Malware Analysis Report

2024-11-30 19:36

Sample ID 220213-pnzjnabggl
Target 8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb
SHA256 8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb
Tags
rms rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb

Threat Level: Known bad

The file 8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb was found to be: Known bad.

Malicious Activity Summary

rms rat trojan upx

RMS

Executes dropped EXE

UPX packed file

Checks computer location settings

Loads dropped DLL

Drops file in System32 directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Runs .reg file with regedit

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Enumerates processes with tasklist

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-13 12:29

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-13 12:29

Reported

2022-02-13 12:31

Platform

win7-en-20211208

Max time kernel

146s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe"

Signatures

RMS

trojan rat rms

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\RManServer.exe N/A
N/A N/A C:\Windows\SysWOW64\RManServer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\dsfTheoraEncoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\dsfVorbisEncoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\HookDrv.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\Microsoft.VC80.CRT.manifest C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\msvcr80.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\msvcr80.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\RManWLN.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\RManWLN.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\RManWLN.dll C:\Windows\SysWOW64\RManServer.exe N/A
File opened for modification C:\Windows\SysWOW64\dsfOggMux.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\dsfVorbisEncoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\HookDrv.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\msvcp80.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\msvcp80.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\PushSource.ax C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\RManFUSClient.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\RManWLN.dll C:\Windows\SysWOW64\RManServer.exe N/A
File opened for modification C:\Windows\SysWOW64\dsfTheoraEncoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\Microsoft.VC80.CRT.manifest C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\RManFUSClient.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\RManIpcServer.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\dsfOggMux.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\PushSource.ax C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\RManIpcServer.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\cmd.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\RManIpcServer.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\RManWLN.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\PushSource.ax C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\Microsoft.VC80.CRT.manifest C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\dsfTheoraEncoder.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\RManServer.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\wuauclt.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\msvcp80.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\RManIpcServer.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\RManFUSClient.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\install.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\HookDrv.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\__tmp_rar_sfx_access_check_259377573 C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\wuauclt.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\dsfVorbisEncoder.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\msvcr80.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\RManServer.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\dsfTheoraEncoder.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\HookDrv.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\settings.reg C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\settings.reg C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\RManFUSClient.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\msvcr80.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\dsfOggMux.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\msvcp80.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\RManWLN.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\PushSource.ax C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\install.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\dsfVorbisEncoder.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\Microsoft.VC80.CRT.manifest C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\dsfOggMux.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\RManServer.exe N/A
N/A N/A C:\Windows\SysWOW64\RManServer.exe N/A
N/A N/A C:\Windows\SysWOW64\RManFUSClient.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\RManServer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\RManServer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\RManServer.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\RManServer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: 33 N/A C:\Windows\wuauclt.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\wuauclt.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1600 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe C:\Windows\install.exe
PID 1600 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe C:\Windows\install.exe
PID 1600 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe C:\Windows\install.exe
PID 1600 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe C:\Windows\install.exe
PID 1600 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe C:\Windows\install.exe
PID 1600 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe C:\Windows\install.exe
PID 1600 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe C:\Windows\install.exe
PID 1332 wrote to memory of 556 N/A C:\Windows\install.exe C:\Windows\SysWOW64\cmd.exe
PID 1332 wrote to memory of 556 N/A C:\Windows\install.exe C:\Windows\SysWOW64\cmd.exe
PID 1332 wrote to memory of 556 N/A C:\Windows\install.exe C:\Windows\SysWOW64\cmd.exe
PID 1332 wrote to memory of 556 N/A C:\Windows\install.exe C:\Windows\SysWOW64\cmd.exe
PID 1332 wrote to memory of 556 N/A C:\Windows\install.exe C:\Windows\SysWOW64\cmd.exe
PID 1332 wrote to memory of 556 N/A C:\Windows\install.exe C:\Windows\SysWOW64\cmd.exe
PID 1332 wrote to memory of 556 N/A C:\Windows\install.exe C:\Windows\SysWOW64\cmd.exe
PID 556 wrote to memory of 1736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 556 wrote to memory of 1736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 556 wrote to memory of 1736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 556 wrote to memory of 1736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 556 wrote to memory of 1188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 556 wrote to memory of 1188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 556 wrote to memory of 1188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 556 wrote to memory of 1188 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 556 wrote to memory of 1144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 556 wrote to memory of 1144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 556 wrote to memory of 1144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 556 wrote to memory of 1144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 556 wrote to memory of 1584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 556 wrote to memory of 1584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 556 wrote to memory of 1584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 556 wrote to memory of 1584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 556 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 556 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 556 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 556 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 928 wrote to memory of 1440 N/A C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\RManFUSClient.exe
PID 928 wrote to memory of 1440 N/A C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\RManFUSClient.exe
PID 928 wrote to memory of 1440 N/A C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\RManFUSClient.exe
PID 928 wrote to memory of 1440 N/A C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\RManFUSClient.exe
PID 928 wrote to memory of 1340 N/A C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\RManFUSClient.exe
PID 928 wrote to memory of 1340 N/A C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\RManFUSClient.exe
PID 928 wrote to memory of 1340 N/A C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\RManFUSClient.exe
PID 928 wrote to memory of 1340 N/A C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\RManFUSClient.exe
PID 556 wrote to memory of 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 556 wrote to memory of 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 556 wrote to memory of 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 556 wrote to memory of 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 556 wrote to memory of 1948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 556 wrote to memory of 1948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 556 wrote to memory of 1948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 556 wrote to memory of 1948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 556 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\wuauclt.exe
PID 556 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\wuauclt.exe
PID 556 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\wuauclt.exe
PID 556 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\wuauclt.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe

"C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe"

C:\Windows\install.exe

"C:\Windows\install.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\CB3B.tmp\install.bat" "

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\SysWOW64\RManServer.exe

"C:\Windows\System32\RManServer.exe" /silentinstall

C:\Windows\SysWOW64\RManServer.exe

"C:\Windows\System32\RManServer.exe" /firewall

C:\Windows\SysWOW64\regedit.exe

regedit /s "settings.reg"

C:\Windows\SysWOW64\RManServer.exe

"C:\Windows\System32\RManServer.exe" /start

C:\Windows\SysWOW64\RManServer.exe

C:\Windows\SysWOW64\RManServer.exe

C:\Windows\SysWOW64\RManFUSClient.exe

"C:\Windows\SysWOW64\RManFUSClient.exe"

C:\Windows\SysWOW64\RManFUSClient.exe

C:\Windows\SysWOW64\RManFUSClient.exe /tray

C:\Windows\SysWOW64\tasklist.exe

TaskList

C:\Windows\SysWOW64\findstr.exe

FindStr /BI "wuauclt.exe"

C:\Windows\wuauclt.exe

C:\Windows\wuauclt.exe

Network

Country Destination Domain Proto
DE 193.107.210.172:80 tcp
DE 193.107.210.172:80 tcp
DE 193.107.210.172:80 tcp
DE 193.107.210.172:80 tcp
DE 193.107.210.172:80 tcp
DE 193.107.210.172:80 tcp

Files

memory/1600-54-0x0000000075471000-0x0000000075473000-memory.dmp

C:\Windows\install.exe

MD5 57f34c24f971b9f0505a1ef7bd736495
SHA1 c1e8ccafae3ee70ebeea4bc39e0c8a72aaa522f7
SHA256 713769b5d51e56fbf2b54378a13ba8130aaf72be3de0b46f861da5e6258ca8a6
SHA512 e22c82ed86c1377327a74e15b61536f3ba4e82381ac693ef65bd575391810324fa974bf774c53709d89e79579b98c4d57c2cb95b06400c1ad7ec11f2176816ad

C:\Users\Admin\AppData\Local\Temp\CB3B.tmp\install.bat

MD5 5d290d9265af1cd075ce85d502f79848
SHA1 04a94aadb97c5db7e0d47a64578d8e015f0c1ef4
SHA256 a38c7d7099089fc18d178c069798cbb89e5735e2f187759aabf70110cc6f0018
SHA512 d87833102e94d33bfe726abfaacafc48db03a0231966cb4aedff24a252eba1f3327dc5b839f93345b059f6b7cb1662942c473d0a46d17de575b2eb7a257dc849

C:\Windows\dsfOggMux.dll

MD5 65889701199e41ae2abee652a232af6e
SHA1 3f76c39fde130b550013a4f13bfea2862b5628cf
SHA256 ef12a65d861a14aed28480946bc56fce479a21e9beac2983239eac6551d4f32e
SHA512 edbb1a1541a546d69e3fd64047a20613b47b3c08f2b639a53160b825c4a1462c4cc08a7bf417aa2db814f412fb16619c6c0d9364e21cc1c6d753ecf81f1d30f5

C:\Windows\dsfTheoraEncoder.dll

MD5 5f2fc8a0d96a1e796a4daae9465f5dd6
SHA1 224f13f3cbaa441c0cb6d6300715fda7136408ea
SHA256 f8686d8752801bb21c3d94ebe743758d79b9b59f33589ec8620e75a949d1871f
SHA512 da866275159b434205f259176c3937b7c77b14ed95d052152b05b984909e094bbd3b2702d3e874a4a1e1bc02fc5a8476ea43df8aee43542d56e832eacc8f54ad

C:\Windows\dsfVorbisEncoder.dll

MD5 086a9fd9179aad7911561eeff08cf7e2
SHA1 d390c28376e08769a06a4a8b46609b3a668f728b
SHA256 2cede6701b73a4ddd6422fde157ea54644a3a9598b3ba217cf2b30b595cf6282
SHA512 a98f593a306208da49e57e265daf37d6b1bd9f190fba45d65dd6cfa08801b760f540ea5cc443f9a1512eb5ddc01b1e4e28fc8ddecb9c0f1d42c884c4efaa7193

C:\Windows\HookDrv.dll

MD5 895d68b21984db50bfbffc88d289f5da
SHA1 2cc6625e1fcdeac9dceb6a0f381f52ba574365a8
SHA256 d3b6c19376b95cb9501181b42b7cbebd44b994d9652ef5fc103eec0d747b8e7d
SHA512 7d4d78b985c13fcd3ea835db7eab5373881257830e2f3f8cac3efc22b1e6d38ac99d1245539cf286beb6f67f077bb2582980c9f7c4250fd8546ff65edabcd68b

C:\Windows\wuauclt.exe

MD5 fa0207cfdf1a2bb71eedf22dff1f51b9
SHA1 9c5c6d6a5801d167d2904ed5ce9db55284efe1ea
SHA256 d16fee1ae038c26597d33055d7933f9b14166b3722b01866adb08d7f2ce62e8d
SHA512 fbc7c7fcabd43fa92328ff21f1d215279e639307ff56196662b4a2f05427186ddde39f7a2a120cf06ef26a38f11a1e01c67167a1c2b77361de512fdcb8ec691b

C:\Windows\Microsoft.VC80.CRT.manifest

MD5 d34b3da03c59f38a510eaa8ccc151ec7
SHA1 41b978588a9902f5e14b2b693973cb210ed900b2
SHA256 a50941352cb9d8f7ba6fbf7db5c8af95fb5ab76fc5d60cfd0984e558678908cc
SHA512 231a97761d652a0fc133b930abba07d456ba6cd70703a632fd7292f6ee00e50ef28562159e54acc3fc6cc118f766ea3f2f8392579ae31cc9c0c1c0dd761d36f7

C:\Windows\msvcp80.dll

MD5 8c53ccd787c381cd535d8dcca12584d8
SHA1 bc7ce60270a58450596aa3e3e5d0a99f731333d9
SHA256 384aaee2a103f7ed5c3ba59d4fb2ba22313aaa1fbc5d232c29dbc14d38e0b528
SHA512 e86c1426f1ad62d8f9bb1196dee647477f71b9aacafabb181f35e639c105779f95f1576b72c0a9216e876430383b8d44f27748b13c25e0548c254a0f641e4755

C:\Windows\msvcr80.dll

MD5 1169436ee42f860c7db37a4692b38f0e
SHA1 4ccd15bf2c1b1d541ac883b0f42497e8ced6a5a3
SHA256 9382aaed2db19cd75a70e38964f06c63f19f63c9dfb5a33b0c2d445bb41b6e46
SHA512 e06064eb95a2ab9c3343672072f5b3f5983fc8ea9e5c92f79e50ba2e259d6d5fa8ed97170dea6d0d032ea6c01e074eefaab850d28965c7522fb7e03d9c65eae0

C:\Windows\PushSource.ax

MD5 fb755251b8b9ac0f35494854f21ccdbf
SHA1 32de2cbfaf4a6d773f3b94af8e2a6cf66a01eabb
SHA256 ecbc5b49263df7950fd7329dfd44d5ad4da77845ffd1981afe3bd6798e1cd9f5
SHA512 a78d76ebefaa276f811b16b22caf84045982b305c13efb824db8b16b668fe07421486711567bfe83ecd4509a7b2896a0decaff624209c159f5a9e8b3e1dce215

C:\Windows\RManFUSClient.exe

MD5 90719b7ca701e60c9e2843b1ce5d83bb
SHA1 3ffeb62c929a402d9fe702e41ab6f17132f29042
SHA256 17d807a4087c763e6f60f35ef1e237e24df71c544ef9be51bef122877484e675
SHA512 cdb8257f7880a46110998fc1562f9ff6d476ab93c4d746e58aa34fdc8152436f7139c7d2fb6756e387d878e3f265823e938facd3542aab11f38f7a16784bc307

C:\Windows\RManIpcServer.dll

MD5 7d94872e3bbf6b60aec6bfe03f2423d7
SHA1 67dd0a451e5a5247d077ffe347f404a0334b2d10
SHA256 a39ffbec4e0df7ad55467e2954d7cbb47b8116c46e348d419daed65bf55744e7
SHA512 25835b2d7ed18e85ab2939e00c1de66dd7a79dd95c08b692f97f6eb9217cc43a665eeaae5e7d216581ef5fa418353b24fc9f7d9b9ff022a6057b9801968a827b

C:\Windows\RManServer.exe

MD5 3741871591255572c033bd5cf1dbc9f4
SHA1 76130a825c5b9c0a662f31fe4afd92914ba4653f
SHA256 5951f01b5f515a12da71ca61f4d2da4718201de53523a093b910701287454c77
SHA512 30fff32979a4366bead3cbd6a8f610019d1af9ce6324e0cf4785cf9b19562a6bdb18d71bd1fcb7b0922eae090c3a5cbd0725ef5d5dce3fec091b7620a448ae92

C:\Windows\RManWLN.dll

MD5 4ed36e9479243d9426b196f306d21d04
SHA1 e102a9b2a8101b1105f6e3996df3ce6af17f31f4
SHA256 f54a5149b1df0f141ca14844fd38458761ebd43bdd63e7f516a88370ac0c917d
SHA512 46d94a53d0871d7ff728a2b6afd39b83978b37241e7f3e01e0d6e79de57ff81f20e081f4f210efd294ce274e5a79934078de4662d4da974a3279e5d6c93df5af

C:\Windows\SysWOW64\RManServer.exe

MD5 3741871591255572c033bd5cf1dbc9f4
SHA1 76130a825c5b9c0a662f31fe4afd92914ba4653f
SHA256 5951f01b5f515a12da71ca61f4d2da4718201de53523a093b910701287454c77
SHA512 30fff32979a4366bead3cbd6a8f610019d1af9ce6324e0cf4785cf9b19562a6bdb18d71bd1fcb7b0922eae090c3a5cbd0725ef5d5dce3fec091b7620a448ae92

\Windows\SysWOW64\RManServer.exe

MD5 3741871591255572c033bd5cf1dbc9f4
SHA1 76130a825c5b9c0a662f31fe4afd92914ba4653f
SHA256 5951f01b5f515a12da71ca61f4d2da4718201de53523a093b910701287454c77
SHA512 30fff32979a4366bead3cbd6a8f610019d1af9ce6324e0cf4785cf9b19562a6bdb18d71bd1fcb7b0922eae090c3a5cbd0725ef5d5dce3fec091b7620a448ae92

memory/1188-74-0x00000000001C0000-0x00000000001C1000-memory.dmp

C:\Windows\SysWOW64\RManWLN.dll

MD5 4ed36e9479243d9426b196f306d21d04
SHA1 e102a9b2a8101b1105f6e3996df3ce6af17f31f4
SHA256 f54a5149b1df0f141ca14844fd38458761ebd43bdd63e7f516a88370ac0c917d
SHA512 46d94a53d0871d7ff728a2b6afd39b83978b37241e7f3e01e0d6e79de57ff81f20e081f4f210efd294ce274e5a79934078de4662d4da974a3279e5d6c93df5af

\Windows\SysWOW64\RManServer.exe

MD5 3741871591255572c033bd5cf1dbc9f4
SHA1 76130a825c5b9c0a662f31fe4afd92914ba4653f
SHA256 5951f01b5f515a12da71ca61f4d2da4718201de53523a093b910701287454c77
SHA512 30fff32979a4366bead3cbd6a8f610019d1af9ce6324e0cf4785cf9b19562a6bdb18d71bd1fcb7b0922eae090c3a5cbd0725ef5d5dce3fec091b7620a448ae92

C:\Windows\SysWOW64\RManServer.exe

MD5 3741871591255572c033bd5cf1dbc9f4
SHA1 76130a825c5b9c0a662f31fe4afd92914ba4653f
SHA256 5951f01b5f515a12da71ca61f4d2da4718201de53523a093b910701287454c77
SHA512 30fff32979a4366bead3cbd6a8f610019d1af9ce6324e0cf4785cf9b19562a6bdb18d71bd1fcb7b0922eae090c3a5cbd0725ef5d5dce3fec091b7620a448ae92

C:\Windows\settings.reg

MD5 6e2e1035b0f659550dd447c590ca17ae
SHA1 95c5cea96c5fc82c04ee768914b97866fa03d112
SHA256 d9033d4daf8b2dd31be536824200077f80920e601c8c32f9746ef9b820b895cf
SHA512 af289ede8373bd8072b687735c8f6574245b0876cc89b1208041c8989c4a006d8af2ed5f98916fa68d721f2006e54fe9b8a660f982125d8d7a4c548bbca31f03

\Windows\SysWOW64\RManServer.exe

MD5 3741871591255572c033bd5cf1dbc9f4
SHA1 76130a825c5b9c0a662f31fe4afd92914ba4653f
SHA256 5951f01b5f515a12da71ca61f4d2da4718201de53523a093b910701287454c77
SHA512 30fff32979a4366bead3cbd6a8f610019d1af9ce6324e0cf4785cf9b19562a6bdb18d71bd1fcb7b0922eae090c3a5cbd0725ef5d5dce3fec091b7620a448ae92

C:\Windows\SysWOW64\RManServer.exe

MD5 3741871591255572c033bd5cf1dbc9f4
SHA1 76130a825c5b9c0a662f31fe4afd92914ba4653f
SHA256 5951f01b5f515a12da71ca61f4d2da4718201de53523a093b910701287454c77
SHA512 30fff32979a4366bead3cbd6a8f610019d1af9ce6324e0cf4785cf9b19562a6bdb18d71bd1fcb7b0922eae090c3a5cbd0725ef5d5dce3fec091b7620a448ae92

C:\Windows\SysWOW64\RManServer.exe

MD5 3741871591255572c033bd5cf1dbc9f4
SHA1 76130a825c5b9c0a662f31fe4afd92914ba4653f
SHA256 5951f01b5f515a12da71ca61f4d2da4718201de53523a093b910701287454c77
SHA512 30fff32979a4366bead3cbd6a8f610019d1af9ce6324e0cf4785cf9b19562a6bdb18d71bd1fcb7b0922eae090c3a5cbd0725ef5d5dce3fec091b7620a448ae92

C:\Windows\SysWOW64\RManFUSClient.exe

MD5 90719b7ca701e60c9e2843b1ce5d83bb
SHA1 3ffeb62c929a402d9fe702e41ab6f17132f29042
SHA256 17d807a4087c763e6f60f35ef1e237e24df71c544ef9be51bef122877484e675
SHA512 cdb8257f7880a46110998fc1562f9ff6d476ab93c4d746e58aa34fdc8152436f7139c7d2fb6756e387d878e3f265823e938facd3542aab11f38f7a16784bc307

\Windows\SysWOW64\RManFUSClient.exe

MD5 90719b7ca701e60c9e2843b1ce5d83bb
SHA1 3ffeb62c929a402d9fe702e41ab6f17132f29042
SHA256 17d807a4087c763e6f60f35ef1e237e24df71c544ef9be51bef122877484e675
SHA512 cdb8257f7880a46110998fc1562f9ff6d476ab93c4d746e58aa34fdc8152436f7139c7d2fb6756e387d878e3f265823e938facd3542aab11f38f7a16784bc307

\Windows\SysWOW64\RManFUSClient.exe

MD5 90719b7ca701e60c9e2843b1ce5d83bb
SHA1 3ffeb62c929a402d9fe702e41ab6f17132f29042
SHA256 17d807a4087c763e6f60f35ef1e237e24df71c544ef9be51bef122877484e675
SHA512 cdb8257f7880a46110998fc1562f9ff6d476ab93c4d746e58aa34fdc8152436f7139c7d2fb6756e387d878e3f265823e938facd3542aab11f38f7a16784bc307

C:\Windows\SysWOW64\RManFUSClient.exe

MD5 90719b7ca701e60c9e2843b1ce5d83bb
SHA1 3ffeb62c929a402d9fe702e41ab6f17132f29042
SHA256 17d807a4087c763e6f60f35ef1e237e24df71c544ef9be51bef122877484e675
SHA512 cdb8257f7880a46110998fc1562f9ff6d476ab93c4d746e58aa34fdc8152436f7139c7d2fb6756e387d878e3f265823e938facd3542aab11f38f7a16784bc307

C:\Windows\SysWOW64\RManFUSClient.exe

MD5 90719b7ca701e60c9e2843b1ce5d83bb
SHA1 3ffeb62c929a402d9fe702e41ab6f17132f29042
SHA256 17d807a4087c763e6f60f35ef1e237e24df71c544ef9be51bef122877484e675
SHA512 cdb8257f7880a46110998fc1562f9ff6d476ab93c4d746e58aa34fdc8152436f7139c7d2fb6756e387d878e3f265823e938facd3542aab11f38f7a16784bc307

memory/928-93-0x0000000000230000-0x0000000000231000-memory.dmp

memory/1440-95-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/1340-94-0x0000000000230000-0x0000000000231000-memory.dmp

C:\Windows\wuauclt.exe

MD5 fa0207cfdf1a2bb71eedf22dff1f51b9
SHA1 9c5c6d6a5801d167d2904ed5ce9db55284efe1ea
SHA256 d16fee1ae038c26597d33055d7933f9b14166b3722b01866adb08d7f2ce62e8d
SHA512 fbc7c7fcabd43fa92328ff21f1d215279e639307ff56196662b4a2f05427186ddde39f7a2a120cf06ef26a38f11a1e01c67167a1c2b77361de512fdcb8ec691b

C:\Windows\install.exe

MD5 57f34c24f971b9f0505a1ef7bd736495
SHA1 c1e8ccafae3ee70ebeea4bc39e0c8a72aaa522f7
SHA256 713769b5d51e56fbf2b54378a13ba8130aaf72be3de0b46f861da5e6258ca8a6
SHA512 e22c82ed86c1377327a74e15b61536f3ba4e82381ac693ef65bd575391810324fa974bf774c53709d89e79579b98c4d57c2cb95b06400c1ad7ec11f2176816ad

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-13 12:29

Reported

2022-02-13 12:31

Platform

win10v2004-en-20220113

Max time kernel

150s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe"

Signatures

RMS

trojan rat rms

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Windows\install.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Microsoft.VC80.CRT.manifest C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\msvcp80.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\msvcr80.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\msvcr80.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\RManWLN.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\dsfTheoraEncoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\msvcp80.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\RManFUSClient.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\RManWLN.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\RManWLN.dll C:\Windows\SysWOW64\RManServer.exe N/A
File opened for modification C:\Windows\SysWOW64\dsfVorbisEncoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\PushSource.ax C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\RManFUSClient.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\RManIpcServer.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\Microsoft.VC80.CRT.manifest C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\dsfOggMux.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\dsfTheoraEncoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\dsfVorbisEncoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\HookDrv.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\SysWOW64\HookDrv.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\PushSource.ax C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\RManIpcServer.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\dsfOggMux.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\SysWOW64\RManWLN.dll C:\Windows\SysWOW64\RManServer.exe N/A
File opened for modification C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\cmd.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\dsfTheoraEncoder.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\msvcr80.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\WinSxS\pending.xml C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
File opened for modification C:\Windows\dsfOggMux.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\PushSource.ax C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\install.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\dsfVorbisEncoder.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\RManIpcServer.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\settings.reg C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\install.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\dsfVorbisEncoder.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\HookDrv.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\msvcp80.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\RManServer.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\dsfTheoraEncoder.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\msvcr80.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\Microsoft.VC80.CRT.manifest C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\RManFUSClient.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\RManWLN.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\Microsoft.VC80.CRT.manifest C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\msvcp80.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\RManWLN.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\settings.reg C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A
File created C:\Windows\RManFUSClient.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\wuauclt.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\dsfOggMux.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\HookDrv.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\Logs\CBS\CBS.log C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
File opened for modification C:\Windows\PushSource.ax C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File created C:\Windows\__tmp_rar_sfx_access_check_30243750 C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\RManServer.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\wuauclt.exe C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A
File created C:\Windows\RManIpcServer.dll C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe N/A

Enumerates physical storage devices

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\RManServer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\RManServer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\RManServer.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\RManServer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: 33 N/A C:\Windows\wuauclt.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\wuauclt.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4272 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe C:\Windows\install.exe
PID 4272 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe C:\Windows\install.exe
PID 4272 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe C:\Windows\install.exe
PID 4328 wrote to memory of 2404 N/A C:\Windows\install.exe C:\Windows\SysWOW64\cmd.exe
PID 4328 wrote to memory of 2404 N/A C:\Windows\install.exe C:\Windows\SysWOW64\cmd.exe
PID 4328 wrote to memory of 2404 N/A C:\Windows\install.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2404 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2404 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2404 wrote to memory of 5004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 2404 wrote to memory of 5004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 2404 wrote to memory of 5004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 2404 wrote to memory of 3588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 2404 wrote to memory of 3588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 2404 wrote to memory of 3588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 2404 wrote to memory of 3612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2404 wrote to memory of 3612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2404 wrote to memory of 3612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 2404 wrote to memory of 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 2404 wrote to memory of 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 2404 wrote to memory of 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\RManServer.exe
PID 3604 wrote to memory of 5076 N/A C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\RManFUSClient.exe
PID 3604 wrote to memory of 5076 N/A C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\RManFUSClient.exe
PID 3604 wrote to memory of 5076 N/A C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\RManFUSClient.exe
PID 3604 wrote to memory of 860 N/A C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\RManFUSClient.exe
PID 3604 wrote to memory of 860 N/A C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\RManFUSClient.exe
PID 3604 wrote to memory of 860 N/A C:\Windows\SysWOW64\RManServer.exe C:\Windows\SysWOW64\RManFUSClient.exe
PID 2404 wrote to memory of 4828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2404 wrote to memory of 4828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2404 wrote to memory of 4828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2404 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2404 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2404 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2404 wrote to memory of 3532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\wuauclt.exe
PID 2404 wrote to memory of 3532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\wuauclt.exe
PID 2404 wrote to memory of 3532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\wuauclt.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe

"C:\Users\Admin\AppData\Local\Temp\8bbd2bbc84768a44d7768caa388bfae9808f08fbbdb81dbd13cc83eeda9d71bb.exe"

C:\Windows\install.exe

"C:\Windows\install.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\800B.tmp\install.bat" "

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\SysWOW64\RManServer.exe

"C:\Windows\System32\RManServer.exe" /silentinstall

C:\Windows\SysWOW64\RManServer.exe

"C:\Windows\System32\RManServer.exe" /firewall

C:\Windows\SysWOW64\regedit.exe

regedit /s "settings.reg"

C:\Windows\SysWOW64\RManServer.exe

"C:\Windows\System32\RManServer.exe" /start

C:\Windows\SysWOW64\RManServer.exe

C:\Windows\SysWOW64\RManServer.exe

C:\Windows\SysWOW64\RManFUSClient.exe

"C:\Windows\SysWOW64\RManFUSClient.exe"

C:\Windows\SysWOW64\RManFUSClient.exe

C:\Windows\SysWOW64\RManFUSClient.exe /tray

C:\Windows\SysWOW64\tasklist.exe

TaskList

C:\Windows\SysWOW64\findstr.exe

FindStr /BI "wuauclt.exe"

C:\Windows\wuauclt.exe

C:\Windows\wuauclt.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

Network

Country Destination Domain Proto
NL 8.238.24.126:80 tcp
DE 193.107.210.172:80 tcp
DE 193.107.210.172:80 tcp
DE 193.107.210.172:80 tcp
DE 193.107.210.172:80 tcp
DE 193.107.210.172:80 tcp
DE 193.107.210.172:80 tcp

Files

C:\Windows\install.exe

MD5 57f34c24f971b9f0505a1ef7bd736495
SHA1 c1e8ccafae3ee70ebeea4bc39e0c8a72aaa522f7
SHA256 713769b5d51e56fbf2b54378a13ba8130aaf72be3de0b46f861da5e6258ca8a6
SHA512 e22c82ed86c1377327a74e15b61536f3ba4e82381ac693ef65bd575391810324fa974bf774c53709d89e79579b98c4d57c2cb95b06400c1ad7ec11f2176816ad

C:\Windows\install.exe

MD5 57f34c24f971b9f0505a1ef7bd736495
SHA1 c1e8ccafae3ee70ebeea4bc39e0c8a72aaa522f7
SHA256 713769b5d51e56fbf2b54378a13ba8130aaf72be3de0b46f861da5e6258ca8a6
SHA512 e22c82ed86c1377327a74e15b61536f3ba4e82381ac693ef65bd575391810324fa974bf774c53709d89e79579b98c4d57c2cb95b06400c1ad7ec11f2176816ad

C:\Users\Admin\AppData\Local\Temp\800B.tmp\install.bat

MD5 5d290d9265af1cd075ce85d502f79848
SHA1 04a94aadb97c5db7e0d47a64578d8e015f0c1ef4
SHA256 a38c7d7099089fc18d178c069798cbb89e5735e2f187759aabf70110cc6f0018
SHA512 d87833102e94d33bfe726abfaacafc48db03a0231966cb4aedff24a252eba1f3327dc5b839f93345b059f6b7cb1662942c473d0a46d17de575b2eb7a257dc849

C:\Windows\dsfOggMux.dll

MD5 65889701199e41ae2abee652a232af6e
SHA1 3f76c39fde130b550013a4f13bfea2862b5628cf
SHA256 ef12a65d861a14aed28480946bc56fce479a21e9beac2983239eac6551d4f32e
SHA512 edbb1a1541a546d69e3fd64047a20613b47b3c08f2b639a53160b825c4a1462c4cc08a7bf417aa2db814f412fb16619c6c0d9364e21cc1c6d753ecf81f1d30f5

C:\Windows\dsfTheoraEncoder.dll

MD5 5f2fc8a0d96a1e796a4daae9465f5dd6
SHA1 224f13f3cbaa441c0cb6d6300715fda7136408ea
SHA256 f8686d8752801bb21c3d94ebe743758d79b9b59f33589ec8620e75a949d1871f
SHA512 da866275159b434205f259176c3937b7c77b14ed95d052152b05b984909e094bbd3b2702d3e874a4a1e1bc02fc5a8476ea43df8aee43542d56e832eacc8f54ad

C:\Windows\dsfVorbisEncoder.dll

MD5 086a9fd9179aad7911561eeff08cf7e2
SHA1 d390c28376e08769a06a4a8b46609b3a668f728b
SHA256 2cede6701b73a4ddd6422fde157ea54644a3a9598b3ba217cf2b30b595cf6282
SHA512 a98f593a306208da49e57e265daf37d6b1bd9f190fba45d65dd6cfa08801b760f540ea5cc443f9a1512eb5ddc01b1e4e28fc8ddecb9c0f1d42c884c4efaa7193

C:\Windows\HookDrv.dll

MD5 895d68b21984db50bfbffc88d289f5da
SHA1 2cc6625e1fcdeac9dceb6a0f381f52ba574365a8
SHA256 d3b6c19376b95cb9501181b42b7cbebd44b994d9652ef5fc103eec0d747b8e7d
SHA512 7d4d78b985c13fcd3ea835db7eab5373881257830e2f3f8cac3efc22b1e6d38ac99d1245539cf286beb6f67f077bb2582980c9f7c4250fd8546ff65edabcd68b

C:\Windows\wuauclt.exe

MD5 fa0207cfdf1a2bb71eedf22dff1f51b9
SHA1 9c5c6d6a5801d167d2904ed5ce9db55284efe1ea
SHA256 d16fee1ae038c26597d33055d7933f9b14166b3722b01866adb08d7f2ce62e8d
SHA512 fbc7c7fcabd43fa92328ff21f1d215279e639307ff56196662b4a2f05427186ddde39f7a2a120cf06ef26a38f11a1e01c67167a1c2b77361de512fdcb8ec691b

C:\Windows\Microsoft.VC80.CRT.manifest

MD5 d34b3da03c59f38a510eaa8ccc151ec7
SHA1 41b978588a9902f5e14b2b693973cb210ed900b2
SHA256 a50941352cb9d8f7ba6fbf7db5c8af95fb5ab76fc5d60cfd0984e558678908cc
SHA512 231a97761d652a0fc133b930abba07d456ba6cd70703a632fd7292f6ee00e50ef28562159e54acc3fc6cc118f766ea3f2f8392579ae31cc9c0c1c0dd761d36f7

C:\Windows\msvcp80.dll

MD5 8c53ccd787c381cd535d8dcca12584d8
SHA1 bc7ce60270a58450596aa3e3e5d0a99f731333d9
SHA256 384aaee2a103f7ed5c3ba59d4fb2ba22313aaa1fbc5d232c29dbc14d38e0b528
SHA512 e86c1426f1ad62d8f9bb1196dee647477f71b9aacafabb181f35e639c105779f95f1576b72c0a9216e876430383b8d44f27748b13c25e0548c254a0f641e4755

C:\Windows\msvcr80.dll

MD5 1169436ee42f860c7db37a4692b38f0e
SHA1 4ccd15bf2c1b1d541ac883b0f42497e8ced6a5a3
SHA256 9382aaed2db19cd75a70e38964f06c63f19f63c9dfb5a33b0c2d445bb41b6e46
SHA512 e06064eb95a2ab9c3343672072f5b3f5983fc8ea9e5c92f79e50ba2e259d6d5fa8ed97170dea6d0d032ea6c01e074eefaab850d28965c7522fb7e03d9c65eae0

C:\Windows\RManFUSClient.exe

MD5 90719b7ca701e60c9e2843b1ce5d83bb
SHA1 3ffeb62c929a402d9fe702e41ab6f17132f29042
SHA256 17d807a4087c763e6f60f35ef1e237e24df71c544ef9be51bef122877484e675
SHA512 cdb8257f7880a46110998fc1562f9ff6d476ab93c4d746e58aa34fdc8152436f7139c7d2fb6756e387d878e3f265823e938facd3542aab11f38f7a16784bc307

C:\Windows\PushSource.ax

MD5 fb755251b8b9ac0f35494854f21ccdbf
SHA1 32de2cbfaf4a6d773f3b94af8e2a6cf66a01eabb
SHA256 ecbc5b49263df7950fd7329dfd44d5ad4da77845ffd1981afe3bd6798e1cd9f5
SHA512 a78d76ebefaa276f811b16b22caf84045982b305c13efb824db8b16b668fe07421486711567bfe83ecd4509a7b2896a0decaff624209c159f5a9e8b3e1dce215

C:\Windows\RManIpcServer.dll

MD5 7d94872e3bbf6b60aec6bfe03f2423d7
SHA1 67dd0a451e5a5247d077ffe347f404a0334b2d10
SHA256 a39ffbec4e0df7ad55467e2954d7cbb47b8116c46e348d419daed65bf55744e7
SHA512 25835b2d7ed18e85ab2939e00c1de66dd7a79dd95c08b692f97f6eb9217cc43a665eeaae5e7d216581ef5fa418353b24fc9f7d9b9ff022a6057b9801968a827b

C:\Windows\RManServer.exe

MD5 3741871591255572c033bd5cf1dbc9f4
SHA1 76130a825c5b9c0a662f31fe4afd92914ba4653f
SHA256 5951f01b5f515a12da71ca61f4d2da4718201de53523a093b910701287454c77
SHA512 30fff32979a4366bead3cbd6a8f610019d1af9ce6324e0cf4785cf9b19562a6bdb18d71bd1fcb7b0922eae090c3a5cbd0725ef5d5dce3fec091b7620a448ae92

C:\Windows\RManWLN.dll

MD5 4ed36e9479243d9426b196f306d21d04
SHA1 e102a9b2a8101b1105f6e3996df3ce6af17f31f4
SHA256 f54a5149b1df0f141ca14844fd38458761ebd43bdd63e7f516a88370ac0c917d
SHA512 46d94a53d0871d7ff728a2b6afd39b83978b37241e7f3e01e0d6e79de57ff81f20e081f4f210efd294ce274e5a79934078de4662d4da974a3279e5d6c93df5af

C:\Windows\SysWOW64\RManServer.exe

MD5 3741871591255572c033bd5cf1dbc9f4
SHA1 76130a825c5b9c0a662f31fe4afd92914ba4653f
SHA256 5951f01b5f515a12da71ca61f4d2da4718201de53523a093b910701287454c77
SHA512 30fff32979a4366bead3cbd6a8f610019d1af9ce6324e0cf4785cf9b19562a6bdb18d71bd1fcb7b0922eae090c3a5cbd0725ef5d5dce3fec091b7620a448ae92

C:\Windows\SysWOW64\RManServer.exe

MD5 3741871591255572c033bd5cf1dbc9f4
SHA1 76130a825c5b9c0a662f31fe4afd92914ba4653f
SHA256 5951f01b5f515a12da71ca61f4d2da4718201de53523a093b910701287454c77
SHA512 30fff32979a4366bead3cbd6a8f610019d1af9ce6324e0cf4785cf9b19562a6bdb18d71bd1fcb7b0922eae090c3a5cbd0725ef5d5dce3fec091b7620a448ae92

C:\Windows\SysWOW64\RManWLN.dll

MD5 4ed36e9479243d9426b196f306d21d04
SHA1 e102a9b2a8101b1105f6e3996df3ce6af17f31f4
SHA256 f54a5149b1df0f141ca14844fd38458761ebd43bdd63e7f516a88370ac0c917d
SHA512 46d94a53d0871d7ff728a2b6afd39b83978b37241e7f3e01e0d6e79de57ff81f20e081f4f210efd294ce274e5a79934078de4662d4da974a3279e5d6c93df5af

C:\Windows\SysWOW64\RManServer.exe

MD5 3741871591255572c033bd5cf1dbc9f4
SHA1 76130a825c5b9c0a662f31fe4afd92914ba4653f
SHA256 5951f01b5f515a12da71ca61f4d2da4718201de53523a093b910701287454c77
SHA512 30fff32979a4366bead3cbd6a8f610019d1af9ce6324e0cf4785cf9b19562a6bdb18d71bd1fcb7b0922eae090c3a5cbd0725ef5d5dce3fec091b7620a448ae92

memory/3588-150-0x00000000024E0000-0x00000000024E1000-memory.dmp

C:\Windows\settings.reg

MD5 6e2e1035b0f659550dd447c590ca17ae
SHA1 95c5cea96c5fc82c04ee768914b97866fa03d112
SHA256 d9033d4daf8b2dd31be536824200077f80920e601c8c32f9746ef9b820b895cf
SHA512 af289ede8373bd8072b687735c8f6574245b0876cc89b1208041c8989c4a006d8af2ed5f98916fa68d721f2006e54fe9b8a660f982125d8d7a4c548bbca31f03

C:\Windows\SysWOW64\RManServer.exe

MD5 3741871591255572c033bd5cf1dbc9f4
SHA1 76130a825c5b9c0a662f31fe4afd92914ba4653f
SHA256 5951f01b5f515a12da71ca61f4d2da4718201de53523a093b910701287454c77
SHA512 30fff32979a4366bead3cbd6a8f610019d1af9ce6324e0cf4785cf9b19562a6bdb18d71bd1fcb7b0922eae090c3a5cbd0725ef5d5dce3fec091b7620a448ae92

C:\Windows\SysWOW64\RManServer.exe

MD5 3741871591255572c033bd5cf1dbc9f4
SHA1 76130a825c5b9c0a662f31fe4afd92914ba4653f
SHA256 5951f01b5f515a12da71ca61f4d2da4718201de53523a093b910701287454c77
SHA512 30fff32979a4366bead3cbd6a8f610019d1af9ce6324e0cf4785cf9b19562a6bdb18d71bd1fcb7b0922eae090c3a5cbd0725ef5d5dce3fec091b7620a448ae92

memory/3644-154-0x0000000000940000-0x0000000000941000-memory.dmp

C:\Windows\SysWOW64\RManFUSClient.exe

MD5 90719b7ca701e60c9e2843b1ce5d83bb
SHA1 3ffeb62c929a402d9fe702e41ab6f17132f29042
SHA256 17d807a4087c763e6f60f35ef1e237e24df71c544ef9be51bef122877484e675
SHA512 cdb8257f7880a46110998fc1562f9ff6d476ab93c4d746e58aa34fdc8152436f7139c7d2fb6756e387d878e3f265823e938facd3542aab11f38f7a16784bc307

memory/3604-155-0x0000000000930000-0x0000000000931000-memory.dmp

C:\Windows\SysWOW64\RManFUSClient.exe

MD5 90719b7ca701e60c9e2843b1ce5d83bb
SHA1 3ffeb62c929a402d9fe702e41ab6f17132f29042
SHA256 17d807a4087c763e6f60f35ef1e237e24df71c544ef9be51bef122877484e675
SHA512 cdb8257f7880a46110998fc1562f9ff6d476ab93c4d746e58aa34fdc8152436f7139c7d2fb6756e387d878e3f265823e938facd3542aab11f38f7a16784bc307

C:\Windows\SysWOW64\RManFUSClient.exe

MD5 90719b7ca701e60c9e2843b1ce5d83bb
SHA1 3ffeb62c929a402d9fe702e41ab6f17132f29042
SHA256 17d807a4087c763e6f60f35ef1e237e24df71c544ef9be51bef122877484e675
SHA512 cdb8257f7880a46110998fc1562f9ff6d476ab93c4d746e58aa34fdc8152436f7139c7d2fb6756e387d878e3f265823e938facd3542aab11f38f7a16784bc307

memory/860-159-0x00000000008D0000-0x00000000008D1000-memory.dmp

memory/5076-160-0x00000000025B0000-0x00000000025B1000-memory.dmp

C:\Windows\wuauclt.exe

MD5 fa0207cfdf1a2bb71eedf22dff1f51b9
SHA1 9c5c6d6a5801d167d2904ed5ce9db55284efe1ea
SHA256 d16fee1ae038c26597d33055d7933f9b14166b3722b01866adb08d7f2ce62e8d
SHA512 fbc7c7fcabd43fa92328ff21f1d215279e639307ff56196662b4a2f05427186ddde39f7a2a120cf06ef26a38f11a1e01c67167a1c2b77361de512fdcb8ec691b

memory/964-162-0x000002D192FA0000-0x000002D192FB0000-memory.dmp

memory/964-163-0x000002D193760000-0x000002D193770000-memory.dmp

memory/964-164-0x000002D196380000-0x000002D196384000-memory.dmp