Malware Analysis Report

2024-11-30 19:37

Sample ID 220213-lllm8saddk
Target dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33
SHA256 dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33
Tags
rms evasion persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33

Threat Level: Known bad

The file dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33 was found to be: Known bad.

Malicious Activity Summary

rms evasion persistence rat trojan

RMS

UAC bypass

Executes dropped EXE

Modifies Windows Firewall

Sets file to hidden

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Delays execution with timeout.exe

Views/modifies file attributes

Suspicious behavior: EnumeratesProcesses

Modifies registry key

Runs .reg file with regedit

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-13 09:37

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-13 09:37

Reported

2022-02-13 09:39

Platform

win7-en-20211208

Max time kernel

137s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe"

Signatures

RMS

trojan rat rms

UAC bypass

evasion trojan

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe N/A
N/A N/A C:\Folder562\rutserv.exe N/A

Modifies Windows Firewall

evasion

Sets file to hidden

evasion

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Services = "C:Folder562\\rutserv.exe" C:\Windows\SysWOW64\reg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\4w5tb68h7t987093f4trq893f4rw89etw.txt C:\Windows\SysWOW64\wscript.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Folder562\rutserv.exe N/A
N/A N/A C:\Folder562\rutserv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Folder562\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Folder562\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Folder562\rutserv.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Folder562\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 612 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 612 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 612 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 612 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 612 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 612 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 612 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 268 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 268 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 268 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 268 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 268 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 268 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 268 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 304 wrote to memory of 1708 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1708 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1708 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1708 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1708 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1708 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1708 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1620 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1620 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1620 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1620 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1620 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1620 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1620 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1308 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1308 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1308 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1308 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1308 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1308 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 304 wrote to memory of 1308 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 1708 wrote to memory of 1048 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1708 wrote to memory of 1048 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1708 wrote to memory of 1048 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1708 wrote to memory of 1048 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1708 wrote to memory of 1048 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1708 wrote to memory of 1048 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1708 wrote to memory of 1048 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1048 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1048 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1048 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1048 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1048 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1048 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1048 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1048 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1048 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1048 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1048 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1048 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1048 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1048 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1048 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1048 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1048 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1048 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1048 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1048 wrote to memory of 992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1048 wrote to memory of 1856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe

"C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe"

C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

"C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe" -p284579G45398T745398T

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Log\install.vbs"

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Log\Windows\hiscomponent\install.bat" "

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Log"

C:\Windows\SysWOW64\netsh.exe

netsh advfirewall set allprofiles state off

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Log\Windows\hiscomponent\msg.vbs"

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\SysWOW64\reg.exe

reg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\DEVICEMAP" /f

C:\Windows\SysWOW64\reg.exe

reg delete "HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System" /f

C:\Windows\SysWOW64\regedit.exe

regedit /s "Windows\hiscomponent\regedit.reg"

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Folder562\rutserv.exe

rutserv.exe

C:\Windows\SysWOW64\reg.exe

Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Services" /t REG_SZ /d "C:Folder562\rutserv.exe" /f

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\Folder562\*.*"

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\Folder562"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\System32\cmd.exe /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

memory/612-54-0x0000000075891000-0x0000000075893000-memory.dmp

\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

MD5 ef4bd1ef9388f417ff97617494078b5d
SHA1 e14337b0f3ebe062ff985dc8f92fab345aa853bc
SHA256 43f05d77571cb31e76b374c684d0fe7b9533a44bc820be889aff4e83db5361c7
SHA512 a195dea35c39a5f84631e024b55421c863b59632c6f6f904e004a637009ebba7c2e352e04cd2867639263310321ad0000c75fd8a94417ae2dd85869e86a5adc6

\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

MD5 ef4bd1ef9388f417ff97617494078b5d
SHA1 e14337b0f3ebe062ff985dc8f92fab345aa853bc
SHA256 43f05d77571cb31e76b374c684d0fe7b9533a44bc820be889aff4e83db5361c7
SHA512 a195dea35c39a5f84631e024b55421c863b59632c6f6f904e004a637009ebba7c2e352e04cd2867639263310321ad0000c75fd8a94417ae2dd85869e86a5adc6

\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

MD5 ef4bd1ef9388f417ff97617494078b5d
SHA1 e14337b0f3ebe062ff985dc8f92fab345aa853bc
SHA256 43f05d77571cb31e76b374c684d0fe7b9533a44bc820be889aff4e83db5361c7
SHA512 a195dea35c39a5f84631e024b55421c863b59632c6f6f904e004a637009ebba7c2e352e04cd2867639263310321ad0000c75fd8a94417ae2dd85869e86a5adc6

C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

MD5 ef4bd1ef9388f417ff97617494078b5d
SHA1 e14337b0f3ebe062ff985dc8f92fab345aa853bc
SHA256 43f05d77571cb31e76b374c684d0fe7b9533a44bc820be889aff4e83db5361c7
SHA512 a195dea35c39a5f84631e024b55421c863b59632c6f6f904e004a637009ebba7c2e352e04cd2867639263310321ad0000c75fd8a94417ae2dd85869e86a5adc6

C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

MD5 ef4bd1ef9388f417ff97617494078b5d
SHA1 e14337b0f3ebe062ff985dc8f92fab345aa853bc
SHA256 43f05d77571cb31e76b374c684d0fe7b9533a44bc820be889aff4e83db5361c7
SHA512 a195dea35c39a5f84631e024b55421c863b59632c6f6f904e004a637009ebba7c2e352e04cd2867639263310321ad0000c75fd8a94417ae2dd85869e86a5adc6

C:\Log\install.vbs

MD5 6cab561732bb524984d25e29b8e93414
SHA1 73adabe3f5191ea01d8026b14285f0330f97fccc
SHA256 81d2721f8da28ab12ab7e6572dbfe39c78f1eb24b09ccd9ae816dbcb9f398e60
SHA512 7f001fcdf73056fb688c62be0f68b1b1c54e3f0aff05b8e03e0947716e2cd771fa9e12314cb3b6efd9f971c889405d6eccb83a6ee48280e135fc6e14e216e45d

C:\Log\Windows\hiscomponent\install.bat

MD5 f21ee20f3a6ff9b9ef9b289eb22f5cc6
SHA1 05f6ce53ea8803bc129ba2fffa07df12b4495e9f
SHA256 895c47f916a29847f5441f357d0009ae4f88dca62a11c87ea18f1572e3d72c10
SHA512 13a03018fb02d030fcb6e918a2dd8ffe4f2323ee3db36601a1c7180cad6d2638f57da174f9466eecdc3950d0cfdae88224eb5b0cacdec8e56a0c9343a2863947

C:\Log\Windows\hiscomponent\msg.vbs

MD5 14c531ba8e338bc48e95ed64aa8c273a
SHA1 d9a4054c110f808d2568b491a60f5fe5ed0c582f
SHA256 e784cec60d6b4b46c9fa2d13db2a635a43098ba42d9a9f4e70539ed07567d326
SHA512 f109c752fbade4880b95630338121db2170bcb92ebd6050b291834461615bf4c730d9943865b4fa5ffa9b40cc7f4b77addfdb2a231d636f289b468925c29e9b3

C:\Log\Windows\hiscomponent\regedit.reg

MD5 1e2ccca0527a525c77689d2f8635d659
SHA1 5e0d75a36335a6d1a6bf2b4944eedd394cd942aa
SHA256 0410eab826dcf52be4b44196054296f0b982f720524774976934cb7c919d5a15
SHA512 85c3d550b8e13019cefaf6c79bc4fc4fc65afb0b7a2a07ce5a6f1d1d80d1a87b44cceddf8fa27bcb6593748f8b64c2722886e9a4f9c0358fe0784ea12ecdb6e4

C:\Log\Windows\hiscomponent\rutserv.exe

MD5 80ce3eba6ae11d4e0a731f9eedd68f54
SHA1 9e6ca06d9896a84801ab4adbecbe91f91787bb32
SHA256 93730cdb5e9463ee8e1f480d94f412d9d2fee39ed1d3e332b0eff6f72b6ab695
SHA512 ee18d5e03d72cf16ee752336aee10b8979bba16ea731a5e5d236e0807c0cb857f4e4a7dcfdc75cbf9c58757d96432085082442fd771a9aac0af4b96acc853b4e

C:\Log\RDPCheck.exe

MD5 8f82226b2f24d470c02f6664f67f23f7
SHA1 66f40824b406c748846ef11e6b022958f8cbe48b
SHA256 5603338a1f8dbb46efb8e0869db3491d5db92f362711d6680f91ecc5d18bfadf
SHA512 04bc1f785bddf264699fb6bf6fce9652af8c95872f8fef93540f0b86df2e93ced910f01dc54a76a5425d2f5446d587df6ad20d8976fc4be7e9ce3511eb4b00ee

C:\Log\RDPConf.exe

MD5 1e4537b75cad6288f68d595d9c9b13c1
SHA1 9cc14ce3a3982376f454bd3833f4774d955d9bd3
SHA256 8b266c0945d003f5d0b2d6f59239e9dffb41dbccd1659d2c05bbf472ba1f0ccf
SHA512 8caa7b17ed4ec760d4e665ec8ffb543fb3a2287dbe4ba4b08daf9a46819ec662e4e3105e0f9d7ad94edb2d477551d2ca0ebce870d489a0713f8676978b0cc3ec

C:\Log\RDPWInst.exe

MD5 ce6a1d8fe9d16f4c4e2f41ef6cd3ad9b
SHA1 87a89f73faf22dbb6af94f0edbf4cf484673f572
SHA256 cb55b418cd219bcea3cb9dbfca4262d92affaabf34623e6f1e3ce8581c6cd5b2
SHA512 cea5f06d08bf5ee76aef21f05a1857dbfb240c02aff877df7a33b42d59571b4fc6358f0176e3e8ef53c8e06249e65c4e700a18e547c3071413591e4542ff0e9d

C:\Log\install.bat

MD5 cce1e07cf18ea79cc9e87922e9f5609a
SHA1 6800e3e5d42fc0e1d5834214df1958112066a626
SHA256 7afa7437b35cc7961ef51c3672e709f0aaf63b87badf1a884a6713e5749a9292
SHA512 b770d184fb371362fd6ba39e9c2462bb7fa8c7ffa4b1ffb55759fc37e5f06fb0f853e918dad5784d49cc33394c4f6295f5dda99f27304a5f0b34e9eb726fedf6

C:\Log\update.bat

MD5 29ca1c35075247b035af75c11cab78f1
SHA1 4f670d13d7532462f4b1e66d085ef8b9f065ff88
SHA256 353f2dc17a4e80564caa175f7170dbedc1b40f704444520ae671f78a5d1f2b6d
SHA512 3970adc72020194f93935fad2c17790170da7f0f4444e2bfc402f9924fdceaa4b6443e9871c3b8cda24089b84cbdcf185f0d31238c0be93c58e280cf36ab71a7

\Folder562\rutserv.exe

MD5 80ce3eba6ae11d4e0a731f9eedd68f54
SHA1 9e6ca06d9896a84801ab4adbecbe91f91787bb32
SHA256 93730cdb5e9463ee8e1f480d94f412d9d2fee39ed1d3e332b0eff6f72b6ab695
SHA512 ee18d5e03d72cf16ee752336aee10b8979bba16ea731a5e5d236e0807c0cb857f4e4a7dcfdc75cbf9c58757d96432085082442fd771a9aac0af4b96acc853b4e

\Folder562\rutserv.exe

MD5 80ce3eba6ae11d4e0a731f9eedd68f54
SHA1 9e6ca06d9896a84801ab4adbecbe91f91787bb32
SHA256 93730cdb5e9463ee8e1f480d94f412d9d2fee39ed1d3e332b0eff6f72b6ab695
SHA512 ee18d5e03d72cf16ee752336aee10b8979bba16ea731a5e5d236e0807c0cb857f4e4a7dcfdc75cbf9c58757d96432085082442fd771a9aac0af4b96acc853b4e

C:\Folder562\rutserv.exe

MD5 80ce3eba6ae11d4e0a731f9eedd68f54
SHA1 9e6ca06d9896a84801ab4adbecbe91f91787bb32
SHA256 93730cdb5e9463ee8e1f480d94f412d9d2fee39ed1d3e332b0eff6f72b6ab695
SHA512 ee18d5e03d72cf16ee752336aee10b8979bba16ea731a5e5d236e0807c0cb857f4e4a7dcfdc75cbf9c58757d96432085082442fd771a9aac0af4b96acc853b4e

C:\Folder562\rutserv.exe

MD5 80ce3eba6ae11d4e0a731f9eedd68f54
SHA1 9e6ca06d9896a84801ab4adbecbe91f91787bb32
SHA256 93730cdb5e9463ee8e1f480d94f412d9d2fee39ed1d3e332b0eff6f72b6ab695
SHA512 ee18d5e03d72cf16ee752336aee10b8979bba16ea731a5e5d236e0807c0cb857f4e4a7dcfdc75cbf9c58757d96432085082442fd771a9aac0af4b96acc853b4e

C:\Folder562\install.bat

MD5 cce1e07cf18ea79cc9e87922e9f5609a
SHA1 6800e3e5d42fc0e1d5834214df1958112066a626
SHA256 7afa7437b35cc7961ef51c3672e709f0aaf63b87badf1a884a6713e5749a9292
SHA512 b770d184fb371362fd6ba39e9c2462bb7fa8c7ffa4b1ffb55759fc37e5f06fb0f853e918dad5784d49cc33394c4f6295f5dda99f27304a5f0b34e9eb726fedf6

C:\Folder562\update.bat

MD5 29ca1c35075247b035af75c11cab78f1
SHA1 4f670d13d7532462f4b1e66d085ef8b9f065ff88
SHA256 353f2dc17a4e80564caa175f7170dbedc1b40f704444520ae671f78a5d1f2b6d
SHA512 3970adc72020194f93935fad2c17790170da7f0f4444e2bfc402f9924fdceaa4b6443e9871c3b8cda24089b84cbdcf185f0d31238c0be93c58e280cf36ab71a7

C:\Folder562\RDPWInst.exe

MD5 ce6a1d8fe9d16f4c4e2f41ef6cd3ad9b
SHA1 87a89f73faf22dbb6af94f0edbf4cf484673f572
SHA256 cb55b418cd219bcea3cb9dbfca4262d92affaabf34623e6f1e3ce8581c6cd5b2
SHA512 cea5f06d08bf5ee76aef21f05a1857dbfb240c02aff877df7a33b42d59571b4fc6358f0176e3e8ef53c8e06249e65c4e700a18e547c3071413591e4542ff0e9d

C:\Folder562\RDPConf.exe

MD5 1e4537b75cad6288f68d595d9c9b13c1
SHA1 9cc14ce3a3982376f454bd3833f4774d955d9bd3
SHA256 8b266c0945d003f5d0b2d6f59239e9dffb41dbccd1659d2c05bbf472ba1f0ccf
SHA512 8caa7b17ed4ec760d4e665ec8ffb543fb3a2287dbe4ba4b08daf9a46819ec662e4e3105e0f9d7ad94edb2d477551d2ca0ebce870d489a0713f8676978b0cc3ec

C:\Folder562\RDPCheck.exe

MD5 8f82226b2f24d470c02f6664f67f23f7
SHA1 66f40824b406c748846ef11e6b022958f8cbe48b
SHA256 5603338a1f8dbb46efb8e0869db3491d5db92f362711d6680f91ecc5d18bfadf
SHA512 04bc1f785bddf264699fb6bf6fce9652af8c95872f8fef93540f0b86df2e93ced910f01dc54a76a5425d2f5446d587df6ad20d8976fc4be7e9ce3511eb4b00ee

C:\Log\uninstall.bat

MD5 eccb8a01d0427ef29c2380d7dda399f3
SHA1 302601e99d6b02e2e84a0de5c0dce3df139cba31
SHA256 083cd340c800cc021d4a59388680ce0e7ab0f8b998e67def6a507070e7fa01b7
SHA512 78d51882fe04cb64f9f6a82b604ef20e4324e5bc37701747fa55b3c153baa5942774daf737ff204f9e75e81a745ed95cc7ec115da91b9e27e646ed41d3f103f9

memory/1120-100-0x0000000000230000-0x0000000000231000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-13 09:37

Reported

2022-02-13 09:39

Platform

win10v2004-en-20220113

Max time kernel

146s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe"

Signatures

RMS

trojan rat rms

UAC bypass

evasion trojan

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe N/A
N/A N/A C:\Folder562\rutserv.exe N/A

Modifies Windows Firewall

evasion

Sets file to hidden

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Services = "C:Folder562\\rutserv.exe" C:\Windows\SysWOW64\reg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WinSxS\pending.xml C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
File created C:\Windows\4w5tb68h7t987093f4trq893f4rw89etw.txt C:\Windows\SysWOW64\wscript.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\Logs\CBS\CBS.log C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Folder562\rutserv.exe N/A
N/A N/A C:\Folder562\rutserv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Folder562\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Folder562\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Folder562\rutserv.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Folder562\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4840 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 4840 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 4840 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 4800 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 4800 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 4800 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 2704 wrote to memory of 4244 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2704 wrote to memory of 4244 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2704 wrote to memory of 4244 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2704 wrote to memory of 3256 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2704 wrote to memory of 3256 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2704 wrote to memory of 3256 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2704 wrote to memory of 3092 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2704 wrote to memory of 3092 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2704 wrote to memory of 3092 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2704 wrote to memory of 4380 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2704 wrote to memory of 4380 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2704 wrote to memory of 4380 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2704 wrote to memory of 216 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2704 wrote to memory of 216 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2704 wrote to memory of 216 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 4244 wrote to memory of 884 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 4244 wrote to memory of 884 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 4244 wrote to memory of 884 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 884 wrote to memory of 5056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 884 wrote to memory of 5056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 884 wrote to memory of 5056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 884 wrote to memory of 4136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 884 wrote to memory of 4136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 884 wrote to memory of 4136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 884 wrote to memory of 4968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 884 wrote to memory of 4968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 884 wrote to memory of 4968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 884 wrote to memory of 1780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 884 wrote to memory of 1780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 884 wrote to memory of 1780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 884 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 884 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 884 wrote to memory of 1084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 884 wrote to memory of 1400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 884 wrote to memory of 1400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 884 wrote to memory of 1400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 884 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 884 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 884 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 884 wrote to memory of 2152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 884 wrote to memory of 2152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 884 wrote to memory of 2152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 884 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Folder562\rutserv.exe
PID 884 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Folder562\rutserv.exe
PID 884 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Folder562\rutserv.exe
PID 884 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 884 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 884 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 884 wrote to memory of 440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 884 wrote to memory of 440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 884 wrote to memory of 440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 884 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 884 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 884 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 884 wrote to memory of 2312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 884 wrote to memory of 2312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 884 wrote to memory of 2312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2312 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe

"C:\Users\Admin\AppData\Local\Temp\dd2fb445e78bd04256c869a2386d6c79771016ecc2da3f237b4e405e6b89ba33.exe"

C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

"C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe" -p284579G45398T745398T

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Log\install.vbs"

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Log\Windows\hiscomponent\install.bat" "

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Log"

C:\Windows\SysWOW64\netsh.exe

netsh advfirewall set allprofiles state off

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Log\Windows\hiscomponent\msg.vbs"

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\SysWOW64\reg.exe

reg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\DEVICEMAP" /f

C:\Windows\SysWOW64\reg.exe

reg delete "HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System" /f

C:\Windows\SysWOW64\regedit.exe

regedit /s "Windows\hiscomponent\regedit.reg"

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Folder562\rutserv.exe

rutserv.exe

C:\Windows\SysWOW64\reg.exe

Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Services" /t REG_SZ /d "C:Folder562\rutserv.exe" /f

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\Folder562\*.*"

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\Folder562"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\System32\cmd.exe /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

Network

Country Destination Domain Proto
US 52.109.12.19:443 tcp
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp
NL 8.238.21.126:80 tcp
US 20.42.73.26:443 tcp
NL 104.110.191.140:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

MD5 ef4bd1ef9388f417ff97617494078b5d
SHA1 e14337b0f3ebe062ff985dc8f92fab345aa853bc
SHA256 43f05d77571cb31e76b374c684d0fe7b9533a44bc820be889aff4e83db5361c7
SHA512 a195dea35c39a5f84631e024b55421c863b59632c6f6f904e004a637009ebba7c2e352e04cd2867639263310321ad0000c75fd8a94417ae2dd85869e86a5adc6

C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

MD5 ef4bd1ef9388f417ff97617494078b5d
SHA1 e14337b0f3ebe062ff985dc8f92fab345aa853bc
SHA256 43f05d77571cb31e76b374c684d0fe7b9533a44bc820be889aff4e83db5361c7
SHA512 a195dea35c39a5f84631e024b55421c863b59632c6f6f904e004a637009ebba7c2e352e04cd2867639263310321ad0000c75fd8a94417ae2dd85869e86a5adc6

C:\Log\install.vbs

MD5 6cab561732bb524984d25e29b8e93414
SHA1 73adabe3f5191ea01d8026b14285f0330f97fccc
SHA256 81d2721f8da28ab12ab7e6572dbfe39c78f1eb24b09ccd9ae816dbcb9f398e60
SHA512 7f001fcdf73056fb688c62be0f68b1b1c54e3f0aff05b8e03e0947716e2cd771fa9e12314cb3b6efd9f971c889405d6eccb83a6ee48280e135fc6e14e216e45d

C:\Log\Windows\hiscomponent\install.bat

MD5 f21ee20f3a6ff9b9ef9b289eb22f5cc6
SHA1 05f6ce53ea8803bc129ba2fffa07df12b4495e9f
SHA256 895c47f916a29847f5441f357d0009ae4f88dca62a11c87ea18f1572e3d72c10
SHA512 13a03018fb02d030fcb6e918a2dd8ffe4f2323ee3db36601a1c7180cad6d2638f57da174f9466eecdc3950d0cfdae88224eb5b0cacdec8e56a0c9343a2863947

memory/3424-134-0x0000023D93590000-0x0000023D935A0000-memory.dmp

memory/3424-135-0x0000023D93B20000-0x0000023D93B30000-memory.dmp

memory/3424-136-0x0000023D96210000-0x0000023D96214000-memory.dmp

C:\Log\Windows\hiscomponent\msg.vbs

MD5 14c531ba8e338bc48e95ed64aa8c273a
SHA1 d9a4054c110f808d2568b491a60f5fe5ed0c582f
SHA256 e784cec60d6b4b46c9fa2d13db2a635a43098ba42d9a9f4e70539ed07567d326
SHA512 f109c752fbade4880b95630338121db2170bcb92ebd6050b291834461615bf4c730d9943865b4fa5ffa9b40cc7f4b77addfdb2a231d636f289b468925c29e9b3

C:\Log\Windows\hiscomponent\regedit.reg

MD5 1e2ccca0527a525c77689d2f8635d659
SHA1 5e0d75a36335a6d1a6bf2b4944eedd394cd942aa
SHA256 0410eab826dcf52be4b44196054296f0b982f720524774976934cb7c919d5a15
SHA512 85c3d550b8e13019cefaf6c79bc4fc4fc65afb0b7a2a07ce5a6f1d1d80d1a87b44cceddf8fa27bcb6593748f8b64c2722886e9a4f9c0358fe0784ea12ecdb6e4

C:\Log\Windows\hiscomponent\rutserv.exe

MD5 80ce3eba6ae11d4e0a731f9eedd68f54
SHA1 9e6ca06d9896a84801ab4adbecbe91f91787bb32
SHA256 93730cdb5e9463ee8e1f480d94f412d9d2fee39ed1d3e332b0eff6f72b6ab695
SHA512 ee18d5e03d72cf16ee752336aee10b8979bba16ea731a5e5d236e0807c0cb857f4e4a7dcfdc75cbf9c58757d96432085082442fd771a9aac0af4b96acc853b4e

C:\Log\RDPCheck.exe

MD5 8f82226b2f24d470c02f6664f67f23f7
SHA1 66f40824b406c748846ef11e6b022958f8cbe48b
SHA256 5603338a1f8dbb46efb8e0869db3491d5db92f362711d6680f91ecc5d18bfadf
SHA512 04bc1f785bddf264699fb6bf6fce9652af8c95872f8fef93540f0b86df2e93ced910f01dc54a76a5425d2f5446d587df6ad20d8976fc4be7e9ce3511eb4b00ee

C:\Log\RDPConf.exe

MD5 1e4537b75cad6288f68d595d9c9b13c1
SHA1 9cc14ce3a3982376f454bd3833f4774d955d9bd3
SHA256 8b266c0945d003f5d0b2d6f59239e9dffb41dbccd1659d2c05bbf472ba1f0ccf
SHA512 8caa7b17ed4ec760d4e665ec8ffb543fb3a2287dbe4ba4b08daf9a46819ec662e4e3105e0f9d7ad94edb2d477551d2ca0ebce870d489a0713f8676978b0cc3ec

C:\Log\RDPWInst.exe

MD5 ce6a1d8fe9d16f4c4e2f41ef6cd3ad9b
SHA1 87a89f73faf22dbb6af94f0edbf4cf484673f572
SHA256 cb55b418cd219bcea3cb9dbfca4262d92affaabf34623e6f1e3ce8581c6cd5b2
SHA512 cea5f06d08bf5ee76aef21f05a1857dbfb240c02aff877df7a33b42d59571b4fc6358f0176e3e8ef53c8e06249e65c4e700a18e547c3071413591e4542ff0e9d

C:\Log\install.bat

MD5 cce1e07cf18ea79cc9e87922e9f5609a
SHA1 6800e3e5d42fc0e1d5834214df1958112066a626
SHA256 7afa7437b35cc7961ef51c3672e709f0aaf63b87badf1a884a6713e5749a9292
SHA512 b770d184fb371362fd6ba39e9c2462bb7fa8c7ffa4b1ffb55759fc37e5f06fb0f853e918dad5784d49cc33394c4f6295f5dda99f27304a5f0b34e9eb726fedf6

C:\Log\update.bat

MD5 29ca1c35075247b035af75c11cab78f1
SHA1 4f670d13d7532462f4b1e66d085ef8b9f065ff88
SHA256 353f2dc17a4e80564caa175f7170dbedc1b40f704444520ae671f78a5d1f2b6d
SHA512 3970adc72020194f93935fad2c17790170da7f0f4444e2bfc402f9924fdceaa4b6443e9871c3b8cda24089b84cbdcf185f0d31238c0be93c58e280cf36ab71a7

C:\Folder562\rutserv.exe

MD5 80ce3eba6ae11d4e0a731f9eedd68f54
SHA1 9e6ca06d9896a84801ab4adbecbe91f91787bb32
SHA256 93730cdb5e9463ee8e1f480d94f412d9d2fee39ed1d3e332b0eff6f72b6ab695
SHA512 ee18d5e03d72cf16ee752336aee10b8979bba16ea731a5e5d236e0807c0cb857f4e4a7dcfdc75cbf9c58757d96432085082442fd771a9aac0af4b96acc853b4e

C:\Folder562\rutserv.exe

MD5 80ce3eba6ae11d4e0a731f9eedd68f54
SHA1 9e6ca06d9896a84801ab4adbecbe91f91787bb32
SHA256 93730cdb5e9463ee8e1f480d94f412d9d2fee39ed1d3e332b0eff6f72b6ab695
SHA512 ee18d5e03d72cf16ee752336aee10b8979bba16ea731a5e5d236e0807c0cb857f4e4a7dcfdc75cbf9c58757d96432085082442fd771a9aac0af4b96acc853b4e

C:\Folder562\update.bat

MD5 29ca1c35075247b035af75c11cab78f1
SHA1 4f670d13d7532462f4b1e66d085ef8b9f065ff88
SHA256 353f2dc17a4e80564caa175f7170dbedc1b40f704444520ae671f78a5d1f2b6d
SHA512 3970adc72020194f93935fad2c17790170da7f0f4444e2bfc402f9924fdceaa4b6443e9871c3b8cda24089b84cbdcf185f0d31238c0be93c58e280cf36ab71a7

C:\Folder562\install.bat

MD5 cce1e07cf18ea79cc9e87922e9f5609a
SHA1 6800e3e5d42fc0e1d5834214df1958112066a626
SHA256 7afa7437b35cc7961ef51c3672e709f0aaf63b87badf1a884a6713e5749a9292
SHA512 b770d184fb371362fd6ba39e9c2462bb7fa8c7ffa4b1ffb55759fc37e5f06fb0f853e918dad5784d49cc33394c4f6295f5dda99f27304a5f0b34e9eb726fedf6

C:\Folder562\RDPWInst.exe

MD5 ce6a1d8fe9d16f4c4e2f41ef6cd3ad9b
SHA1 87a89f73faf22dbb6af94f0edbf4cf484673f572
SHA256 cb55b418cd219bcea3cb9dbfca4262d92affaabf34623e6f1e3ce8581c6cd5b2
SHA512 cea5f06d08bf5ee76aef21f05a1857dbfb240c02aff877df7a33b42d59571b4fc6358f0176e3e8ef53c8e06249e65c4e700a18e547c3071413591e4542ff0e9d

C:\Folder562\RDPConf.exe

MD5 1e4537b75cad6288f68d595d9c9b13c1
SHA1 9cc14ce3a3982376f454bd3833f4774d955d9bd3
SHA256 8b266c0945d003f5d0b2d6f59239e9dffb41dbccd1659d2c05bbf472ba1f0ccf
SHA512 8caa7b17ed4ec760d4e665ec8ffb543fb3a2287dbe4ba4b08daf9a46819ec662e4e3105e0f9d7ad94edb2d477551d2ca0ebce870d489a0713f8676978b0cc3ec

C:\Folder562\RDPCheck.exe

MD5 8f82226b2f24d470c02f6664f67f23f7
SHA1 66f40824b406c748846ef11e6b022958f8cbe48b
SHA256 5603338a1f8dbb46efb8e0869db3491d5db92f362711d6680f91ecc5d18bfadf
SHA512 04bc1f785bddf264699fb6bf6fce9652af8c95872f8fef93540f0b86df2e93ced910f01dc54a76a5425d2f5446d587df6ad20d8976fc4be7e9ce3511eb4b00ee

C:\Log\uninstall.bat

MD5 eccb8a01d0427ef29c2380d7dda399f3
SHA1 302601e99d6b02e2e84a0de5c0dce3df139cba31
SHA256 083cd340c800cc021d4a59388680ce0e7ab0f8b998e67def6a507070e7fa01b7
SHA512 78d51882fe04cb64f9f6a82b604ef20e4324e5bc37701747fa55b3c153baa5942774daf737ff204f9e75e81a745ed95cc7ec115da91b9e27e646ed41d3f103f9

memory/3724-153-0x0000000000C70000-0x0000000000C71000-memory.dmp