Malware Analysis Report

2024-11-30 19:36

Sample ID 220213-qz3wwscdfn
Target 6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500
SHA256 6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500
Tags
rms evasion rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500

Threat Level: Known bad

The file 6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500 was found to be: Known bad.

Malicious Activity Summary

rms evasion rat trojan

RMS

Sets file to hidden

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Drops file in Windows directory

Enumerates physical storage devices

Delays execution with timeout.exe

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Runs .reg file with regedit

Views/modifies file attributes

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-13 13:42

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-13 13:42

Reported

2022-02-13 13:45

Platform

win10v2004-en-20220113

Max time kernel

149s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe"

Signatures

RMS

trojan rat rms

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe N/A
N/A N/A C:\Folder768\rutserv.exe N/A

Sets file to hidden

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\wscript.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\WinSxS\pending.xml C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
File created C:\Windows\4w5tb68h7t987093f4trq893f4rw89etw.txt C:\Windows\SysWOW64\wscript.exe N/A
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\Logs\CBS\CBS.log C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Folder768\rutserv.exe N/A
N/A N/A C:\Folder768\rutserv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Folder768\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Folder768\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Folder768\rutserv.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Folder768\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3128 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 3128 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 3128 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 3428 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 3428 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 3428 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 2368 wrote to memory of 1676 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2368 wrote to memory of 1676 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2368 wrote to memory of 1676 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2368 wrote to memory of 2780 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2368 wrote to memory of 2780 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2368 wrote to memory of 2780 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2368 wrote to memory of 3204 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2368 wrote to memory of 3204 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 2368 wrote to memory of 3204 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 1676 wrote to memory of 4888 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1676 wrote to memory of 4888 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1676 wrote to memory of 4888 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 4888 wrote to memory of 4764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4888 wrote to memory of 4764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4888 wrote to memory of 4764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4888 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4888 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4888 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4888 wrote to memory of 3948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4888 wrote to memory of 3948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4888 wrote to memory of 3948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4888 wrote to memory of 4348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4888 wrote to memory of 4348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4888 wrote to memory of 4348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4888 wrote to memory of 2332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 4888 wrote to memory of 2332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 4888 wrote to memory of 2332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 4888 wrote to memory of 2016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4888 wrote to memory of 2016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4888 wrote to memory of 2016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4888 wrote to memory of 3752 N/A C:\Windows\SysWOW64\cmd.exe C:\Folder768\rutserv.exe
PID 4888 wrote to memory of 3752 N/A C:\Windows\SysWOW64\cmd.exe C:\Folder768\rutserv.exe
PID 4888 wrote to memory of 3752 N/A C:\Windows\SysWOW64\cmd.exe C:\Folder768\rutserv.exe
PID 4888 wrote to memory of 4796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4888 wrote to memory of 4796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4888 wrote to memory of 4796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4888 wrote to memory of 220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4888 wrote to memory of 220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4888 wrote to memory of 220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe

"C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe"

C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

"C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe" -p284579G45398T745398T

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Log\install.vbs"

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Log\Windows\hiscomponent\install.bat" "

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Log"

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\SysWOW64\reg.exe

reg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\DEVICEMAP" /f

C:\Windows\SysWOW64\reg.exe

reg delete "HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System" /f

C:\Windows\SysWOW64\regedit.exe

regedit /s "Windows\hiscomponent\regedit.reg"

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Folder768\rutserv.exe

rutserv.exe

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\Folder768\*.*"

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\Folder768"

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp
NL 104.110.191.133:80 tcp
NL 104.110.191.133:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

MD5 c4f6d81423575991bef469365913ce9a
SHA1 c4841554435e23b1b19badbf2b2bda72678addb1
SHA256 321e73140432b5811dd26c1bb3cf990cdece47fad76bb8f1fed3c11a8ea13816
SHA512 047a114b052c5e81a586d7aae5b99fd7b605dd76f329f57619e12fabde6792c873c71d3cc4081f7194898f4aac0ee7da9606df6c25483a0bf3c2f66e900d36b0

C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

MD5 c4f6d81423575991bef469365913ce9a
SHA1 c4841554435e23b1b19badbf2b2bda72678addb1
SHA256 321e73140432b5811dd26c1bb3cf990cdece47fad76bb8f1fed3c11a8ea13816
SHA512 047a114b052c5e81a586d7aae5b99fd7b605dd76f329f57619e12fabde6792c873c71d3cc4081f7194898f4aac0ee7da9606df6c25483a0bf3c2f66e900d36b0

C:\Log\install.vbs

MD5 6cab561732bb524984d25e29b8e93414
SHA1 73adabe3f5191ea01d8026b14285f0330f97fccc
SHA256 81d2721f8da28ab12ab7e6572dbfe39c78f1eb24b09ccd9ae816dbcb9f398e60
SHA512 7f001fcdf73056fb688c62be0f68b1b1c54e3f0aff05b8e03e0947716e2cd771fa9e12314cb3b6efd9f971c889405d6eccb83a6ee48280e135fc6e14e216e45d

C:\Log\Windows\hiscomponent\install.bat

MD5 33ada5cdc4c57e3f695901fe4b5c7e0d
SHA1 570c1e7bb377eccbb22c9b38e3bef119b67dccf8
SHA256 2d2dcf87267c10290c121cb05178ff9f890e2e6eba34768d323872537d9e50e2
SHA512 c62e9487acf033fa325d87c6b9e9d574bac947cc5c47140365d7e517d776b5e6e7be09edf10a1aced7e052690bbda5bb5383a419afedbe5a5af5e2d5e38ea65e

C:\Log\Windows\hiscomponent\regedit.reg

MD5 a66500e88dccc574a92e495dbb51370d
SHA1 1708c9af563c32a67ada199567eb1b89b8d49ddd
SHA256 0fe3a8827afc275e117c34c7aa92405dc330b2a2861c15b4f9a124471589c1c0
SHA512 b26aad9b7fe1daa15f93c882009a1b7364e8be833ad0588fbca29119db10d5695191d283b69571e97e0e130b3a6529ab873fefac1f23b16a76d77d9e9f8aea64

memory/2444-135-0x000001BB08180000-0x000001BB08190000-memory.dmp

memory/2444-136-0x000001BB08960000-0x000001BB08970000-memory.dmp

memory/2444-137-0x000001BB0B560000-0x000001BB0B564000-memory.dmp

C:\Log\rutserv.exe

MD5 88c4a86ac204ad1d217c78579308c1b0
SHA1 8a4a615cd3b7e485b2d4f0262116e5fa60bd345c
SHA256 8fe667e5f864d20abdc075d071d88455297228753ac11191dc7979aee6360393
SHA512 e55995ccf776c5033e2be8f3bf2906ddbc076a19b2f7d30ca0d4dec7d76fbbc3c61142ff9bc0d1e32f43c71daba3f668899705b6137f9e7c37ed0fdc626d3808

C:\Log\RDPCheck.exe

MD5 8f82226b2f24d470c02f6664f67f23f7
SHA1 66f40824b406c748846ef11e6b022958f8cbe48b
SHA256 5603338a1f8dbb46efb8e0869db3491d5db92f362711d6680f91ecc5d18bfadf
SHA512 04bc1f785bddf264699fb6bf6fce9652af8c95872f8fef93540f0b86df2e93ced910f01dc54a76a5425d2f5446d587df6ad20d8976fc4be7e9ce3511eb4b00ee

C:\Log\RDPConf.exe

MD5 1e4537b75cad6288f68d595d9c9b13c1
SHA1 9cc14ce3a3982376f454bd3833f4774d955d9bd3
SHA256 8b266c0945d003f5d0b2d6f59239e9dffb41dbccd1659d2c05bbf472ba1f0ccf
SHA512 8caa7b17ed4ec760d4e665ec8ffb543fb3a2287dbe4ba4b08daf9a46819ec662e4e3105e0f9d7ad94edb2d477551d2ca0ebce870d489a0713f8676978b0cc3ec

C:\Log\update.bat

MD5 29ca1c35075247b035af75c11cab78f1
SHA1 4f670d13d7532462f4b1e66d085ef8b9f065ff88
SHA256 353f2dc17a4e80564caa175f7170dbedc1b40f704444520ae671f78a5d1f2b6d
SHA512 3970adc72020194f93935fad2c17790170da7f0f4444e2bfc402f9924fdceaa4b6443e9871c3b8cda24089b84cbdcf185f0d31238c0be93c58e280cf36ab71a7

C:\Log\install.bat

MD5 cce1e07cf18ea79cc9e87922e9f5609a
SHA1 6800e3e5d42fc0e1d5834214df1958112066a626
SHA256 7afa7437b35cc7961ef51c3672e709f0aaf63b87badf1a884a6713e5749a9292
SHA512 b770d184fb371362fd6ba39e9c2462bb7fa8c7ffa4b1ffb55759fc37e5f06fb0f853e918dad5784d49cc33394c4f6295f5dda99f27304a5f0b34e9eb726fedf6

C:\Log\RDPWInst.exe

MD5 ce6a1d8fe9d16f4c4e2f41ef6cd3ad9b
SHA1 87a89f73faf22dbb6af94f0edbf4cf484673f572
SHA256 cb55b418cd219bcea3cb9dbfca4262d92affaabf34623e6f1e3ce8581c6cd5b2
SHA512 cea5f06d08bf5ee76aef21f05a1857dbfb240c02aff877df7a33b42d59571b4fc6358f0176e3e8ef53c8e06249e65c4e700a18e547c3071413591e4542ff0e9d

C:\Folder768\rutserv.exe

MD5 88c4a86ac204ad1d217c78579308c1b0
SHA1 8a4a615cd3b7e485b2d4f0262116e5fa60bd345c
SHA256 8fe667e5f864d20abdc075d071d88455297228753ac11191dc7979aee6360393
SHA512 e55995ccf776c5033e2be8f3bf2906ddbc076a19b2f7d30ca0d4dec7d76fbbc3c61142ff9bc0d1e32f43c71daba3f668899705b6137f9e7c37ed0fdc626d3808

C:\Folder768\rutserv.exe

MD5 88c4a86ac204ad1d217c78579308c1b0
SHA1 8a4a615cd3b7e485b2d4f0262116e5fa60bd345c
SHA256 8fe667e5f864d20abdc075d071d88455297228753ac11191dc7979aee6360393
SHA512 e55995ccf776c5033e2be8f3bf2906ddbc076a19b2f7d30ca0d4dec7d76fbbc3c61142ff9bc0d1e32f43c71daba3f668899705b6137f9e7c37ed0fdc626d3808

C:\Folder768\RDPCheck.exe

MD5 8f82226b2f24d470c02f6664f67f23f7
SHA1 66f40824b406c748846ef11e6b022958f8cbe48b
SHA256 5603338a1f8dbb46efb8e0869db3491d5db92f362711d6680f91ecc5d18bfadf
SHA512 04bc1f785bddf264699fb6bf6fce9652af8c95872f8fef93540f0b86df2e93ced910f01dc54a76a5425d2f5446d587df6ad20d8976fc4be7e9ce3511eb4b00ee

C:\Folder768\update.bat

MD5 29ca1c35075247b035af75c11cab78f1
SHA1 4f670d13d7532462f4b1e66d085ef8b9f065ff88
SHA256 353f2dc17a4e80564caa175f7170dbedc1b40f704444520ae671f78a5d1f2b6d
SHA512 3970adc72020194f93935fad2c17790170da7f0f4444e2bfc402f9924fdceaa4b6443e9871c3b8cda24089b84cbdcf185f0d31238c0be93c58e280cf36ab71a7

C:\Folder768\RDPWInst.exe

MD5 ce6a1d8fe9d16f4c4e2f41ef6cd3ad9b
SHA1 87a89f73faf22dbb6af94f0edbf4cf484673f572
SHA256 cb55b418cd219bcea3cb9dbfca4262d92affaabf34623e6f1e3ce8581c6cd5b2
SHA512 cea5f06d08bf5ee76aef21f05a1857dbfb240c02aff877df7a33b42d59571b4fc6358f0176e3e8ef53c8e06249e65c4e700a18e547c3071413591e4542ff0e9d

C:\Folder768\RDPConf.exe

MD5 1e4537b75cad6288f68d595d9c9b13c1
SHA1 9cc14ce3a3982376f454bd3833f4774d955d9bd3
SHA256 8b266c0945d003f5d0b2d6f59239e9dffb41dbccd1659d2c05bbf472ba1f0ccf
SHA512 8caa7b17ed4ec760d4e665ec8ffb543fb3a2287dbe4ba4b08daf9a46819ec662e4e3105e0f9d7ad94edb2d477551d2ca0ebce870d489a0713f8676978b0cc3ec

C:\Folder768\install.bat

MD5 cce1e07cf18ea79cc9e87922e9f5609a
SHA1 6800e3e5d42fc0e1d5834214df1958112066a626
SHA256 7afa7437b35cc7961ef51c3672e709f0aaf63b87badf1a884a6713e5749a9292
SHA512 b770d184fb371362fd6ba39e9c2462bb7fa8c7ffa4b1ffb55759fc37e5f06fb0f853e918dad5784d49cc33394c4f6295f5dda99f27304a5f0b34e9eb726fedf6

C:\Log\uninstall.bat

MD5 eccb8a01d0427ef29c2380d7dda399f3
SHA1 302601e99d6b02e2e84a0de5c0dce3df139cba31
SHA256 083cd340c800cc021d4a59388680ce0e7ab0f8b998e67def6a507070e7fa01b7
SHA512 78d51882fe04cb64f9f6a82b604ef20e4324e5bc37701747fa55b3c153baa5942774daf737ff204f9e75e81a745ed95cc7ec115da91b9e27e646ed41d3f103f9

memory/3752-152-0x0000000000400000-0x0000000000A97000-memory.dmp

memory/3752-153-0x0000000000030000-0x0000000000032000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-13 13:42

Reported

2022-02-13 13:45

Platform

win7-en-20211208

Max time kernel

146s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe"

Signatures

RMS

trojan rat rms

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe N/A
N/A N/A C:\Folder768\rutserv.exe N/A

Sets file to hidden

evasion

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\4w5tb68h7t987093f4trq893f4rw89etw.txt C:\Windows\SysWOW64\wscript.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Folder768\rutserv.exe N/A
N/A N/A C:\Folder768\rutserv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Folder768\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Folder768\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Folder768\rutserv.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Folder768\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1528 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 1528 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 1528 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 1528 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 1528 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 1528 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 1528 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
PID 1364 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 1364 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 1364 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 1364 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 1364 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 1364 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 1364 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe C:\Windows\SysWOW64\WScript.exe
PID 884 wrote to memory of 1136 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1136 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1136 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1136 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1136 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1136 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1136 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 704 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 704 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 704 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 704 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 704 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 704 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 704 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 284 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 284 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 284 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 284 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 284 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 284 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 284 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 980 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 980 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 980 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 980 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 980 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 980 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 980 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 436 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 436 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 436 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 436 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 436 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 436 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 436 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1544 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1544 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1544 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1544 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1544 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1544 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 884 wrote to memory of 1544 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\wscript.exe
PID 1508 wrote to memory of 1208 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe

"C:\Users\Admin\AppData\Local\Temp\6016d62ee9ee6150f925bfa2369509d66f244c7912a9a3e0f44f15fd29054500.exe"

C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

"C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe" -p284579G45398T745398T

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Log\install.vbs"

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Log\Windows\hiscomponent\install.bat" "

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Log"

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\SysWOW64\reg.exe

reg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\DEVICEMAP" /f

C:\Windows\SysWOW64\reg.exe

reg delete "HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System" /f

C:\Windows\SysWOW64\regedit.exe

regedit /s "Windows\hiscomponent\regedit.reg"

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Folder768\rutserv.exe

rutserv.exe

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\Folder768\*.*"

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\Folder768"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

memory/1528-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

MD5 c4f6d81423575991bef469365913ce9a
SHA1 c4841554435e23b1b19badbf2b2bda72678addb1
SHA256 321e73140432b5811dd26c1bb3cf990cdece47fad76bb8f1fed3c11a8ea13816
SHA512 047a114b052c5e81a586d7aae5b99fd7b605dd76f329f57619e12fabde6792c873c71d3cc4081f7194898f4aac0ee7da9606df6c25483a0bf3c2f66e900d36b0

\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

MD5 c4f6d81423575991bef469365913ce9a
SHA1 c4841554435e23b1b19badbf2b2bda72678addb1
SHA256 321e73140432b5811dd26c1bb3cf990cdece47fad76bb8f1fed3c11a8ea13816
SHA512 047a114b052c5e81a586d7aae5b99fd7b605dd76f329f57619e12fabde6792c873c71d3cc4081f7194898f4aac0ee7da9606df6c25483a0bf3c2f66e900d36b0

\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

MD5 c4f6d81423575991bef469365913ce9a
SHA1 c4841554435e23b1b19badbf2b2bda72678addb1
SHA256 321e73140432b5811dd26c1bb3cf990cdece47fad76bb8f1fed3c11a8ea13816
SHA512 047a114b052c5e81a586d7aae5b99fd7b605dd76f329f57619e12fabde6792c873c71d3cc4081f7194898f4aac0ee7da9606df6c25483a0bf3c2f66e900d36b0

C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

MD5 c4f6d81423575991bef469365913ce9a
SHA1 c4841554435e23b1b19badbf2b2bda72678addb1
SHA256 321e73140432b5811dd26c1bb3cf990cdece47fad76bb8f1fed3c11a8ea13816
SHA512 047a114b052c5e81a586d7aae5b99fd7b605dd76f329f57619e12fabde6792c873c71d3cc4081f7194898f4aac0ee7da9606df6c25483a0bf3c2f66e900d36b0

C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe

MD5 c4f6d81423575991bef469365913ce9a
SHA1 c4841554435e23b1b19badbf2b2bda72678addb1
SHA256 321e73140432b5811dd26c1bb3cf990cdece47fad76bb8f1fed3c11a8ea13816
SHA512 047a114b052c5e81a586d7aae5b99fd7b605dd76f329f57619e12fabde6792c873c71d3cc4081f7194898f4aac0ee7da9606df6c25483a0bf3c2f66e900d36b0

C:\Log\install.vbs

MD5 6cab561732bb524984d25e29b8e93414
SHA1 73adabe3f5191ea01d8026b14285f0330f97fccc
SHA256 81d2721f8da28ab12ab7e6572dbfe39c78f1eb24b09ccd9ae816dbcb9f398e60
SHA512 7f001fcdf73056fb688c62be0f68b1b1c54e3f0aff05b8e03e0947716e2cd771fa9e12314cb3b6efd9f971c889405d6eccb83a6ee48280e135fc6e14e216e45d

C:\Log\Windows\hiscomponent\install.bat

MD5 33ada5cdc4c57e3f695901fe4b5c7e0d
SHA1 570c1e7bb377eccbb22c9b38e3bef119b67dccf8
SHA256 2d2dcf87267c10290c121cb05178ff9f890e2e6eba34768d323872537d9e50e2
SHA512 c62e9487acf033fa325d87c6b9e9d574bac947cc5c47140365d7e517d776b5e6e7be09edf10a1aced7e052690bbda5bb5383a419afedbe5a5af5e2d5e38ea65e

C:\Log\Windows\hiscomponent\regedit.reg

MD5 a66500e88dccc574a92e495dbb51370d
SHA1 1708c9af563c32a67ada199567eb1b89b8d49ddd
SHA256 0fe3a8827afc275e117c34c7aa92405dc330b2a2861c15b4f9a124471589c1c0
SHA512 b26aad9b7fe1daa15f93c882009a1b7364e8be833ad0588fbca29119db10d5695191d283b69571e97e0e130b3a6529ab873fefac1f23b16a76d77d9e9f8aea64

C:\Log\rutserv.exe

MD5 88c4a86ac204ad1d217c78579308c1b0
SHA1 8a4a615cd3b7e485b2d4f0262116e5fa60bd345c
SHA256 8fe667e5f864d20abdc075d071d88455297228753ac11191dc7979aee6360393
SHA512 e55995ccf776c5033e2be8f3bf2906ddbc076a19b2f7d30ca0d4dec7d76fbbc3c61142ff9bc0d1e32f43c71daba3f668899705b6137f9e7c37ed0fdc626d3808

C:\Log\RDPCheck.exe

MD5 8f82226b2f24d470c02f6664f67f23f7
SHA1 66f40824b406c748846ef11e6b022958f8cbe48b
SHA256 5603338a1f8dbb46efb8e0869db3491d5db92f362711d6680f91ecc5d18bfadf
SHA512 04bc1f785bddf264699fb6bf6fce9652af8c95872f8fef93540f0b86df2e93ced910f01dc54a76a5425d2f5446d587df6ad20d8976fc4be7e9ce3511eb4b00ee

C:\Log\RDPConf.exe

MD5 1e4537b75cad6288f68d595d9c9b13c1
SHA1 9cc14ce3a3982376f454bd3833f4774d955d9bd3
SHA256 8b266c0945d003f5d0b2d6f59239e9dffb41dbccd1659d2c05bbf472ba1f0ccf
SHA512 8caa7b17ed4ec760d4e665ec8ffb543fb3a2287dbe4ba4b08daf9a46819ec662e4e3105e0f9d7ad94edb2d477551d2ca0ebce870d489a0713f8676978b0cc3ec

C:\Log\RDPWInst.exe

MD5 ce6a1d8fe9d16f4c4e2f41ef6cd3ad9b
SHA1 87a89f73faf22dbb6af94f0edbf4cf484673f572
SHA256 cb55b418cd219bcea3cb9dbfca4262d92affaabf34623e6f1e3ce8581c6cd5b2
SHA512 cea5f06d08bf5ee76aef21f05a1857dbfb240c02aff877df7a33b42d59571b4fc6358f0176e3e8ef53c8e06249e65c4e700a18e547c3071413591e4542ff0e9d

C:\Log\update.bat

MD5 29ca1c35075247b035af75c11cab78f1
SHA1 4f670d13d7532462f4b1e66d085ef8b9f065ff88
SHA256 353f2dc17a4e80564caa175f7170dbedc1b40f704444520ae671f78a5d1f2b6d
SHA512 3970adc72020194f93935fad2c17790170da7f0f4444e2bfc402f9924fdceaa4b6443e9871c3b8cda24089b84cbdcf185f0d31238c0be93c58e280cf36ab71a7

C:\Log\install.bat

MD5 cce1e07cf18ea79cc9e87922e9f5609a
SHA1 6800e3e5d42fc0e1d5834214df1958112066a626
SHA256 7afa7437b35cc7961ef51c3672e709f0aaf63b87badf1a884a6713e5749a9292
SHA512 b770d184fb371362fd6ba39e9c2462bb7fa8c7ffa4b1ffb55759fc37e5f06fb0f853e918dad5784d49cc33394c4f6295f5dda99f27304a5f0b34e9eb726fedf6

\Folder768\rutserv.exe

MD5 88c4a86ac204ad1d217c78579308c1b0
SHA1 8a4a615cd3b7e485b2d4f0262116e5fa60bd345c
SHA256 8fe667e5f864d20abdc075d071d88455297228753ac11191dc7979aee6360393
SHA512 e55995ccf776c5033e2be8f3bf2906ddbc076a19b2f7d30ca0d4dec7d76fbbc3c61142ff9bc0d1e32f43c71daba3f668899705b6137f9e7c37ed0fdc626d3808

\Folder768\rutserv.exe

MD5 88c4a86ac204ad1d217c78579308c1b0
SHA1 8a4a615cd3b7e485b2d4f0262116e5fa60bd345c
SHA256 8fe667e5f864d20abdc075d071d88455297228753ac11191dc7979aee6360393
SHA512 e55995ccf776c5033e2be8f3bf2906ddbc076a19b2f7d30ca0d4dec7d76fbbc3c61142ff9bc0d1e32f43c71daba3f668899705b6137f9e7c37ed0fdc626d3808

C:\Folder768\rutserv.exe

MD5 88c4a86ac204ad1d217c78579308c1b0
SHA1 8a4a615cd3b7e485b2d4f0262116e5fa60bd345c
SHA256 8fe667e5f864d20abdc075d071d88455297228753ac11191dc7979aee6360393
SHA512 e55995ccf776c5033e2be8f3bf2906ddbc076a19b2f7d30ca0d4dec7d76fbbc3c61142ff9bc0d1e32f43c71daba3f668899705b6137f9e7c37ed0fdc626d3808

C:\Log\uninstall.bat

MD5 eccb8a01d0427ef29c2380d7dda399f3
SHA1 302601e99d6b02e2e84a0de5c0dce3df139cba31
SHA256 083cd340c800cc021d4a59388680ce0e7ab0f8b998e67def6a507070e7fa01b7
SHA512 78d51882fe04cb64f9f6a82b604ef20e4324e5bc37701747fa55b3c153baa5942774daf737ff204f9e75e81a745ed95cc7ec115da91b9e27e646ed41d3f103f9

C:\Folder768\update.bat

MD5 29ca1c35075247b035af75c11cab78f1
SHA1 4f670d13d7532462f4b1e66d085ef8b9f065ff88
SHA256 353f2dc17a4e80564caa175f7170dbedc1b40f704444520ae671f78a5d1f2b6d
SHA512 3970adc72020194f93935fad2c17790170da7f0f4444e2bfc402f9924fdceaa4b6443e9871c3b8cda24089b84cbdcf185f0d31238c0be93c58e280cf36ab71a7

C:\Folder768\rutserv.exe

MD5 88c4a86ac204ad1d217c78579308c1b0
SHA1 8a4a615cd3b7e485b2d4f0262116e5fa60bd345c
SHA256 8fe667e5f864d20abdc075d071d88455297228753ac11191dc7979aee6360393
SHA512 e55995ccf776c5033e2be8f3bf2906ddbc076a19b2f7d30ca0d4dec7d76fbbc3c61142ff9bc0d1e32f43c71daba3f668899705b6137f9e7c37ed0fdc626d3808

C:\Folder768\RDPWInst.exe

MD5 ce6a1d8fe9d16f4c4e2f41ef6cd3ad9b
SHA1 87a89f73faf22dbb6af94f0edbf4cf484673f572
SHA256 cb55b418cd219bcea3cb9dbfca4262d92affaabf34623e6f1e3ce8581c6cd5b2
SHA512 cea5f06d08bf5ee76aef21f05a1857dbfb240c02aff877df7a33b42d59571b4fc6358f0176e3e8ef53c8e06249e65c4e700a18e547c3071413591e4542ff0e9d

C:\Folder768\RDPConf.exe

MD5 1e4537b75cad6288f68d595d9c9b13c1
SHA1 9cc14ce3a3982376f454bd3833f4774d955d9bd3
SHA256 8b266c0945d003f5d0b2d6f59239e9dffb41dbccd1659d2c05bbf472ba1f0ccf
SHA512 8caa7b17ed4ec760d4e665ec8ffb543fb3a2287dbe4ba4b08daf9a46819ec662e4e3105e0f9d7ad94edb2d477551d2ca0ebce870d489a0713f8676978b0cc3ec

C:\Folder768\RDPCheck.exe

MD5 8f82226b2f24d470c02f6664f67f23f7
SHA1 66f40824b406c748846ef11e6b022958f8cbe48b
SHA256 5603338a1f8dbb46efb8e0869db3491d5db92f362711d6680f91ecc5d18bfadf
SHA512 04bc1f785bddf264699fb6bf6fce9652af8c95872f8fef93540f0b86df2e93ced910f01dc54a76a5425d2f5446d587df6ad20d8976fc4be7e9ce3511eb4b00ee

C:\Folder768\install.bat

MD5 cce1e07cf18ea79cc9e87922e9f5609a
SHA1 6800e3e5d42fc0e1d5834214df1958112066a626
SHA256 7afa7437b35cc7961ef51c3672e709f0aaf63b87badf1a884a6713e5749a9292
SHA512 b770d184fb371362fd6ba39e9c2462bb7fa8c7ffa4b1ffb55759fc37e5f06fb0f853e918dad5784d49cc33394c4f6295f5dda99f27304a5f0b34e9eb726fedf6

memory/1896-99-0x0000000000250000-0x0000000000251000-memory.dmp

memory/1896-98-0x0000000000400000-0x0000000000A97000-memory.dmp

memory/1896-100-0x0000000000A96000-0x0000000000A97000-memory.dmp

memory/1896-101-0x0000000000230000-0x0000000000232000-memory.dmp