Malware Analysis Report

2024-11-30 19:36

Sample ID 220208-x3qt3adgan
Target 62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2
SHA256 62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2
Tags
rms evasion rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2

Threat Level: Known bad

The file 62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2 was found to be: Known bad.

Malicious Activity Summary

rms evasion rat trojan upx

RMS

UPX packed file

Executes dropped EXE

Sets file to hidden

Checks computer location settings

Loads dropped DLL

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Runs .reg file with regedit

Suspicious use of WriteProcessMemory

Kills process with taskkill

Delays execution with timeout.exe

Suspicious use of SetWindowsHookEx

Suspicious behavior: SetClipboardViewer

Views/modifies file attributes

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-08 19:22

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-08 19:22

Reported

2022-02-08 23:57

Platform

win7-en-20211208

Max time kernel

153s

Max time network

168s

Command Line

"C:\Users\Admin\AppData\Local\Temp\62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2.exe"

Signatures

RMS

trojan rat rms

Sets file to hidden

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Server\rfusclient.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\rutserv.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\Server\vp8decoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\rfusclient.exe C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\Server\vp8encoder.dll C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\Server\rutserv.exe C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\Server\vp8decoder.dll C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\Server\rfusclient.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\Server\rutserv.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\vp8decoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\Server\vp8encoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\vp8encoder.dll C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files\Server\rfusclient.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\Server\rutserv.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Server\rutserv.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1728 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2.exe C:\Windows\SysWOW64\cmd.exe
PID 1728 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2.exe C:\Windows\SysWOW64\cmd.exe
PID 1728 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2.exe C:\Windows\SysWOW64\cmd.exe
PID 1728 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2.exe C:\Windows\SysWOW64\cmd.exe
PID 1768 wrote to memory of 1208 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\install.sfx.exe
PID 1768 wrote to memory of 1208 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\install.sfx.exe
PID 1768 wrote to memory of 1208 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\install.sfx.exe
PID 1768 wrote to memory of 1208 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\install.sfx.exe
PID 1768 wrote to memory of 1208 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\install.sfx.exe
PID 1768 wrote to memory of 1208 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\install.sfx.exe
PID 1768 wrote to memory of 1208 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\install.sfx.exe
PID 1208 wrote to memory of 1456 N/A \??\c:\install.sfx.exe C:\install.exe
PID 1208 wrote to memory of 1456 N/A \??\c:\install.sfx.exe C:\install.exe
PID 1208 wrote to memory of 1456 N/A \??\c:\install.sfx.exe C:\install.exe
PID 1208 wrote to memory of 1456 N/A \??\c:\install.sfx.exe C:\install.exe
PID 1208 wrote to memory of 1456 N/A \??\c:\install.sfx.exe C:\install.exe
PID 1208 wrote to memory of 1456 N/A \??\c:\install.sfx.exe C:\install.exe
PID 1208 wrote to memory of 1456 N/A \??\c:\install.sfx.exe C:\install.exe
PID 1456 wrote to memory of 1568 N/A C:\install.exe C:\Windows\SysWOW64\WScript.exe
PID 1456 wrote to memory of 1568 N/A C:\install.exe C:\Windows\SysWOW64\WScript.exe
PID 1456 wrote to memory of 1568 N/A C:\install.exe C:\Windows\SysWOW64\WScript.exe
PID 1456 wrote to memory of 1568 N/A C:\install.exe C:\Windows\SysWOW64\WScript.exe
PID 1456 wrote to memory of 1568 N/A C:\install.exe C:\Windows\SysWOW64\WScript.exe
PID 1456 wrote to memory of 1568 N/A C:\install.exe C:\Windows\SysWOW64\WScript.exe
PID 1456 wrote to memory of 1568 N/A C:\install.exe C:\Windows\SysWOW64\WScript.exe
PID 1568 wrote to memory of 1664 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1568 wrote to memory of 1664 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1568 wrote to memory of 1664 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1568 wrote to memory of 1664 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1568 wrote to memory of 1664 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1568 wrote to memory of 1664 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1568 wrote to memory of 1664 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1664 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1664 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1664 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1664 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1664 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1664 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1664 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1664 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1664 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1664 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1664 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1664 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1664 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1664 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1664 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1664 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1664 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1664 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1664 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1664 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1664 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1664 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1664 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1664 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1664 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1664 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1664 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1664 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1664 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1664 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1664 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1664 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2.exe

"C:\Users\Admin\AppData\Local\Temp\62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\1.bat" "

\??\c:\install.sfx.exe

install.sfx.exe -p1234 -dc:\

C:\install.exe

"C:\install.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Hex\install.vbs"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Hex\install.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rutserv.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rfusclient.exe

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\SysWOW64\regedit.exe

regedit /s "regedit.reg"

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 2

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Program Files\Server\*.*"

C:\Program Files\Server\rutserv.exe

rutserv.exe /silentinstall

C:\Program Files\Server\rutserv.exe

rutserv.exe /firewall

C:\Program Files\Server\rutserv.exe

rutserv.exe /start

C:\Program Files\Server\rutserv.exe

"C:\Program Files\Server\rutserv.exe"

C:\Program Files\Server\rfusclient.exe

"C:\Program Files\Server\rfusclient.exe"

C:\Program Files\Server\rfusclient.exe

"C:\Program Files\Server\rfusclient.exe" /tray

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Program Files\Server\rfusclient.exe

"C:\Program Files\Server\rfusclient.exe" /tray

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

memory/1728-55-0x0000000074F11000-0x0000000074F13000-memory.dmp

C:\1.bat

MD5 27d53acc161c91737fcb1864c4b4737d
SHA1 9470d7a9cf65125a47c8ef2c4c24480fe21628aa
SHA256 6fc5aa27db5b170751f239bf65ab90520f8d65da28177602a5161debce8d237e
SHA512 14ef2c2926b6df332f44c97c04b1d124f034318174755fc2a16f4e7e091e9dfaccafaec2644d926f8c41d0f493cc82cf04b873bb4e41d80b1ed0733ff245e6ef

\??\c:\install.sfx.exe

MD5 57a7d52bbd12f9f62bc491389799e064
SHA1 eb7b5fe5b9261b758e57cefebf5bb2b947ea4f6a
SHA256 0cfb6fa0fb2b5a163a88bcde536571e39883512d4384d27bb0c6e39ac85c7384
SHA512 9164417f7d20d206f68cc0299dee401763814f0edb5d7e57625d2aa6e9b7376b4e3138e00144d2f4f7096c10673c743ceca76b6922563ecfd004e5cfc199e7fc

C:\install.sfx.exe

MD5 57a7d52bbd12f9f62bc491389799e064
SHA1 eb7b5fe5b9261b758e57cefebf5bb2b947ea4f6a
SHA256 0cfb6fa0fb2b5a163a88bcde536571e39883512d4384d27bb0c6e39ac85c7384
SHA512 9164417f7d20d206f68cc0299dee401763814f0edb5d7e57625d2aa6e9b7376b4e3138e00144d2f4f7096c10673c743ceca76b6922563ecfd004e5cfc199e7fc

C:\install.exe

MD5 fad4dca26cb95a074569b14a9fc66203
SHA1 9921e215aaf221dea1b42d5b896a7ea74766ba00
SHA256 780edabce6291c572161de1400ad9009dc4a50560452e9160e4030f1ba38b534
SHA512 213cf1197c38f8c7721b175c40e31da9c196acf3dfcceb72d6cf008a1c8a9b74651fc0031305a224462ed4f13515e5d160884949cb7c207eca267784e648b8f7

C:\install.exe

MD5 fad4dca26cb95a074569b14a9fc66203
SHA1 9921e215aaf221dea1b42d5b896a7ea74766ba00
SHA256 780edabce6291c572161de1400ad9009dc4a50560452e9160e4030f1ba38b534
SHA512 213cf1197c38f8c7721b175c40e31da9c196acf3dfcceb72d6cf008a1c8a9b74651fc0031305a224462ed4f13515e5d160884949cb7c207eca267784e648b8f7

C:\Hex\install.vbs

MD5 53b4089b17b50772970facafacef3941
SHA1 8f69320a1a627488d8d7adc5daef8ee7d0a70ff9
SHA256 3211edb49cce04b4611d91ac235966d542678e4434ca1c2b236975c990b0935c
SHA512 e0da4f4f4d7a29c62746942488f73e09b9f484be781366f94e7f981ee431a4c013dc4b479ff1525831922ec162e0fdc235dd919ab96fdc4fdd3de55b5ad6d531

C:\Hex\install.bat

MD5 4c20504c645f84bce230745131dc1919
SHA1 8c18cede047b4e810090e55187dc776548821d82
SHA256 7cd4f05d659e3ceeb104907a47ea875fc5bf0a32aad02f5a4f38b1b725b688c6
SHA512 58286ef8df7249d3fc6d76c3e163ff3e709b10c31de893da16787b9a685f66475e876af40972c530bf8e2671fdcb66f3f92083cec128694df8906b0b92bb3eb7

C:\Hex\regedit.reg

MD5 4d9e37bf0c0c1857923a31cf5ea9ff06
SHA1 30aa1f480d9505cd6f3603cb586365ab8a0c62e4
SHA256 3cb99705f6f165301e6c75a70a61f266015a90482ee375ed6361184cae41a5ca
SHA512 b0f79cf5bb06bb2c0680ccf5b0ae6c5d91063803f19bc8b39633ed9d8c23b27e618d990979b15cd34cf008494fba09070cfda590f5d1f38d54510b02922f9b24

C:\Hex\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

C:\Hex\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Hex\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Hex\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Program Files\Server\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Program Files\Server\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

memory/920-86-0x00000000001D0000-0x00000000001D1000-memory.dmp

\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

memory/1720-90-0x0000000000240000-0x0000000000241000-memory.dmp

\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

memory/276-97-0x0000000000370000-0x0000000000371000-memory.dmp

memory/1644-96-0x0000000000240000-0x0000000000241000-memory.dmp

\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

C:\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

C:\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

memory/796-104-0x0000000000230000-0x0000000000231000-memory.dmp

memory/432-105-0x0000000000230000-0x0000000000231000-memory.dmp

C:\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-08 19:22

Reported

2022-02-08 23:56

Platform

win10v2004-en-20220113

Max time kernel

171s

Max time network

197s

Command Line

"C:\Users\Admin\AppData\Local\Temp\62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2.exe"

Signatures

RMS

trojan rat rms

Sets file to hidden

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation \??\c:\install.sfx.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\install.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Server\vp8encoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\rutserv.exe C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\Server\vp8decoder.dll C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\Server\vp8encoder.dll C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\Server\rfusclient.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\Server\rutserv.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\rutserv.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\Server\vp8decoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\Server\rfusclient.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\vp8decoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\vp8encoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\rfusclient.exe C:\Windows\SysWOW64\attrib.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\Logs\CBS\CBS.log C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
File opened for modification C:\Windows\WinSxS\pending.xml C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings C:\install.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\install.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2044 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2.exe C:\Windows\SysWOW64\cmd.exe
PID 2044 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2.exe C:\Windows\SysWOW64\cmd.exe
PID 2044 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2.exe C:\Windows\SysWOW64\cmd.exe
PID 4764 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\install.sfx.exe
PID 4764 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\install.sfx.exe
PID 4764 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\install.sfx.exe
PID 1608 wrote to memory of 1588 N/A \??\c:\install.sfx.exe C:\install.exe
PID 1608 wrote to memory of 1588 N/A \??\c:\install.sfx.exe C:\install.exe
PID 1608 wrote to memory of 1588 N/A \??\c:\install.sfx.exe C:\install.exe
PID 1588 wrote to memory of 3520 N/A C:\install.exe C:\Windows\SysWOW64\WScript.exe
PID 1588 wrote to memory of 3520 N/A C:\install.exe C:\Windows\SysWOW64\WScript.exe
PID 1588 wrote to memory of 3520 N/A C:\install.exe C:\Windows\SysWOW64\WScript.exe
PID 3520 wrote to memory of 4792 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3520 wrote to memory of 4792 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3520 wrote to memory of 4792 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4792 wrote to memory of 116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4792 wrote to memory of 116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4792 wrote to memory of 116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4792 wrote to memory of 3612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4792 wrote to memory of 3612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4792 wrote to memory of 3612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4792 wrote to memory of 4172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4792 wrote to memory of 4172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4792 wrote to memory of 4172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4792 wrote to memory of 4224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 4792 wrote to memory of 4224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 4792 wrote to memory of 4224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 4792 wrote to memory of 2768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4792 wrote to memory of 2768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4792 wrote to memory of 2768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4792 wrote to memory of 4952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4792 wrote to memory of 4952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4792 wrote to memory of 4952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4792 wrote to memory of 3840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4792 wrote to memory of 3840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4792 wrote to memory of 3840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4792 wrote to memory of 1120 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 4792 wrote to memory of 1120 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 4792 wrote to memory of 1120 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 4792 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 4792 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 4792 wrote to memory of 1036 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 4792 wrote to memory of 3580 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 4792 wrote to memory of 3580 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 4792 wrote to memory of 3580 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 3320 wrote to memory of 1984 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 3320 wrote to memory of 1984 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 3320 wrote to memory of 1984 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 3320 wrote to memory of 1772 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 3320 wrote to memory of 1772 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 3320 wrote to memory of 1772 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 4792 wrote to memory of 3884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4792 wrote to memory of 3884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4792 wrote to memory of 3884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1984 wrote to memory of 392 N/A C:\Program Files\Server\rfusclient.exe C:\Program Files\Server\rfusclient.exe
PID 1984 wrote to memory of 392 N/A C:\Program Files\Server\rfusclient.exe C:\Program Files\Server\rfusclient.exe
PID 1984 wrote to memory of 392 N/A C:\Program Files\Server\rfusclient.exe C:\Program Files\Server\rfusclient.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2.exe

"C:\Users\Admin\AppData\Local\Temp\62c18ab9d7bb18724ecf243ae468ce5634af538f0e280deef7d1c5c02eda61e2.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\1.bat" "

\??\c:\install.sfx.exe

install.sfx.exe -p1234 -dc:\

C:\install.exe

"C:\install.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Hex\install.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Hex\install.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rutserv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rfusclient.exe

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\SysWOW64\regedit.exe

regedit /s "regedit.reg"

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 2

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Program Files\Server\*.*"

C:\Program Files\Server\rutserv.exe

rutserv.exe /silentinstall

C:\Program Files\Server\rutserv.exe

rutserv.exe /firewall

C:\Program Files\Server\rutserv.exe

rutserv.exe /start

C:\Program Files\Server\rutserv.exe

"C:\Program Files\Server\rutserv.exe"

C:\Program Files\Server\rfusclient.exe

"C:\Program Files\Server\rfusclient.exe" /tray

C:\Program Files\Server\rfusclient.exe

"C:\Program Files\Server\rfusclient.exe"

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Program Files\Server\rfusclient.exe

"C:\Program Files\Server\rfusclient.exe" /tray

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 20.190.151.67:443 tcp
US 20.190.151.67:443 tcp
NL 104.110.191.133:80 tcp
NL 104.110.191.133:80 tcp
US 8.8.8.8:53 crl3.digicert.com udp
US 93.184.220.29:80 crl3.digicert.com tcp
US 93.184.220.29:80 crl3.digicert.com tcp
US 8.8.8.8:53 settings-win.data.microsoft.com udp
US 52.167.17.97:443 settings-win.data.microsoft.com tcp
US 8.8.8.8:53 crl4.digicert.com udp
US 93.184.220.29:80 crl4.digicert.com tcp
US 8.8.8.8:53 settings-win.data.microsoft.com udp
US 52.167.249.196:443 settings-win.data.microsoft.com tcp
US 93.184.220.29:80 crl4.digicert.com tcp
NL 104.110.191.140:80 tcp
US 93.184.220.29:80 crl4.digicert.com tcp
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp
US 8.8.8.8:53 settings-win.data.microsoft.com udp
US 52.167.249.196:443 settings-win.data.microsoft.com tcp
US 52.167.249.196:443 settings-win.data.microsoft.com tcp
US 52.167.249.196:443 settings-win.data.microsoft.com tcp
US 93.184.220.29:80 crl4.digicert.com tcp
US 93.184.220.29:80 crl4.digicert.com tcp
US 93.184.220.29:80 crl4.digicert.com tcp

Files

C:\1.bat

MD5 27d53acc161c91737fcb1864c4b4737d
SHA1 9470d7a9cf65125a47c8ef2c4c24480fe21628aa
SHA256 6fc5aa27db5b170751f239bf65ab90520f8d65da28177602a5161debce8d237e
SHA512 14ef2c2926b6df332f44c97c04b1d124f034318174755fc2a16f4e7e091e9dfaccafaec2644d926f8c41d0f493cc82cf04b873bb4e41d80b1ed0733ff245e6ef

C:\install.sfx.exe

MD5 57a7d52bbd12f9f62bc491389799e064
SHA1 eb7b5fe5b9261b758e57cefebf5bb2b947ea4f6a
SHA256 0cfb6fa0fb2b5a163a88bcde536571e39883512d4384d27bb0c6e39ac85c7384
SHA512 9164417f7d20d206f68cc0299dee401763814f0edb5d7e57625d2aa6e9b7376b4e3138e00144d2f4f7096c10673c743ceca76b6922563ecfd004e5cfc199e7fc

\??\c:\install.sfx.exe

MD5 57a7d52bbd12f9f62bc491389799e064
SHA1 eb7b5fe5b9261b758e57cefebf5bb2b947ea4f6a
SHA256 0cfb6fa0fb2b5a163a88bcde536571e39883512d4384d27bb0c6e39ac85c7384
SHA512 9164417f7d20d206f68cc0299dee401763814f0edb5d7e57625d2aa6e9b7376b4e3138e00144d2f4f7096c10673c743ceca76b6922563ecfd004e5cfc199e7fc

C:\install.exe

MD5 fad4dca26cb95a074569b14a9fc66203
SHA1 9921e215aaf221dea1b42d5b896a7ea74766ba00
SHA256 780edabce6291c572161de1400ad9009dc4a50560452e9160e4030f1ba38b534
SHA512 213cf1197c38f8c7721b175c40e31da9c196acf3dfcceb72d6cf008a1c8a9b74651fc0031305a224462ed4f13515e5d160884949cb7c207eca267784e648b8f7

C:\install.exe

MD5 fad4dca26cb95a074569b14a9fc66203
SHA1 9921e215aaf221dea1b42d5b896a7ea74766ba00
SHA256 780edabce6291c572161de1400ad9009dc4a50560452e9160e4030f1ba38b534
SHA512 213cf1197c38f8c7721b175c40e31da9c196acf3dfcceb72d6cf008a1c8a9b74651fc0031305a224462ed4f13515e5d160884949cb7c207eca267784e648b8f7

C:\Hex\install.vbs

MD5 53b4089b17b50772970facafacef3941
SHA1 8f69320a1a627488d8d7adc5daef8ee7d0a70ff9
SHA256 3211edb49cce04b4611d91ac235966d542678e4434ca1c2b236975c990b0935c
SHA512 e0da4f4f4d7a29c62746942488f73e09b9f484be781366f94e7f981ee431a4c013dc4b479ff1525831922ec162e0fdc235dd919ab96fdc4fdd3de55b5ad6d531

C:\Hex\install.bat

MD5 4c20504c645f84bce230745131dc1919
SHA1 8c18cede047b4e810090e55187dc776548821d82
SHA256 7cd4f05d659e3ceeb104907a47ea875fc5bf0a32aad02f5a4f38b1b725b688c6
SHA512 58286ef8df7249d3fc6d76c3e163ff3e709b10c31de893da16787b9a685f66475e876af40972c530bf8e2671fdcb66f3f92083cec128694df8906b0b92bb3eb7

memory/4880-137-0x000002549EF20000-0x000002549EF30000-memory.dmp

memory/4880-138-0x000002549EF80000-0x000002549EF90000-memory.dmp

memory/4880-139-0x00000254A1630000-0x00000254A1634000-memory.dmp

C:\Hex\regedit.reg

MD5 4d9e37bf0c0c1857923a31cf5ea9ff06
SHA1 30aa1f480d9505cd6f3603cb586365ab8a0c62e4
SHA256 3cb99705f6f165301e6c75a70a61f266015a90482ee375ed6361184cae41a5ca
SHA512 b0f79cf5bb06bb2c0680ccf5b0ae6c5d91063803f19bc8b39633ed9d8c23b27e618d990979b15cd34cf008494fba09070cfda590f5d1f38d54510b02922f9b24

C:\Hex\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

C:\Hex\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Hex\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Hex\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Program Files\Server\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Program Files\Server\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

memory/1120-150-0x00000000010A0000-0x00000000010A1000-memory.dmp

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

memory/1036-152-0x0000000002940000-0x0000000002941000-memory.dmp

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

memory/3580-155-0x00000000010F0000-0x00000000010F1000-memory.dmp

memory/3320-156-0x0000000000C30000-0x0000000000C31000-memory.dmp

C:\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

C:\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

memory/1984-159-0x0000000002990000-0x0000000002991000-memory.dmp

memory/1772-160-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

C:\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae