Overview

overview

10

Static

static

9e53945f65...12.exe

windows7_x64

10

9e53945f65...12.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9e53945f65d0528540a52741bde298a2626582e684f56ddd0f4e534e13491c12

  • Size

    6.2MB

  • Sample

    220415-fhywhaheg2

  • MD5

    ab92d1376a186f27c4e5440843173020

  • SHA1

    9aebb2a37972d52c671985f9833c820934fa96d3

  • SHA256

    9e53945f65d0528540a52741bde298a2626582e684f56ddd0f4e534e13491c12

  • SHA512

    f7e05d9c1723446e31bed30ffd22563dc03880aabdc8fbe37b70e7fcba68dba933ad1bd5f44a0d6a66df01519178bcee653b0273d1c55fdedb273a1fa85f0a48

Score
10/10
rmspersistencerattrojan

Malware Config

Targets

    • Target

      9e53945f65d0528540a52741bde298a2626582e684f56ddd0f4e534e13491c12

    • Size

      6.2MB

    • MD5

      ab92d1376a186f27c4e5440843173020

    • SHA1

      9aebb2a37972d52c671985f9833c820934fa96d3

    • SHA256

      9e53945f65d0528540a52741bde298a2626582e684f56ddd0f4e534e13491c12

    • SHA512

      f7e05d9c1723446e31bed30ffd22563dc03880aabdc8fbe37b70e7fcba68dba933ad1bd5f44a0d6a66df01519178bcee653b0273d1c55fdedb273a1fa85f0a48

    Score
    10/10
    rmsrattrojanpersistence

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Registers COM server for autorun

      persistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks