv.exe
Token: SeShutdownPrivilege	1200	Explorer.EXE
Token: SeShutdownPrivilege	1200	Explorer.EXE
Token: SeShutdownPrivilege	1200	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
756	rutserv.exe
1548	rutserv.exe
1264	AcroRd32.exe
1264	AcroRd32.exe
1264	AcroRd32.exe
1264	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 900	1568	36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216.exe	27
PID 1568 wrote to memory of 900	1568	36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216.exe	27
PID 1568 wrote to memory of 900	1568	36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216.exe	27
PID 1568 wrote to memory of 900	1568	36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216.exe	27
PID 1568 wrote to memory of 900	1568	36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216.exe	27
PID 1568 wrote to memory of 900	1568	36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216.exe	27
PID 1568 wrote to memory of 900	1568	36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216.exe	27
PID 900 wrote to memory of 660	900	winchk32.exe	28
PID 900 wrote to memory of 660	900	winchk32.exe	28
PID 900 wrote to memory of 660	900	winchk32.exe	28
PID 900 wrote to memory of 660	900	winchk32.exe	28
PID 900 wrote to memory of 660	900	winchk32.exe	28
PID 900 wrote to memory of 660	900	winchk32.exe	28
PID 900 wrote to memory of 660	900	winchk32.exe	28
PID 900 wrote to memory of 660	900	winchk32.exe	28
PID 900 wrote to memory of 660	900	winchk32.exe	28
PID 900 wrote to memory of 660	900	winchk32.exe	28
PID 900 wrote to memory of 660	900	winchk32.exe	28
PID 900 wrote to memory of 660	900	winchk32.exe	28
PID 900 wrote to memory of 660	900	winchk32.exe	28
PID 660 wrote to memory of 1852	660	winchk32.exe	29
PID 660 wrote to memory of 1852	660	winchk32.exe	29
PID 660 wrote to memory of 1852	660	winchk32.exe	29
PID 660 wrote to memory of 1852	660	winchk32.exe	29
PID 660 wrote to memory of 1852	660	winchk32.exe	29
PID 660 wrote to memory of 1852	660	winchk32.exe	29
PID 660 wrote to memory of 1852	660	winchk32.exe	29
PID 1852 wrote to memory of 876	1852	cmd.exe	31
PID 1852 wrote to memory of 876	1852	cmd.exe	31
PID 1852 wrote to memory of 876	1852	cmd.exe	31
PID 1852 wrote to memory of 876	1852	cmd.exe	31
PID 1852 wrote to memory of 876	1852	cmd.exe	31
PID 1852 wrote to memory of 876	1852	cmd.exe	31
PID 1852 wrote to memory of 876	1852	cmd.exe	31
PID 660 wrote to memory of 1048	660	winchk32.exe	32
PID 660 wrote to memory of 1048	660	winchk32.exe	32
PID 660 wrote to memory of 1048	660	winchk32.exe	32
PID 660 wrote to memory of 1048	660	winchk32.exe	32
PID 660 wrote to memory of 1048	660	winchk32.exe	32
PID 660 wrote to memory of 1048	660	winchk32.exe	32
PID 660 wrote to memory of 1048	660	winchk32.exe	32
PID 1048 wrote to memory of 956	1048	cmd.exe	34
PID 1048 wrote to memory of 956	1048	cmd.exe	34
PID 1048 wrote to memory of 956	1048	cmd.exe	34
PID 1048 wrote to memory of 956	1048	cmd.exe	34
PID 1048 wrote to memory of 956	1048	cmd.exe	34
PID 1048 wrote to memory of 956	1048	cmd.exe	34
PID 1048 wrote to memory of 956	1048	cmd.exe	34
PID 956 wrote to memory of 1388	956	winchk32.exe	35
PID 956 wrote to memory of 1388	956	winchk32.exe	35
PID 956 wrote to memory of 1388	956	winchk32.exe	35
PID 956 wrote to memory of 1388	956	winchk32.exe	35
PID 956 wrote to memory of 1388	956	winchk32.exe	35
PID 956 wrote to memory of 1388	956	winchk32.exe	35
PID 956 wrote to memory of 1388	956	winchk32.exe	35
PID 956 wrote to memory of 1388	956	winchk32.exe	35
PID 956 wrote to memory of 1388	956	winchk32.exe	35
PID 956 wrote to memory of 1388	956	winchk32.exe	35
PID 956 wrote to memory of 1388	956	winchk32.exe	35
PID 956 wrote to memory of 1388	956	winchk32.exe	35
PID 956 wrote to memory of 1388	956	winchk32.exe	35
PID 1388 wrote to memory of 848	1388	winchk32.exe	36
PID 1388 wrote to memory of 848	1388	winchk32.exe	36
PID 1388 wrote to memory of 848	1388	winchk32.exe	36

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1200
- C:\Users\Admin\AppData\Local\Temp\36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216.exe
  "C:\Users\Admin\AppData\Local\Temp\36329712a21bc2a49d1e13920b3f7b647793f046e67a3c62aa7474ce61be0216.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe" /inst /xwait
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:900
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe" /inst /xwait
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:660
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C xcopy /Y /E /Q * C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1852
      - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /Y /E /Q * C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\
        6⤵
        Enumerates system info in registry
        
        PID:876
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1048
      - C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
        
        C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:956
        
        C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
        
        C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe /inj
        8⤵
        Loads dropped DLL
        
        PID:848
        
        C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe
        
        C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe /inj
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe
        8⤵
        Loads dropped DLL
        
        PID:1860
        
        C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe
        
        C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:756
        
        C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe
        
        C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe -second
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1548
        
        C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exe
        
        C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exe /tray /user
        11⤵
        Executes dropped EXE
        
        PID:1588
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ZPDG.pdf"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/660-67-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/660-69-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/660-66-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/660-73-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/660-68-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/660-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/660-70-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/660-76-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/660-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/756-117-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/900-75-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1200-104-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1548-121-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1568-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1588-125-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download