Overview

overview

10

Static

static

$77_loader.exe

windows7_x64

10

$77_loader.exe

windows10-2004_x64

Sharing

Copy URL Twitter E-mail

General

  • Target
    $77_loader.exe
  • Size 397KB
  • Sample220419-eq9sasbbcl
  • SHA256 3826953ded758361f9783d67242e4ba87092d637d72bcf81c649e52665c57de4
  • MD5 SHA1 SHA512
Score
10/10
rmsdiscoveryevasionpersistencerattrojan

Malware Config

Targets

    • Target
      $77_loader.exe
    • Size 397KB
    • SHA256 3826953ded758361f9783d67242e4ba87092d637d72bcf81c649e52665c57de4
    • MD5 SHA1 SHA512
    Score
    10/10
    rmsdiscoveryevasionpersistencerattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • Modifies powershell logging option

      evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks