Analysis
-
max time kernel
4294211s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
10-03-2022 19:59
Static task
static1
Behavioral task
behavioral1
Sample
4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
General
-
Target
4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe
-
Size
4.6MB
-
MD5
db463e26728b4396feb9145ef2de758d
-
SHA1
e10a452585645cde52d8e20db93dfa935290f28d
-
SHA256
4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427
-
SHA512
e8d9afc3cc3d3a43d35eda30f761e9bb2ceedc2a1f9edcd0b7f8631313129f2d730deb9bcdbed9d881da3c6c41c52cdcba9a721fbd05d4b4266fb3bdfce2e309
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1664 rutserv.exe 1064 rutserv.exe 1980 rutserv.exe 2000 rutserv.exe 1376 rfusclient.exe 1516 rfusclient.exe 528 rfusclient.exe -
resource yara_rule behavioral1/files/0x00060000000142db-59.dat upx behavioral1/files/0x00060000000142d2-58.dat upx behavioral1/files/0x0006000000014540-63.dat upx behavioral1/files/0x0009000000013a34-62.dat upx behavioral1/files/0x0006000000014540-66.dat upx behavioral1/files/0x0006000000014540-67.dat upx behavioral1/files/0x0006000000014540-70.dat upx behavioral1/files/0x0006000000014540-72.dat upx behavioral1/files/0x0006000000014540-74.dat upx behavioral1/files/0x0009000000013a34-80.dat upx behavioral1/files/0x0009000000013a34-81.dat upx behavioral1/files/0x0009000000013a34-79.dat upx behavioral1/files/0x0009000000013a34-78.dat upx behavioral1/files/0x0009000000013a34-86.dat upx -
Loads dropped DLL 3 IoCs
pid Process 948 cmd.exe 2000 rutserv.exe 2000 rutserv.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification C:\Program Files\rtsd\vp8encoder.dll attrib.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\rutserv.exe 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\vp8encoder.dll 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe File created C:\Program Files\rtsd\vp8decoder.dll cmd.exe File opened for modification C:\Program Files\rtsd\vp8decoder.dll cmd.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\install.bat 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\13213.exe 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe File created C:\Program Files\rtsd\rfusclient.exe cmd.exe File opened for modification C:\Program Files\rtsd\rfusclient.exe attrib.exe File opened for modification C:\Program Files\rtsd\vp8decoder.dll attrib.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\regedit.reg 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\vp8decoder.dll 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\gabe.jpg 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe File created C:\Program Files\rtsd\vp8encoder.dll cmd.exe File opened for modification C:\Program Files\rtsd\vp8encoder.dll cmd.exe File opened for modification C:\Program Files\rtsd\rutserv.exe attrib.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\rfusclient.exe 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe File opened for modification C:\Program Files\rtsd\rfusclient.exe cmd.exe File created C:\Program Files\rtsd\rutserv.exe cmd.exe File opened for modification C:\Program Files\rtsd\rutserv.exe cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 2 IoCs
pid Process 272 taskkill.exe 1964 taskkill.exe -
Runs .reg file with regedit 1 IoCs
pid Process 1924 regedit.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1664 rutserv.exe 1664 rutserv.exe 1664 rutserv.exe 1664 rutserv.exe 1064 rutserv.exe 1064 rutserv.exe 1980 rutserv.exe 1980 rutserv.exe 2000 rutserv.exe 2000 rutserv.exe 2000 rutserv.exe 2000 rutserv.exe 1516 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 528 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 272 taskkill.exe Token: SeDebugPrivilege 1964 taskkill.exe Token: SeDebugPrivilege 1664 rutserv.exe Token: SeDebugPrivilege 1980 rutserv.exe Token: SeTakeOwnershipPrivilege 2000 rutserv.exe Token: SeTcbPrivilege 2000 rutserv.exe Token: SeTcbPrivilege 2000 rutserv.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1664 rutserv.exe 1064 rutserv.exe 1980 rutserv.exe 2000 rutserv.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 1792 wrote to memory of 948 1792 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe 27 PID 1792 wrote to memory of 948 1792 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe 27 PID 1792 wrote to memory of 948 1792 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe 27 PID 1792 wrote to memory of 948 1792 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe 27 PID 1792 wrote to memory of 948 1792 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe 27 PID 1792 wrote to memory of 948 1792 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe 27 PID 1792 wrote to memory of 948 1792 4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe 27 PID 948 wrote to memory of 272 948 cmd.exe 29 PID 948 wrote to memory of 272 948 cmd.exe 29 PID 948 wrote to memory of 272 948 cmd.exe 29 PID 948 wrote to memory of 272 948 cmd.exe 29 PID 948 wrote to memory of 1964 948 cmd.exe 31 PID 948 wrote to memory of 1964 948 cmd.exe 31 PID 948 wrote to memory of 1964 948 cmd.exe 31 PID 948 wrote to memory of 1964 948 cmd.exe 31 PID 948 wrote to memory of 1940 948 cmd.exe 32 PID 948 wrote to memory of 1940 948 cmd.exe 32 PID 948 wrote to memory of 1940 948 cmd.exe 32 PID 948 wrote to memory of 1940 948 cmd.exe 32 PID 948 wrote to memory of 1924 948 cmd.exe 33 PID 948 wrote to memory of 1924 948 cmd.exe 33 PID 948 wrote to memory of 1924 948 cmd.exe 33 PID 948 wrote to memory of 1924 948 cmd.exe 33 PID 948 wrote to memory of 1020 948 cmd.exe 34 PID 948 wrote to memory of 1020 948 cmd.exe 34 PID 948 wrote to memory of 1020 948 cmd.exe 34 PID 948 wrote to memory of 1020 948 cmd.exe 34 PID 948 wrote to memory of 1664 948 cmd.exe 36 PID 948 wrote to memory of 1664 948 cmd.exe 36 PID 948 wrote to memory of 1664 948 cmd.exe 36 PID 948 wrote to memory of 1664 948 cmd.exe 36 PID 948 wrote to memory of 1064 948 cmd.exe 37 PID 948 wrote to memory of 1064 948 cmd.exe 37 PID 948 wrote to memory of 1064 948 cmd.exe 37 PID 948 wrote to memory of 1064 948 cmd.exe 37 PID 948 wrote to memory of 1980 948 cmd.exe 38 PID 948 wrote to memory of 1980 948 cmd.exe 38 PID 948 wrote to memory of 1980 948 cmd.exe 38 PID 948 wrote to memory of 1980 948 cmd.exe 38 PID 2000 wrote to memory of 1376 2000 rutserv.exe 40 PID 2000 wrote to memory of 1376 2000 rutserv.exe 40 PID 2000 wrote to memory of 1376 2000 rutserv.exe 40 PID 2000 wrote to memory of 1376 2000 rutserv.exe 40 PID 2000 wrote to memory of 1516 2000 rutserv.exe 41 PID 2000 wrote to memory of 1516 2000 rutserv.exe 41 PID 2000 wrote to memory of 1516 2000 rutserv.exe 41 PID 2000 wrote to memory of 1516 2000 rutserv.exe 41 PID 1516 wrote to memory of 528 1516 rfusclient.exe 42 PID 1516 wrote to memory of 528 1516 rfusclient.exe 42 PID 1516 wrote to memory of 528 1516 rfusclient.exe 42 PID 1516 wrote to memory of 528 1516 rfusclient.exe 42 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1020 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe"C:\Users\Admin\AppData\Local\Temp\4c9f119fa1e021e2a60d2716ca8ebd4c196e8b30e895b1199cf59be5e6004427.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\Company\NewProduct\install.bat" "2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 4t4t53⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:272
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im g4rgt3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
C:\Windows\SysWOW64\reg.exereg delete "70t9j" /f3⤵PID:1940
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s "regedit.reg"3⤵
- Runs .reg file with regedit
PID:1924
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\Program Files\rtsd\*.*"3⤵
- Drops file in Program Files directory
- Views/modifies file attributes
PID:1020
-
-
C:\Program Files\rtsd\rutserv.exerutserv.exe /silentinstall3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1664
-
-
C:\Program Files\rtsd\rutserv.exerutserv.exe /firewall3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1064
-
-
C:\Program Files\rtsd\rutserv.exerutserv.exe /start3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1980
-
-
-
C:\Program Files\rtsd\rutserv.exe"C:\Program Files\rtsd\rutserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Program Files\rtsd\rfusclient.exe"C:\Program Files\rtsd\rfusclient.exe" /tray2⤵
- Executes dropped EXE
PID:1376
-
-
C:\Program Files\rtsd\rfusclient.exe"C:\Program Files\rtsd\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Program Files\rtsd\rfusclient.exe"C:\Program Files\rtsd\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:528
-
-