Overview

overview

10

Static

static

tmp.exe

windows7_x64

10

tmp.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    23-02-2022 09:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp.exe

  • Size

    8.3MB

  • MD5

    cb2ffac2a251378cda3f91cd613f453d

  • SHA1

    3a028761638f5aa93b0719c5650c83a138e8abc9

  • SHA256

    10165e27e0db0a6708f346ddea657ab0409499f93eb8426a80864a966f0f401e

  • SHA512

    1d203540fde5074f0d57e1ecbd9af2ee862b940f8fb58c3e55ad9db5ba029aff82a4468eee24c760b5e55cc96e61244af0fd6f3c46db857824e13e45ec1e802f

Score
10/10
rmsdiscoveryrattrojan

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 8 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 53 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3632
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3.4ru_mod_mod.msi" /qn
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1908
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\killself.bat
        3⤵
          PID:2160
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3708
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding B1EECFB6B9637CA9459744C8935DBEDC
        2⤵
        • Loads dropped DLL
        PID:3372
      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:392
      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1932
      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2748
    • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
      "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:560
      • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
        "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
        2⤵
        • Executes dropped EXE
        PID:3108
      • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
        "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3596
        • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
          "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: SetClipboardViewer
          PID:3656

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/560-162-0x0000000000C10000-0x0000000000C11000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1932-145-0x0000000000C70000-0x0000000000C71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2748-147-0x0000000000D70000-0x0000000000D71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3108-164-0x0000000002740000-0x0000000002741000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3596-163-0x0000000002890000-0x0000000002891000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3632-132-0x0000000002A90000-0x0000000002A91000-memory.dmp

      Filesize

      4KB

      Download