Malware Analysis Report

2024-11-15 08:39

Sample ID 220417-sa4g8sgfbj
Target 8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6
SHA256 8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6
Tags
rms discovery evasion rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6

Threat Level: Known bad

The file 8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6 was found to be: Known bad.

Malicious Activity Summary

rms discovery evasion rat trojan upx

RMS

UPX packed file

Sets file to hidden

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Checks installed software on the system

Drops file in System32 directory

Drops file in Program Files directory

Enumerates physical storage devices

Views/modifies file attributes

Kills process with taskkill

Runs .reg file with regedit

Suspicious behavior: SetClipboardViewer

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-04-17 14:56

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-04-17 14:56

Reported

2022-04-17 15:25

Platform

win7-20220414-en

Max time kernel

147s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe"

Signatures

RMS

trojan rat rms

Sets file to hidden

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Skype\Skype\regedit.reg C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File opened for modification C:\Program Files (x86)\Skype\Skype\rutserv.exe C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File created C:\Program Files\rtsd\rutserv.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\rtsd\vp8encoder.dll C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files (x86)\Skype\Skype\install.bat C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File created C:\Program Files (x86)\Skype\Skype\Uninstall.ini C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File opened for modification C:\Program Files\rtsd\rutserv.exe C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files (x86)\Skype\Skype\rfusclient.exe C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File opened for modification C:\Program Files (x86)\Skype\Skype\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File opened for modification C:\Program Files (x86)\Skype\Skype\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File created C:\Program Files\rtsd\rfusclient.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\rtsd\vp8encoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\rtsd\vp8encoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files (x86)\Skype\Skype\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File opened for modification C:\Program Files\rtsd\rfusclient.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\rtsd\rutserv.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\rtsd\vp8decoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\rtsd\vp8decoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\rtsd\rfusclient.exe C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\rtsd\vp8decoder.dll C:\Windows\SysWOW64\attrib.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files\rtsd\rfusclient.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\rtsd\rutserv.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\rtsd\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\rtsd\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\rtsd\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\rtsd\rutserv.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\rtsd\rutserv.exe N/A
N/A N/A C:\Program Files\rtsd\rutserv.exe N/A
N/A N/A C:\Program Files\rtsd\rutserv.exe N/A
N/A N/A C:\Program Files\rtsd\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1192 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe C:\Windows\SysWOW64\cmd.exe
PID 1192 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe C:\Windows\SysWOW64\cmd.exe
PID 1192 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe C:\Windows\SysWOW64\cmd.exe
PID 1192 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe C:\Windows\SysWOW64\cmd.exe
PID 1220 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\done.sfx.exe
PID 1220 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\done.sfx.exe
PID 1220 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\done.sfx.exe
PID 1220 wrote to memory of 1864 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\done.sfx.exe
PID 1864 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\done.sfx.exe C:\Users\Admin\AppData\Local\Temp\done.exe
PID 1864 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\done.sfx.exe C:\Users\Admin\AppData\Local\Temp\done.exe
PID 1864 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\done.sfx.exe C:\Users\Admin\AppData\Local\Temp\done.exe
PID 1864 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\done.sfx.exe C:\Users\Admin\AppData\Local\Temp\done.exe
PID 1864 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\done.sfx.exe C:\Users\Admin\AppData\Local\Temp\done.exe
PID 1864 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\done.sfx.exe C:\Users\Admin\AppData\Local\Temp\done.exe
PID 1864 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\done.sfx.exe C:\Users\Admin\AppData\Local\Temp\done.exe
PID 1652 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\done.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\done.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\done.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\done.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\done.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\done.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\done.exe C:\Windows\SysWOW64\cmd.exe
PID 1608 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 864 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 1092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1608 wrote to memory of 1092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1608 wrote to memory of 1092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1608 wrote to memory of 1092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1608 wrote to memory of 1816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1608 wrote to memory of 1816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1608 wrote to memory of 1816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1608 wrote to memory of 1816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1608 wrote to memory of 340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1608 wrote to memory of 340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1608 wrote to memory of 340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1608 wrote to memory of 340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1608 wrote to memory of 576 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 1608 wrote to memory of 576 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 1608 wrote to memory of 576 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 1608 wrote to memory of 576 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 1608 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 1608 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 1608 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 1608 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 1608 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 1608 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 1608 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 1608 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 1260 wrote to memory of 844 N/A C:\Program Files\rtsd\rutserv.exe C:\Program Files\rtsd\rfusclient.exe
PID 1260 wrote to memory of 1752 N/A C:\Program Files\rtsd\rutserv.exe C:\Program Files\rtsd\rfusclient.exe
PID 1260 wrote to memory of 844 N/A C:\Program Files\rtsd\rutserv.exe C:\Program Files\rtsd\rfusclient.exe
PID 1260 wrote to memory of 1752 N/A C:\Program Files\rtsd\rutserv.exe C:\Program Files\rtsd\rfusclient.exe
PID 1260 wrote to memory of 844 N/A C:\Program Files\rtsd\rutserv.exe C:\Program Files\rtsd\rfusclient.exe
PID 1260 wrote to memory of 844 N/A C:\Program Files\rtsd\rutserv.exe C:\Program Files\rtsd\rfusclient.exe
PID 1260 wrote to memory of 1752 N/A C:\Program Files\rtsd\rutserv.exe C:\Program Files\rtsd\rfusclient.exe
PID 1260 wrote to memory of 1752 N/A C:\Program Files\rtsd\rutserv.exe C:\Program Files\rtsd\rfusclient.exe
PID 844 wrote to memory of 752 N/A C:\Program Files\rtsd\rfusclient.exe C:\Program Files\rtsd\rfusclient.exe
PID 844 wrote to memory of 752 N/A C:\Program Files\rtsd\rfusclient.exe C:\Program Files\rtsd\rfusclient.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe

"C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\start.bat" "

C:\Users\Admin\AppData\Local\Temp\done.sfx.exe

done.sfx.exe -p12345 -dC:\Users\Admin\AppData\Local\Temp

C:\Users\Admin\AppData\Local\Temp\done.exe

"C:\Users\Admin\AppData\Local\Temp\done.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Program Files (x86)\Skype\Skype\install.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im 4t4t5

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im g4rgt

C:\Windows\SysWOW64\reg.exe

reg delete "70t9j" /f

C:\Windows\SysWOW64\regedit.exe

regedit /s "regedit.reg"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Program Files\rtsd\*.*"

C:\Program Files\rtsd\rutserv.exe

rutserv.exe /silentinstall

C:\Program Files\rtsd\rutserv.exe

rutserv.exe /firewall

C:\Program Files\rtsd\rutserv.exe

rutserv.exe /start

C:\Program Files\rtsd\rutserv.exe

"C:\Program Files\rtsd\rutserv.exe"

C:\Program Files\rtsd\rfusclient.exe

"C:\Program Files\rtsd\rfusclient.exe"

C:\Program Files\rtsd\rfusclient.exe

"C:\Program Files\rtsd\rfusclient.exe" /tray

C:\Program Files\rtsd\rfusclient.exe

"C:\Program Files\rtsd\rfusclient.exe" /tray

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

memory/1192-54-0x0000000076011000-0x0000000076013000-memory.dmp

memory/1220-55-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Start.bat

MD5 5c2579116c93e93aa51120f9e5c7832f
SHA1 8716bb82b326d4c4d1d0d459591e34cebe7452bf
SHA256 33a1a9c8075a826cf9af1bea7bbde3bcdc359a59104556df73004d31e6e81510
SHA512 272943f8efe1e93761d5d063bf5c92a15dbc34621df19bb679daf18f0ece66ee2844385a9b95283ebbbafce9f5d5ba7012792393eb886b704f123a4d65c74360

C:\Users\Admin\AppData\Local\Temp\done.sfx.exe

MD5 1a3a5f5e74c490dd51ecee0e99443006
SHA1 d428523078df559a41138ba14a1c2371ed85cfb2
SHA256 09093128167ba929e88b21458c2b019d62ea427d2c953431ed18bd36eeb58afa
SHA512 58931690810de79f2c2a02561393ac00354a24345751d874cb3c59a28b4a839268655ce5200177a45d4a9d5eeb0095bbded9c259d86337e06dd880ec2f3b36e7

\Users\Admin\AppData\Local\Temp\done.sfx.exe

MD5 1a3a5f5e74c490dd51ecee0e99443006
SHA1 d428523078df559a41138ba14a1c2371ed85cfb2
SHA256 09093128167ba929e88b21458c2b019d62ea427d2c953431ed18bd36eeb58afa
SHA512 58931690810de79f2c2a02561393ac00354a24345751d874cb3c59a28b4a839268655ce5200177a45d4a9d5eeb0095bbded9c259d86337e06dd880ec2f3b36e7

memory/1864-59-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\done.sfx.exe

MD5 1a3a5f5e74c490dd51ecee0e99443006
SHA1 d428523078df559a41138ba14a1c2371ed85cfb2
SHA256 09093128167ba929e88b21458c2b019d62ea427d2c953431ed18bd36eeb58afa
SHA512 58931690810de79f2c2a02561393ac00354a24345751d874cb3c59a28b4a839268655ce5200177a45d4a9d5eeb0095bbded9c259d86337e06dd880ec2f3b36e7

\Users\Admin\AppData\Local\Temp\done.exe

MD5 00d9268a9d3afca847690635acccfee1
SHA1 b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA256 eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
SHA512 0b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096

\Users\Admin\AppData\Local\Temp\done.exe

MD5 00d9268a9d3afca847690635acccfee1
SHA1 b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA256 eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
SHA512 0b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096

\Users\Admin\AppData\Local\Temp\done.exe

MD5 00d9268a9d3afca847690635acccfee1
SHA1 b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA256 eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
SHA512 0b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096

\Users\Admin\AppData\Local\Temp\done.exe

MD5 00d9268a9d3afca847690635acccfee1
SHA1 b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA256 eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
SHA512 0b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096

C:\Users\Admin\AppData\Local\Temp\done.exe

MD5 00d9268a9d3afca847690635acccfee1
SHA1 b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA256 eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
SHA512 0b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096

memory/1652-66-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\done.exe

MD5 00d9268a9d3afca847690635acccfee1
SHA1 b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA256 eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
SHA512 0b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096

memory/1608-70-0x0000000000000000-mapping.dmp

memory/2028-72-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Skype\Skype\install.bat

MD5 fd6bef56a5dc776691926eb3aa7b5279
SHA1 da94eb0f6ca09850decb74326fe7894253dfec6c
SHA256 db1602d244bad54475174194204f4604804094c8156b8ea2b1dc81879be8ac92
SHA512 3694350a2efaece3664c96327f0fc6cb77a87d68313a3011824953650b9afc40d19b2db1743dbbd317a223d5463c7a8eae1518a9b1e417226e930a941c7f830c

memory/864-73-0x0000000000000000-mapping.dmp

memory/1092-74-0x0000000000000000-mapping.dmp

memory/1816-75-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Skype\Skype\regedit.reg

MD5 be9eab82e90b682ee82da98a7c77fede
SHA1 d1ac691345dc42dc253c441e92f4e54e74135451
SHA256 49525765484a492bdc74a26bf2baf5f2dda6907dc1866ca80bd3d97c1177fd4d
SHA512 047aa0866e1c4c64ddbda3621741a117f6ce3f2cfb25dee275af26ac398d1af2148d4f068ddb84105215b52bd44932d72b6469c06a1c390a35edbd1768718204

C:\Program Files (x86)\Skype\Skype\rfusclient.exe

MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff

C:\Program Files (x86)\Skype\Skype\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Program Files (x86)\Skype\Skype\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Program Files (x86)\Skype\Skype\rutserv.exe

MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad

C:\Program Files\rtsd\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Program Files\rtsd\rutserv.exe

MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad

C:\Program Files\rtsd\rfusclient.exe

MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff

C:\Program Files\rtsd\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Program Files\rtsd\rutserv.exe

MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad

memory/576-88-0x0000000000000000-mapping.dmp

\Program Files\rtsd\rutserv.exe

MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad

memory/340-82-0x0000000000000000-mapping.dmp

memory/1828-91-0x0000000000000000-mapping.dmp

C:\Program Files\rtsd\rutserv.exe

MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad

memory/1692-94-0x0000000000000000-mapping.dmp

C:\Program Files\rtsd\rutserv.exe

MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad

C:\Program Files\rtsd\rutserv.exe

MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad

\Program Files\rtsd\rfusclient.exe

MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff

\Program Files\rtsd\rfusclient.exe

MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff

memory/1752-101-0x0000000000000000-mapping.dmp

memory/844-102-0x0000000000000000-mapping.dmp

C:\Program Files\rtsd\rfusclient.exe

MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff

C:\Program Files\rtsd\rfusclient.exe

MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff

C:\Program Files\rtsd\rfusclient.exe

MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff

memory/752-107-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-04-17 14:56

Reported

2022-04-17 15:25

Platform

win10v2004-20220414-en

Max time kernel

144s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe"

Signatures

RMS

trojan rat rms

Sets file to hidden

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\done.sfx.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\done.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\rutserv.pdb C:\Program Files\rtsd\rutserv.exe N/A
File opened for modification C:\Windows\SysWOW64\exe\rutserv.pdb C:\Program Files\rtsd\rutserv.exe N/A
File opened for modification C:\Windows\SysWOW64\symbols\exe\rutserv.pdb C:\Program Files\rtsd\rutserv.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\rtsd\rfusclient.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\rtsd\vp8encoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\rtsd\rutserv.pdb C:\Program Files\rtsd\rutserv.exe N/A
File opened for modification C:\Program Files\rtsd\rutserv.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files (x86)\Skype\Skype\install.bat C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File opened for modification C:\Program Files (x86)\Skype\Skype\regedit.reg C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File opened for modification C:\Program Files (x86)\Skype\Skype\rfusclient.exe C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File opened for modification C:\Program Files (x86)\Skype\Skype\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File opened for modification C:\Program Files (x86)\Skype\Skype\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File opened for modification C:\Program Files\rtsd\vp8decoder.dll C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\rtsd\vp8encoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files (x86)\Skype\Skype\rutserv.exe C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File opened for modification C:\Program Files (x86)\Skype\Skype\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File created C:\Program Files (x86)\Skype\Skype\Uninstall.ini C:\Users\Admin\AppData\Local\Temp\done.exe N/A
File opened for modification C:\Program Files\rtsd\rfusclient.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\rtsd\rutserv.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\rtsd\vp8decoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\rtsd\vp8decoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\rtsd\rfusclient.exe C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\rtsd\rutserv.exe C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\rtsd\vp8encoder.dll C:\Windows\SysWOW64\attrib.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files\rtsd\rfusclient.exe N/A
N/A N/A C:\Program Files\rtsd\rfusclient.exe N/A
N/A N/A C:\Program Files\rtsd\rfusclient.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\rtsd\rutserv.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\rtsd\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\rtsd\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\rtsd\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\rtsd\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1648 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe C:\Windows\SysWOW64\cmd.exe
PID 3344 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\done.sfx.exe
PID 3344 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\done.sfx.exe
PID 3344 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\done.sfx.exe
PID 2160 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\done.sfx.exe C:\Users\Admin\AppData\Local\Temp\done.exe
PID 2160 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\done.sfx.exe C:\Users\Admin\AppData\Local\Temp\done.exe
PID 2160 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\done.sfx.exe C:\Users\Admin\AppData\Local\Temp\done.exe
PID 4940 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\done.exe C:\Windows\SysWOW64\cmd.exe
PID 4940 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\done.exe C:\Windows\SysWOW64\cmd.exe
PID 4940 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\done.exe C:\Windows\SysWOW64\cmd.exe
PID 4532 wrote to memory of 4492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4532 wrote to memory of 4492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4532 wrote to memory of 4492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4532 wrote to memory of 4144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4532 wrote to memory of 4144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4532 wrote to memory of 4144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4532 wrote to memory of 4568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4532 wrote to memory of 4568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4532 wrote to memory of 4568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4532 wrote to memory of 4464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 4532 wrote to memory of 4464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 4532 wrote to memory of 4464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 4532 wrote to memory of 1728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4532 wrote to memory of 1728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4532 wrote to memory of 1728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4532 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 4532 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 4532 wrote to memory of 532 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 4532 wrote to memory of 2944 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 4532 wrote to memory of 2944 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 4532 wrote to memory of 2944 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 4532 wrote to memory of 4512 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 4532 wrote to memory of 4512 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 4532 wrote to memory of 4512 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\rtsd\rutserv.exe
PID 4344 wrote to memory of 3980 N/A C:\Program Files\rtsd\rutserv.exe C:\Program Files\rtsd\rfusclient.exe
PID 4344 wrote to memory of 3980 N/A C:\Program Files\rtsd\rutserv.exe C:\Program Files\rtsd\rfusclient.exe
PID 4344 wrote to memory of 3980 N/A C:\Program Files\rtsd\rutserv.exe C:\Program Files\rtsd\rfusclient.exe
PID 4344 wrote to memory of 2744 N/A C:\Program Files\rtsd\rutserv.exe C:\Program Files\rtsd\rfusclient.exe
PID 4344 wrote to memory of 2744 N/A C:\Program Files\rtsd\rutserv.exe C:\Program Files\rtsd\rfusclient.exe
PID 4344 wrote to memory of 2744 N/A C:\Program Files\rtsd\rutserv.exe C:\Program Files\rtsd\rfusclient.exe
PID 2744 wrote to memory of 2044 N/A C:\Program Files\rtsd\rfusclient.exe C:\Program Files\rtsd\rfusclient.exe
PID 2744 wrote to memory of 2044 N/A C:\Program Files\rtsd\rfusclient.exe C:\Program Files\rtsd\rfusclient.exe
PID 2744 wrote to memory of 2044 N/A C:\Program Files\rtsd\rfusclient.exe C:\Program Files\rtsd\rfusclient.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe

"C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\start.bat" "

C:\Users\Admin\AppData\Local\Temp\done.sfx.exe

done.sfx.exe -p12345 -dC:\Users\Admin\AppData\Local\Temp

C:\Users\Admin\AppData\Local\Temp\done.exe

"C:\Users\Admin\AppData\Local\Temp\done.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Skype\Skype\install.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im 4t4t5

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im g4rgt

C:\Windows\SysWOW64\reg.exe

reg delete "70t9j" /f

C:\Windows\SysWOW64\regedit.exe

regedit /s "regedit.reg"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Program Files\rtsd\*.*"

C:\Program Files\rtsd\rutserv.exe

rutserv.exe /silentinstall

C:\Program Files\rtsd\rutserv.exe

rutserv.exe /firewall

C:\Program Files\rtsd\rutserv.exe

rutserv.exe /start

C:\Program Files\rtsd\rutserv.exe

"C:\Program Files\rtsd\rutserv.exe"

C:\Program Files\rtsd\rfusclient.exe

"C:\Program Files\rtsd\rfusclient.exe"

C:\Program Files\rtsd\rfusclient.exe

"C:\Program Files\rtsd\rfusclient.exe" /tray

C:\Program Files\rtsd\rfusclient.exe

"C:\Program Files\rtsd\rfusclient.exe" /tray

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp
RU 95.213.205.83:563 rms-server.tektonit.ru tcp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

memory/3344-130-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Start.bat

MD5 5c2579116c93e93aa51120f9e5c7832f
SHA1 8716bb82b326d4c4d1d0d459591e34cebe7452bf
SHA256 33a1a9c8075a826cf9af1bea7bbde3bcdc359a59104556df73004d31e6e81510
SHA512 272943f8efe1e93761d5d063bf5c92a15dbc34621df19bb679daf18f0ece66ee2844385a9b95283ebbbafce9f5d5ba7012792393eb886b704f123a4d65c74360

C:\Users\Admin\AppData\Local\Temp\done.sfx.exe

MD5 1a3a5f5e74c490dd51ecee0e99443006
SHA1 d428523078df559a41138ba14a1c2371ed85cfb2
SHA256 09093128167ba929e88b21458c2b019d62ea427d2c953431ed18bd36eeb58afa
SHA512 58931690810de79f2c2a02561393ac00354a24345751d874cb3c59a28b4a839268655ce5200177a45d4a9d5eeb0095bbded9c259d86337e06dd880ec2f3b36e7

memory/2160-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\done.sfx.exe

MD5 1a3a5f5e74c490dd51ecee0e99443006
SHA1 d428523078df559a41138ba14a1c2371ed85cfb2
SHA256 09093128167ba929e88b21458c2b019d62ea427d2c953431ed18bd36eeb58afa
SHA512 58931690810de79f2c2a02561393ac00354a24345751d874cb3c59a28b4a839268655ce5200177a45d4a9d5eeb0095bbded9c259d86337e06dd880ec2f3b36e7

memory/4940-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\done.exe

MD5 00d9268a9d3afca847690635acccfee1
SHA1 b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA256 eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
SHA512 0b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096

C:\Users\Admin\AppData\Local\Temp\done.exe

MD5 00d9268a9d3afca847690635acccfee1
SHA1 b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA256 eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
SHA512 0b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096

memory/4492-140-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Skype\Skype\install.bat

MD5 fd6bef56a5dc776691926eb3aa7b5279
SHA1 da94eb0f6ca09850decb74326fe7894253dfec6c
SHA256 db1602d244bad54475174194204f4604804094c8156b8ea2b1dc81879be8ac92
SHA512 3694350a2efaece3664c96327f0fc6cb77a87d68313a3011824953650b9afc40d19b2db1743dbbd317a223d5463c7a8eae1518a9b1e417226e930a941c7f830c

memory/4532-138-0x0000000000000000-mapping.dmp

memory/4144-141-0x0000000000000000-mapping.dmp

memory/4568-142-0x0000000000000000-mapping.dmp

memory/4464-143-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Skype\Skype\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Program Files (x86)\Skype\Skype\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Program Files (x86)\Skype\Skype\rutserv.exe

MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad

C:\Program Files (x86)\Skype\Skype\rfusclient.exe

MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff

C:\Program Files (x86)\Skype\Skype\regedit.reg

MD5 be9eab82e90b682ee82da98a7c77fede
SHA1 d1ac691345dc42dc253c441e92f4e54e74135451
SHA256 49525765484a492bdc74a26bf2baf5f2dda6907dc1866ca80bd3d97c1177fd4d
SHA512 047aa0866e1c4c64ddbda3621741a117f6ce3f2cfb25dee275af26ac398d1af2148d4f068ddb84105215b52bd44932d72b6469c06a1c390a35edbd1768718204

memory/532-154-0x0000000000000000-mapping.dmp

C:\Program Files\rtsd\rutserv.exe

MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad

C:\Program Files\rtsd\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Program Files\rtsd\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Program Files\rtsd\rutserv.exe

MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad

C:\Program Files\rtsd\rfusclient.exe

MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff

memory/1728-149-0x0000000000000000-mapping.dmp

C:\Program Files\rtsd\rutserv.exe

MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad

memory/2944-156-0x0000000000000000-mapping.dmp

C:\Program Files\rtsd\rutserv.exe

MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad

memory/4512-158-0x0000000000000000-mapping.dmp

C:\Program Files\rtsd\rutserv.exe

MD5 1a200526e310fc51317804a0781ff47f
SHA1 2f586b57dad7f40cdb822acff9ba081671716235
SHA256 cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512 ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad

memory/2744-162-0x0000000000000000-mapping.dmp

memory/3980-161-0x0000000000000000-mapping.dmp

C:\Program Files\rtsd\rfusclient.exe

MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff

C:\Program Files\rtsd\rfusclient.exe

MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff

memory/2044-165-0x0000000000000000-mapping.dmp

C:\Program Files\rtsd\rfusclient.exe

MD5 f2e9b5c7de59ec84d6c066336030be1a
SHA1 90248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA256 1e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA512 48550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff