Analysis
-
max time kernel
165s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
13-02-2022 15:38
Static task
static1
Behavioral task
behavioral1
Sample
09fedab0a9fa3fb1df61aa984c9891261b9e15c4ad7bea3de045711f7b081230.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
09fedab0a9fa3fb1df61aa984c9891261b9e15c4ad7bea3de045711f7b081230.exe
-
Size
10.2MB
-
MD5
febef1b6e8b7bf8579dacaa6798f73fe
-
SHA1
012e2cfd33f6d43c427d005201488f2a02a078aa
-
SHA256
09fedab0a9fa3fb1df61aa984c9891261b9e15c4ad7bea3de045711f7b081230
-
SHA512
09fb12a8769ba8789d0472933f0aa33c0f44453809bfe3793bd20a9901bf91fbd0d087efb0802beac18d25b14e1245c2ceefeecbc12f805cf44be947f25e12cc
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2300 rutserv.exe 376 rutserv.exe 2996 rutserv.exe 3124 rutserv.exe 3132 rfusclient.exe 4808 rfusclient.exe 4136 rfusclient.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 09fedab0a9fa3fb1df61aa984c9891261b9e15c4ad7bea3de045711f7b081230.exe -
Loads dropped DLL 14 IoCs
pid Process 2300 rutserv.exe 2300 rutserv.exe 376 rutserv.exe 376 rutserv.exe 2996 rutserv.exe 2996 rutserv.exe 3124 rutserv.exe 3124 rutserv.exe 3132 rfusclient.exe 3132 rfusclient.exe 4808 rfusclient.exe 4808 rfusclient.exe 4136 rfusclient.exe 4136 rfusclient.exe -
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rfusclient.exe cmd.exe File created C:\Windows\SysWOW64\dsfOggMux.dll cmd.exe File created C:\Windows\SysWOW64\Microsoft.VC80.CRT.manifest cmd.exe File created C:\Windows\SysWOW64\msvcp80.dll cmd.exe File opened for modification C:\Windows\SysWOW64\msvcp80.dll cmd.exe File opened for modification C:\Windows\SysWOW64\HookDrv.dll cmd.exe File created C:\Windows\SysWOW64\rversionlib.dll cmd.exe File created C:\Windows\SysWOW64\dsfTheoraEncoder.dll cmd.exe File opened for modification C:\Windows\SysWOW64\dsfTheoraEncoder.dll cmd.exe File opened for modification C:\Windows\SysWOW64\dsfVorbisEncoder.dll cmd.exe File created C:\Windows\SysWOW64\HookDrv.dll cmd.exe File opened for modification C:\Windows\SysWOW64\rutserv.exe cmd.exe File created C:\Windows\SysWOW64\dsfVorbisEncoder.dll cmd.exe File opened for modification C:\Windows\SysWOW64\Microsoft.VC80.CRT.manifest cmd.exe File created C:\Windows\SysWOW64\rfusclient.exe cmd.exe File created C:\Windows\SysWOW64\rutserv.exe cmd.exe File opened for modification C:\Windows\SysWOW64\dsfOggMux.dll cmd.exe File opened for modification C:\Windows\SysWOW64\rversionlib.dll cmd.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs .reg file with regedit 1 IoCs
pid Process 648 regedit.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3124 rutserv.exe 3124 rutserv.exe 3124 rutserv.exe 3124 rutserv.exe 3132 rfusclient.exe 3132 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2300 rutserv.exe Token: SeDebugPrivilege 2996 rutserv.exe Token: SeTakeOwnershipPrivilege 3124 rutserv.exe Token: SeTcbPrivilege 3124 rutserv.exe Token: SeShutdownPrivilege 4192 svchost.exe Token: SeCreatePagefilePrivilege 4192 svchost.exe Token: SeShutdownPrivilege 4192 svchost.exe Token: SeCreatePagefilePrivilege 4192 svchost.exe Token: SeShutdownPrivilege 4192 svchost.exe Token: SeCreatePagefilePrivilege 4192 svchost.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe Token: SeBackupPrivilege 4248 TiWorker.exe Token: SeRestorePrivilege 4248 TiWorker.exe Token: SeSecurityPrivilege 4248 TiWorker.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 4668 wrote to memory of 1412 4668 09fedab0a9fa3fb1df61aa984c9891261b9e15c4ad7bea3de045711f7b081230.exe 81 PID 4668 wrote to memory of 1412 4668 09fedab0a9fa3fb1df61aa984c9891261b9e15c4ad7bea3de045711f7b081230.exe 81 PID 4668 wrote to memory of 1412 4668 09fedab0a9fa3fb1df61aa984c9891261b9e15c4ad7bea3de045711f7b081230.exe 81 PID 1412 wrote to memory of 4860 1412 cmd.exe 84 PID 1412 wrote to memory of 4860 1412 cmd.exe 84 PID 1412 wrote to memory of 4860 1412 cmd.exe 84 PID 1412 wrote to memory of 2300 1412 cmd.exe 85 PID 1412 wrote to memory of 2300 1412 cmd.exe 85 PID 1412 wrote to memory of 2300 1412 cmd.exe 85 PID 1412 wrote to memory of 376 1412 cmd.exe 87 PID 1412 wrote to memory of 376 1412 cmd.exe 87 PID 1412 wrote to memory of 376 1412 cmd.exe 87 PID 1412 wrote to memory of 648 1412 cmd.exe 88 PID 1412 wrote to memory of 648 1412 cmd.exe 88 PID 1412 wrote to memory of 648 1412 cmd.exe 88 PID 1412 wrote to memory of 2996 1412 cmd.exe 89 PID 1412 wrote to memory of 2996 1412 cmd.exe 89 PID 1412 wrote to memory of 2996 1412 cmd.exe 89 PID 3124 wrote to memory of 3132 3124 rutserv.exe 92 PID 3124 wrote to memory of 3132 3124 rutserv.exe 92 PID 3124 wrote to memory of 3132 3124 rutserv.exe 92 PID 3124 wrote to memory of 4808 3124 rutserv.exe 93 PID 3124 wrote to memory of 4808 3124 rutserv.exe 93 PID 3124 wrote to memory of 4808 3124 rutserv.exe 93 PID 3132 wrote to memory of 4136 3132 rfusclient.exe 102 PID 3132 wrote to memory of 4136 3132 rfusclient.exe 102 PID 3132 wrote to memory of 4136 3132 rfusclient.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\09fedab0a9fa3fb1df61aa984c9891261b9e15c4ad7bea3de045711f7b081230.exe"C:\Users\Admin\AppData\Local\Temp\09fedab0a9fa3fb1df61aa984c9891261b9e15c4ad7bea3de045711f7b081230.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8DE5.tmp\Install.bat" "2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SYSTEM\Remote Manipulator System" /f3⤵PID:4860
-
-
C:\Windows\SysWOW64\rutserv.exe"C:\Windows\System32\rutserv.exe" /silentinstall3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Windows\SysWOW64\rutserv.exe"C:\Windows\System32\rutserv.exe" /firewall3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s "settings.reg"3⤵
- Runs .reg file with regedit
PID:648
-
-
C:\Windows\SysWOW64\rutserv.exe"C:\Windows\System32\rutserv.exe" /start3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
-
-
C:\Windows\SysWOW64\rutserv.exeC:\Windows\SysWOW64\rutserv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\rfusclient.exeC:\Windows\SysWOW64\rfusclient.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\rfusclient.exeC:\Windows\SysWOW64\rfusclient.exe /tray3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4136
-
-
-
C:\Windows\SysWOW64\rfusclient.exeC:\Windows\SysWOW64\rfusclient.exe /tray2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4808
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4192
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4248