Malware Analysis Report

2024-11-30 19:41

Sample ID 220207-xv1pasfhcr
Target 8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f
SHA256 8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f
Tags
rms aspackv2 discovery evasion rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f

Threat Level: Known bad

The file 8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f was found to be: Known bad.

Malicious Activity Summary

rms aspackv2 discovery evasion rat trojan upx

RMS

ACProtect 1.3x - 1.4x DLL software

ASPack v2.12-2.42

Executes dropped EXE

Sets file to hidden

UPX packed file

Checks computer location settings

Loads dropped DLL

Checks installed software on the system

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: CmdExeWriteProcessMemorySpam

Runs .reg file with regedit

Views/modifies file attributes

Kills process with taskkill

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Suspicious behavior: SetClipboardViewer

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Delays execution with timeout.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-07 19:11

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-07 19:11

Reported

2022-02-08 00:28

Platform

win7-en-20211208

Max time kernel

155s

Max time network

178s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe"

Signatures

RMS

trojan rat rms

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Sets file to hidden

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\java\javacoder.exe C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
File opened for modification C:\Program Files\java\rfusclient.exe C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
File opened for modification C:\Program Files\java\rfusclient.exe C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Program Files\java\vp8decoder.dll C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Program Files\java\regedit.reg C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
File opened for modification C:\Program Files\Java C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Program Files\java\rutserv.exe C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Program Files\java\vp8encoder.dll C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Program Files\java\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
File opened for modification C:\Program Files\java\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Word\Word\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
File created C:\Program Files (x86)\Microsoft Word\Word\Uninstall.ini C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
File opened for modification C:\Program Files\java\javacoder.exe C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Program Files\java\regedit.reg C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Program Files\java\rutserv.exe C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\regedit.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Program Files\java\rutserv.exe N/A
N/A N/A C:\Program Files\java\rutserv.exe N/A
N/A N/A C:\Program Files\java\rutserv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\java\rutserv.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\java\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\java\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\java\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\java\rutserv.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\java\rutserv.exe N/A
N/A N/A C:\Program Files\java\rutserv.exe N/A
N/A N/A C:\Program Files\java\rutserv.exe N/A
N/A N/A C:\Program Files\java\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1432 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe C:\Program Files\java\javacoder.exe
PID 1432 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe C:\Program Files\java\javacoder.exe
PID 1432 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe C:\Program Files\java\javacoder.exe
PID 1432 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe C:\Program Files\java\javacoder.exe
PID 1128 wrote to memory of 672 N/A C:\Program Files\java\javacoder.exe C:\Windows\system32\cmd.exe
PID 1128 wrote to memory of 672 N/A C:\Program Files\java\javacoder.exe C:\Windows\system32\cmd.exe
PID 1128 wrote to memory of 672 N/A C:\Program Files\java\javacoder.exe C:\Windows\system32\cmd.exe
PID 1128 wrote to memory of 672 N/A C:\Program Files\java\javacoder.exe C:\Windows\system32\cmd.exe
PID 672 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 672 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 672 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 672 wrote to memory of 2024 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 672 wrote to memory of 2024 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 672 wrote to memory of 2024 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 672 wrote to memory of 1008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 672 wrote to memory of 1008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 672 wrote to memory of 1008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 672 wrote to memory of 1184 N/A C:\Windows\system32\cmd.exe C:\Windows\regedit.exe
PID 672 wrote to memory of 1184 N/A C:\Windows\system32\cmd.exe C:\Windows\regedit.exe
PID 672 wrote to memory of 1184 N/A C:\Windows\system32\cmd.exe C:\Windows\regedit.exe
PID 672 wrote to memory of 840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 672 wrote to memory of 840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 672 wrote to memory of 840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 672 wrote to memory of 1348 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 672 wrote to memory of 1348 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 672 wrote to memory of 1348 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 672 wrote to memory of 1348 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 672 wrote to memory of 1724 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 672 wrote to memory of 1724 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 672 wrote to memory of 1724 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 672 wrote to memory of 1724 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 672 wrote to memory of 548 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 672 wrote to memory of 548 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 672 wrote to memory of 548 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 672 wrote to memory of 548 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 1992 wrote to memory of 1852 N/A C:\Program Files\java\rutserv.exe C:\Program Files\java\rfusclient.exe
PID 1992 wrote to memory of 1852 N/A C:\Program Files\java\rutserv.exe C:\Program Files\java\rfusclient.exe
PID 1992 wrote to memory of 1852 N/A C:\Program Files\java\rutserv.exe C:\Program Files\java\rfusclient.exe
PID 1992 wrote to memory of 1852 N/A C:\Program Files\java\rutserv.exe C:\Program Files\java\rfusclient.exe
PID 1992 wrote to memory of 1192 N/A C:\Program Files\java\rutserv.exe C:\Program Files\java\rfusclient.exe
PID 1992 wrote to memory of 1192 N/A C:\Program Files\java\rutserv.exe C:\Program Files\java\rfusclient.exe
PID 1992 wrote to memory of 1192 N/A C:\Program Files\java\rutserv.exe C:\Program Files\java\rfusclient.exe
PID 1992 wrote to memory of 1192 N/A C:\Program Files\java\rutserv.exe C:\Program Files\java\rfusclient.exe
PID 672 wrote to memory of 1056 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 672 wrote to memory of 1056 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 672 wrote to memory of 1056 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 672 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 672 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 672 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe

"C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe"

C:\Program Files\java\javacoder.exe

"C:\Program Files\java\javacoder.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4AB6.tmp\4AB7.bat "C:\Program Files\java\javacoder.exe""

C:\Windows\system32\taskkill.exe

taskkill /f /im rutserv.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im rfusclient.exe

C:\Windows\system32\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\regedit.exe

regedit /s "regedit.reg"

C:\Windows\system32\timeout.exe

timeout 2

C:\Program Files\java\rutserv.exe

rutserv.exe /silentinstall

C:\Program Files\java\rutserv.exe

rutserv.exe /firewall

C:\Program Files\java\rutserv.exe

rutserv.exe /start

C:\Program Files\java\rutserv.exe

"C:\Program Files\java\rutserv.exe"

C:\Program Files\java\rfusclient.exe

"C:\Program Files\java\rfusclient.exe"

C:\Program Files\java\rfusclient.exe

"C:\Program Files\java\rfusclient.exe" /tray

C:\Windows\system32\attrib.exe

attrib +s +h "C:\Program Files\java"

C:\Windows\system32\attrib.exe

attrib +s +h "C:\Program Files\java\*.*"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

memory/1432-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

\Program Files\Java\javacoder.exe

MD5 0337e751bdd8068c7245df415c9fe56a
SHA1 c0dfe2b85231537194f08d8ccd93d8894da02dc7
SHA256 517b1fc6a1f834ef5c136be6ca76422ce66e2a16143e5efd4ce66b3cb7fee2f0
SHA512 a125f8060f946db839fad70b37069c3c38b27277593c4cf12fd5e62351502722127f3b296f276e632b8680e7430db3001a7ab1593b2387ca5150c212853daa4e

C:\Program Files\Java\javacoder.exe

MD5 0337e751bdd8068c7245df415c9fe56a
SHA1 c0dfe2b85231537194f08d8ccd93d8894da02dc7
SHA256 517b1fc6a1f834ef5c136be6ca76422ce66e2a16143e5efd4ce66b3cb7fee2f0
SHA512 a125f8060f946db839fad70b37069c3c38b27277593c4cf12fd5e62351502722127f3b296f276e632b8680e7430db3001a7ab1593b2387ca5150c212853daa4e

C:\Users\Admin\AppData\Local\Temp\4AB6.tmp\4AB7.bat

MD5 e0a94878836292f863bdd72953522d24
SHA1 6317c22f0368b9812236af3e18e41a9bc0d65a99
SHA256 7b0269cdf90d4294c1b230ea55187472add3aecabb78105192f359af76498f98
SHA512 d374db50d78f28b65746693c7d66563f95f97a0fb1392ea48b0240be229c06257b57f1b4564015c884d1ad08f41ce378d22a31aef9d81722332a975d284c63ab

memory/1184-59-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

C:\Program Files\java\regedit.reg

MD5 82da56345728f9f147efaf6b7a717d27
SHA1 020d842b64a870172c5f19af870efb9f17109420
SHA256 5dc865bb94202876d80d2c5e7a99cf98c9006c2afbea52a0b9e41fe7371638a2
SHA512 aa106e3157d94f9f8014a0c3ac40dba9dd14133fe442308d07c0ea4844fba4567ed75209ef00cc702193527abd68d49df9ffdbb1345ce54a90907a3226092a58

C:\Program Files\java\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

C:\Program Files\Java\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/1348-64-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1348-65-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1348-66-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program Files\Java\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/1724-69-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1724-70-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1724-71-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program Files\Java\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/548-74-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/548-75-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program Files\Java\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/1992-78-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1992-79-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program Files\java\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

C:\Program Files\java\vp8encoder.dll

MD5 6298c0af3d1d563834a218a9cc9f54bd
SHA1 0185cd591e454ed072e5a5077b25c612f6849dc9
SHA256 81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512 389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

C:\Program Files\java\vp8decoder.dll

MD5 88318158527985702f61d169434a4940
SHA1 3cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA256 4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA512 5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

\Program Files\Java\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

C:\Program Files\Java\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

\Program Files\Java\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

C:\Program Files\Java\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

memory/548-89-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1192-90-0x0000000000400000-0x00000000009B6000-memory.dmp

C:\Program Files\java\javacoder.exe

MD5 0337e751bdd8068c7245df415c9fe56a
SHA1 c0dfe2b85231537194f08d8ccd93d8894da02dc7
SHA256 517b1fc6a1f834ef5c136be6ca76422ce66e2a16143e5efd4ce66b3cb7fee2f0
SHA512 a125f8060f946db839fad70b37069c3c38b27277593c4cf12fd5e62351502722127f3b296f276e632b8680e7430db3001a7ab1593b2387ca5150c212853daa4e

memory/1192-93-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1992-95-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1192-96-0x0000000000230000-0x0000000000231000-memory.dmp

memory/1992-97-0x00000000002F0000-0x00000000002F1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-07 19:11

Reported

2022-02-08 00:28

Platform

win10v2004-en-20220112

Max time kernel

169s

Max time network

176s

Command Line

%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13

Signatures

RMS

trojan rat rms

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Sets file to hidden

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation C:\Program Files\java\javacoder.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\java\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
File opened for modification C:\Program Files\java\regedit.reg C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Program Files\java\vp8decoder.dll C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Program Files\java\vp8encoder.dll C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Program Files\java\rfusclient.exe C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
File opened for modification C:\Program Files\java\rutserv.exe C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
File opened for modification C:\Program Files\java\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Word\Word\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
File opened for modification C:\Program Files\java\javacoder.exe C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Program Files\java\rfusclient.exe C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Program Files\java\rutserv.exe C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Program Files\java\javacoder.exe C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
File opened for modification C:\Program Files\java\regedit.reg C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
File created C:\Program Files (x86)\Microsoft Word\Word\Uninstall.ini C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe N/A
File opened for modification C:\Program Files\Java C:\Windows\system32\attrib.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat C:\Windows\System32\svchost.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\MusNotifyIcon.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\MusNotifyIcon.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132889299803442648" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3920" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "2.295946" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.006676" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4112" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" C:\Windows\System32\svchost.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\regedit.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files\java\rfusclient.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\java\rutserv.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\java\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\java\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\java\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\java\rutserv.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\java\rutserv.exe N/A
N/A N/A C:\Program Files\java\rutserv.exe N/A
N/A N/A C:\Program Files\java\rutserv.exe N/A
N/A N/A C:\Program Files\java\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3944 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe C:\Program Files\java\javacoder.exe
PID 3944 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe C:\Program Files\java\javacoder.exe
PID 3944 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe C:\Program Files\java\javacoder.exe
PID 3100 wrote to memory of 3652 N/A C:\Program Files\java\javacoder.exe C:\Windows\system32\cmd.exe
PID 3100 wrote to memory of 3652 N/A C:\Program Files\java\javacoder.exe C:\Windows\system32\cmd.exe
PID 3652 wrote to memory of 3328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3652 wrote to memory of 3328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3652 wrote to memory of 3712 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3652 wrote to memory of 3712 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3652 wrote to memory of 3136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3652 wrote to memory of 3136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3652 wrote to memory of 2548 N/A C:\Windows\system32\cmd.exe C:\Windows\regedit.exe
PID 3652 wrote to memory of 2548 N/A C:\Windows\system32\cmd.exe C:\Windows\regedit.exe
PID 3652 wrote to memory of 2976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3652 wrote to memory of 2976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3652 wrote to memory of 1828 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 3652 wrote to memory of 1828 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 3652 wrote to memory of 1828 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 3652 wrote to memory of 3232 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 3652 wrote to memory of 3232 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 3652 wrote to memory of 3232 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 3652 wrote to memory of 2892 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 3652 wrote to memory of 2892 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 3652 wrote to memory of 2892 N/A C:\Windows\system32\cmd.exe C:\Program Files\java\rutserv.exe
PID 3288 wrote to memory of 1532 N/A C:\Program Files\java\rutserv.exe C:\Program Files\java\rfusclient.exe
PID 3288 wrote to memory of 1532 N/A C:\Program Files\java\rutserv.exe C:\Program Files\java\rfusclient.exe
PID 3288 wrote to memory of 1532 N/A C:\Program Files\java\rutserv.exe C:\Program Files\java\rfusclient.exe
PID 3288 wrote to memory of 2604 N/A C:\Program Files\java\rutserv.exe C:\Program Files\java\rfusclient.exe
PID 3288 wrote to memory of 2604 N/A C:\Program Files\java\rutserv.exe C:\Program Files\java\rfusclient.exe
PID 3288 wrote to memory of 2604 N/A C:\Program Files\java\rutserv.exe C:\Program Files\java\rfusclient.exe
PID 3652 wrote to memory of 3708 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 3652 wrote to memory of 3708 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 3652 wrote to memory of 1204 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 3652 wrote to memory of 1204 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2604 wrote to memory of 1536 N/A C:\Program Files\java\rfusclient.exe C:\Program Files\java\rfusclient.exe
PID 2604 wrote to memory of 1536 N/A C:\Program Files\java\rfusclient.exe C:\Program Files\java\rfusclient.exe
PID 2604 wrote to memory of 1536 N/A C:\Program Files\java\rfusclient.exe C:\Program Files\java\rfusclient.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Windows\system32\MusNotifyIcon.exe

%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13

C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe

"C:\Users\Admin\AppData\Local\Temp\8f114509f049f792d2e39ace4fc95be51e1a5a3b2995de11093810076db4240f.exe"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p

C:\Program Files\java\javacoder.exe

"C:\Program Files\java\javacoder.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B416.tmp\B417.bat "C:\Program Files\java\javacoder.exe""

C:\Windows\system32\taskkill.exe

taskkill /f /im rutserv.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im rfusclient.exe

C:\Windows\system32\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\regedit.exe

regedit /s "regedit.reg"

C:\Windows\system32\timeout.exe

timeout 2

C:\Program Files\java\rutserv.exe

rutserv.exe /silentinstall

C:\Program Files\java\rutserv.exe

rutserv.exe /firewall

C:\Program Files\java\rutserv.exe

rutserv.exe /start

C:\Program Files\java\rutserv.exe

"C:\Program Files\java\rutserv.exe"

C:\Program Files\java\rfusclient.exe

"C:\Program Files\java\rfusclient.exe"

C:\Program Files\java\rfusclient.exe

"C:\Program Files\java\rfusclient.exe" /tray

C:\Windows\system32\attrib.exe

attrib +s +h "C:\Program Files\java"

C:\Windows\system32\attrib.exe

attrib +s +h "C:\Program Files\java\*.*"

C:\Program Files\java\rfusclient.exe

"C:\Program Files\java\rfusclient.exe" /tray

Network

Country Destination Domain Proto
US 8.8.8.8:53 settings-win.data.microsoft.com udp
NL 20.73.194.208:443 settings-win.data.microsoft.com tcp
US 93.184.220.29:80 tcp
NL 20.73.194.208:443 settings-win.data.microsoft.com tcp
NL 104.80.224.57:443 tcp
NL 20.73.194.208:443 settings-win.data.microsoft.com tcp
US 20.190.154.17:443 tcp
NL 20.73.194.208:443 settings-win.data.microsoft.com tcp
US 8.8.8.8:53 geo.prod.do.dsp.mp.microsoft.com udp
US 52.143.87.28:443 geo.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 kv801.prod.do.dsp.mp.microsoft.com udp
NL 184.29.205.60:443 kv801.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 settings-win.data.microsoft.com udp
US 52.167.17.97:443 settings-win.data.microsoft.com tcp
SC 185.215.113.83:60722 tcp
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

C:\Program Files\Java\javacoder.exe

MD5 0337e751bdd8068c7245df415c9fe56a
SHA1 c0dfe2b85231537194f08d8ccd93d8894da02dc7
SHA256 517b1fc6a1f834ef5c136be6ca76422ce66e2a16143e5efd4ce66b3cb7fee2f0
SHA512 a125f8060f946db839fad70b37069c3c38b27277593c4cf12fd5e62351502722127f3b296f276e632b8680e7430db3001a7ab1593b2387ca5150c212853daa4e

C:\Program Files\java\javacoder.exe

MD5 0337e751bdd8068c7245df415c9fe56a
SHA1 c0dfe2b85231537194f08d8ccd93d8894da02dc7
SHA256 517b1fc6a1f834ef5c136be6ca76422ce66e2a16143e5efd4ce66b3cb7fee2f0
SHA512 a125f8060f946db839fad70b37069c3c38b27277593c4cf12fd5e62351502722127f3b296f276e632b8680e7430db3001a7ab1593b2387ca5150c212853daa4e

C:\Users\Admin\AppData\Local\Temp\B416.tmp\B417.bat

MD5 e0a94878836292f863bdd72953522d24
SHA1 6317c22f0368b9812236af3e18e41a9bc0d65a99
SHA256 7b0269cdf90d4294c1b230ea55187472add3aecabb78105192f359af76498f98
SHA512 d374db50d78f28b65746693c7d66563f95f97a0fb1392ea48b0240be229c06257b57f1b4564015c884d1ad08f41ce378d22a31aef9d81722332a975d284c63ab

C:\Program Files\java\regedit.reg

MD5 82da56345728f9f147efaf6b7a717d27
SHA1 020d842b64a870172c5f19af870efb9f17109420
SHA256 5dc865bb94202876d80d2c5e7a99cf98c9006c2afbea52a0b9e41fe7371638a2
SHA512 aa106e3157d94f9f8014a0c3ac40dba9dd14133fe442308d07c0ea4844fba4567ed75209ef00cc702193527abd68d49df9ffdbb1345ce54a90907a3226092a58

C:\Program Files\Java\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

C:\Program Files\java\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/1828-136-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1828-137-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1828-138-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program Files\Java\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/3232-140-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3232-141-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3232-142-0x0000000002610000-0x0000000002611000-memory.dmp

memory/3232-143-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program Files\Java\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/2892-145-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/2892-146-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program Files\Java\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/3288-148-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3288-149-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program Files\java\vp8decoder.dll

MD5 88318158527985702f61d169434a4940
SHA1 3cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA256 4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA512 5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

C:\Program Files\java\vp8encoder.dll

MD5 6298c0af3d1d563834a218a9cc9f54bd
SHA1 0185cd591e454ed072e5a5077b25c612f6849dc9
SHA256 81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512 389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

C:\Program Files\java\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

C:\Program Files\Java\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

C:\Program Files\Java\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

memory/2892-155-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/2604-156-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1532-157-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1532-158-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/2604-159-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1532-160-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

C:\Program Files\Java\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

memory/1536-162-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1536-163-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1536-164-0x0000000000400000-0x00000000009B6000-memory.dmp