rms | a2c9e4f09745da32b05cb9dec107f05c84b0772164cb91ccaa09bce68cfef606

Analysis

max time kernel
160s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
17-03-2022 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

install.vbs
Size

120B
MD5

c719a030434d3fa96d62868f27e904a6
SHA1

f2f750a752dd1fda8915a47b082af7cf2d3e3655
SHA256

2696ee4302a85c6b4101fc6d1ce8e38b94fd9c2bbd1acc73b553576b3aacb92f
SHA512

47a9367f7596d19c0636766cd34ca3701d3b1239a284f2333fd04a48422f53b0df21002fd38a4f229f6a2f9f9e8163267e13ecb24d9ce6de1863d5f59ab04ff0

Score

10^/10

rms evasion rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\System	attrib.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
2236	timeout.exe
2940	timeout.exe
4680	timeout.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
3564	taskkill.exe
4316	taskkill.exe
4216	taskkill.exe
4960	taskkill.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4620	regedit.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4236	rutserv.exe
4236	rutserv.exe
4236	rutserv.exe
4236	rutserv.exe
4236	rutserv.exe
4236	rutserv.exe
4236	rutserv.exe
4236	rutserv.exe
5116	rutserv.exe
5116	rutserv.exe
5116	rutserv.exe
5116	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
392	rutserv.exe
392	rutserv.exe
392	rutserv.exe
392	rutserv.exe
392	rutserv.exe
392	rutserv.exe
392	rutserv.exe
392	rutserv.exe
3340	rfusclient.exe
3340	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	taskkill.exe
Token: SeDebugPrivilege	4316	taskkill.exe
Token: SeDebugPrivilege	4216	taskkill.exe
Token: SeDebugPrivilege	4960	taskkill.exe
Token: SeDebugPrivilege	4236	rutserv.exe
Token: SeDebugPrivilege	2028	rutserv.exe
Token: SeTakeOwnershipPrivilege	392	rutserv.exe
Token: SeTcbPrivilege	392	rutserv.exe
Token: SeTcbPrivilege	392	rutserv.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
4236	rutserv.exe
4236	rutserv.exe
4236	rutserv.exe
4236	rutserv.exe
5116	rutserv.exe
5116	rutserv.exe
5116	rutserv.exe
5116	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
2028	rutserv.exe
392	rutserv.exe
392	rutserv.exe
392	rutserv.exe
392	rutserv.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3636	2964	WScript.exe	78
PID 2964 wrote to memory of 3636	2964	WScript.exe	78
PID 3636 wrote to memory of 3424	3636	cmd.exe	80
PID 3636 wrote to memory of 3424	3636	cmd.exe	80
PID 3636 wrote to memory of 3680	3636	cmd.exe	81
PID 3636 wrote to memory of 3680	3636	cmd.exe	81
PID 3636 wrote to memory of 3564	3636	cmd.exe	82
PID 3636 wrote to memory of 3564	3636	cmd.exe	82
PID 3636 wrote to memory of 4316	3636	cmd.exe	84
PID 3636 wrote to memory of 4316	3636	cmd.exe	84
PID 3636 wrote to memory of 4216	3636	cmd.exe	85
PID 3636 wrote to memory of 4216	3636	cmd.exe	85
PID 3636 wrote to memory of 4960	3636	cmd.exe	86
PID 3636 wrote to memory of 4960	3636	cmd.exe	86
PID 3636 wrote to memory of 4664	3636	cmd.exe	87
PID 3636 wrote to memory of 4664	3636	cmd.exe	87
PID 3636 wrote to memory of 4620	3636	cmd.exe	88
PID 3636 wrote to memory of 4620	3636	cmd.exe	88
PID 3636 wrote to memory of 4680	3636	cmd.exe	89
PID 3636 wrote to memory of 4680	3636	cmd.exe	89
PID 3636 wrote to memory of 4236	3636	cmd.exe	92
PID 3636 wrote to memory of 4236	3636	cmd.exe	92
PID 3636 wrote to memory of 4236	3636	cmd.exe	92
PID 3636 wrote to memory of 5116	3636	cmd.exe	94
PID 3636 wrote to memory of 5116	3636	cmd.exe	94
PID 3636 wrote to memory of 5116	3636	cmd.exe	94
PID 3636 wrote to memory of 2028	3636	cmd.exe	96
PID 3636 wrote to memory of 2028	3636	cmd.exe	96
PID 3636 wrote to memory of 2028	3636	cmd.exe	96
PID 392 wrote to memory of 4788	392	rutserv.exe	100
PID 392 wrote to memory of 4788	392	rutserv.exe	100
PID 392 wrote to memory of 4788	392	rutserv.exe	100
PID 392 wrote to memory of 3340	392	rutserv.exe	99
PID 392 wrote to memory of 3340	392	rutserv.exe	99
PID 392 wrote to memory of 3340	392	rutserv.exe	99
PID 3636 wrote to memory of 4436	3636	cmd.exe	101
PID 3636 wrote to memory of 4436	3636	cmd.exe	101
PID 3636 wrote to memory of 1656	3636	cmd.exe	102
PID 3636 wrote to memory of 1656	3636	cmd.exe	102
PID 3636 wrote to memory of 2208	3636	cmd.exe	104
PID 3636 wrote to memory of 2208	3636	cmd.exe	104
PID 3636 wrote to memory of 2236	3636	cmd.exe	105
PID 3636 wrote to memory of 2236	3636	cmd.exe	105
PID 3636 wrote to memory of 3728	3636	cmd.exe	113
PID 3636 wrote to memory of 3728	3636	cmd.exe	113
PID 3636 wrote to memory of 2940	3636	cmd.exe	114
PID 3636 wrote to memory of 2940	3636	cmd.exe	114

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3424	attrib.exe
3680	attrib.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\system32\attrib.exe
    attrib "C:\Program Files (x86)\System" +H +S /S /D
    3⤵
    - Drops file in Program Files directory
    - Views/modifies file attributes
    PID:3424
- - C:\Windows\system32\attrib.exe
    attrib "C:\Program Files (x86)\System\*.*" +H +S /S /D
    3⤵
    - Views/modifies file attributes
    PID:3680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im rutserv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3564
- - C:\Windows\system32\taskkill.exe
    Taskkill /f /im rutserv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im rfusclient.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4216
- - C:\Windows\system32\taskkill.exe
    Taskkill /f /im rfusclient.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
    3⤵
    PID:4664
- - C:\Windows\regedit.exe
    regedit /s "regedit.reg"
    3⤵
    - Runs .reg file with regedit
    PID:4620
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\rutserv.exe
    rutserv.exe /silentinstall
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4236
- - C:\Users\Admin\AppData\Local\Temp\rutserv.exe
    rutserv.exe /firewall
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\rutserv.exe
    rutserv.exe /start
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2028
- - C:\Windows\system32\sc.exe
    sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
    3⤵
    PID:4436
- - C:\Windows\system32\sc.exe
    sc config RManService obj= LocalSystem type= interact type= own
    3⤵
    PID:1656
- - C:\Windows\system32\sc.exe
    sc config RManService DisplayName= "Windows_Defender v6.3"
    3⤵
    PID:2208
- - C:\Windows\system32\timeout.exe
    timeout 120
    3⤵
    - Delays execution with timeout.exe
    PID:2236
- - C:\Windows\system32\reg.exe
    reg export "HKEY_LOCAL_MACHINE\SYSTEM\Remote Manipulator System\v4" "id.txt"
    3⤵
    PID:3728
- - C:\Windows\system32\timeout.exe
    timeout 10
    3⤵
    - Delays execution with timeout.exe
    PID:2940

C:\Users\Admin\AppData\Local\Temp\rutserv.exe
"C:\Users\Admin\AppData\Local\Temp\rutserv.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:392
- C:\Users\Admin\AppData\Local\Temp\rfusclient.exe
  C:\Users\Admin\AppData\Local\Temp\rfusclient.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3340
- C:\Users\Admin\AppData\Local\Temp\rfusclient.exe
  C:\Users\Admin\AppData\Local\Temp\rfusclient.exe /tray
  2⤵
  PID:4788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/392-142-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/392-132-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/392-133-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/392-135-0x0000000004E70000-0x0000000004E71000-memory.dmp

Filesize
4KB

Download
memory/392-134-0x0000000003B20000-0x0000000003B21000-memory.dmp

Filesize
4KB

Download
memory/392-136-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/392-140-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/392-137-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2028-131-0x0000000004580000-0x0000000004581000-memory.dmp

Filesize
4KB

Download
memory/3340-148-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/3340-146-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/3340-150-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/3340-139-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/3340-145-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/3340-143-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/4236-130-0x0000000003010000-0x0000000003011000-memory.dmp

Filesize
4KB

Download
memory/4788-144-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/4788-147-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/4788-138-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/4788-149-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/4788-152-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/4788-151-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/4788-141-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download