Malware Analysis Report

2024-11-15 08:39

Sample ID 220420-k57jdaahfp
Target D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe
SHA256 d3e198d02970c41c83dc1564901df7870ae8753450eb16fd4e264224b80a2ee5
Tags
rms rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d3e198d02970c41c83dc1564901df7870ae8753450eb16fd4e264224b80a2ee5

Threat Level: Known bad

The file D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe was found to be: Known bad.

Malicious Activity Summary

rms rat trojan

Suspicious use of NtCreateUserProcessOtherParentProcess

RMS

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Drops file in Program Files directory

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-04-20 09:12

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-04-20 09:12

Reported

2022-04-20 09:16

Platform

win7-20220414-en

Max time kernel

132s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe"

Signatures

RMS

trojan rat rms

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\OpenJVC\drvhost.exe N/A
N/A N/A C:\Program Files (x86)\OpenJVC\drvhost.exe N/A
N/A N/A C:\Program Files (x86)\OpenJVC\drvhost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\OpenJVC\drvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\OpenJVC\drvhost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\OpenJVC\drvhost.exe C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe N/A
File created C:\Program Files (x86)\OpenJVC\ssleay32.dll C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe N/A
File created C:\Program Files (x86)\OpenJVC\libeay32.dll C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files (x86)\OpenJVC\drvhost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\OpenJVC\drvhost.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files (x86)\OpenJVC\drvhost.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files (x86)\OpenJVC\drvhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1640 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe C:\Program Files (x86)\OpenJVC\drvhost.exe
PID 1640 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe C:\Program Files (x86)\OpenJVC\drvhost.exe
PID 1640 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe C:\Program Files (x86)\OpenJVC\drvhost.exe
PID 1640 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe C:\Program Files (x86)\OpenJVC\drvhost.exe
PID 1640 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe C:\Windows\SysWOW64\cmd.exe
PID 1640 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe C:\Windows\SysWOW64\cmd.exe
PID 1640 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe C:\Windows\SysWOW64\cmd.exe
PID 1640 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe C:\Windows\SysWOW64\cmd.exe
PID 320 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 320 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 320 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 320 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 320 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 320 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 320 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 320 wrote to memory of 1528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 320 wrote to memory of 1588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 320 wrote to memory of 1588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 320 wrote to memory of 1588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 320 wrote to memory of 1588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 364 wrote to memory of 1908 N/A C:\Windows\system32\taskeng.exe C:\Program Files (x86)\OpenJVC\drvhost.exe
PID 364 wrote to memory of 1908 N/A C:\Windows\system32\taskeng.exe C:\Program Files (x86)\OpenJVC\drvhost.exe
PID 364 wrote to memory of 1908 N/A C:\Windows\system32\taskeng.exe C:\Program Files (x86)\OpenJVC\drvhost.exe
PID 364 wrote to memory of 1908 N/A C:\Windows\system32\taskeng.exe C:\Program Files (x86)\OpenJVC\drvhost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe

"C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe"

C:\Program Files (x86)\OpenJVC\drvhost.exe

"C:\Program Files (x86)\OpenJVC\drvhost.exe"

C:\Program Files (x86)\OpenJVC\drvhost.exe

"C:\Program Files (x86)\OpenJVC\drvhost.exe" -second

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c SchTasks /create /f /XML %temp%\Log43.xml /TN \microsoft\windows\defrag\scheduleddefrag && schtasks /Change /TN \microsoft\windows\defrag\scheduleddefrag /ENABLE && schtasks /run /TN \microsoft\windows\defrag\scheduleddefrag

C:\Windows\SysWOW64\schtasks.exe

SchTasks /create /f /XML C:\Users\Admin\AppData\Local\Temp\Log43.xml /TN \microsoft\windows\defrag\scheduleddefrag

C:\Windows\SysWOW64\schtasks.exe

schtasks /Change /TN \microsoft\windows\defrag\scheduleddefrag /ENABLE

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /TN \microsoft\windows\defrag\scheduleddefrag

C:\Windows\system32\taskeng.exe

taskeng.exe {CD9758FC-0F58-4CDF-B62E-ACAEE3AEE7E4} S-1-5-21-1819626980-2277161760-1023733287-1000:TBHNEBSE\Admin:Interactive:[1]

C:\Program Files (x86)\OpenJVC\drvhost.exe

"C:\Program Files (x86)\OpenJVC\drvhost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rms.megatonz.ru udp
NL 185.82.202.138:5655 rms.megatonz.ru tcp
NL 185.82.202.138:5655 rms.megatonz.ru tcp
N/A 127.0.0.1:5650 tcp

Files

memory/1640-54-0x00000000762C1000-0x00000000762C3000-memory.dmp

\Users\Admin\AppData\Local\Temp\nsy263.tmp\System.dll

MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

\Users\Admin\AppData\Local\Temp\nsy263.tmp\NSISList.dll

MD5 4b0617493f32b2b5fe5e838eeb885819
SHA1 336e84380420a9caaa9c12af7c8e530135e63c57
SHA256 df3621f83e9d11be45e0e617b899c4ab0241f60ed56494e892dc449482058402
SHA512 5c50cf97cd9a6c699ec7928a08f77f4eaa68105e87a974432e39b637f926f0df8a95ec19bd63465fc438a4ef6349398938bc8d7651de125d13ccab89d1d49143

\Users\Admin\AppData\Local\Temp\nsy263.tmp\registry.dll

MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

\Program Files (x86)\OpenJVC\drvhost.exe

MD5 2d8bef5c87c297073eb19739ad3f6fe5
SHA1 5634208b9374b21fd5a0d8872333b1753b58c760
SHA256 2d3a2e40afb18ed3946c38c155f85072d9cfd7604a76d8c646ce3ce15ab795eb
SHA512 ca06b03ca87d71dcb0fb583f79fa6fbe56c1f4a49129e4022158e5ca50706fc52e5fb23a5ebf2d5db7db9fdd3bd8fd8c9bf6477775b9c1878db3dc1ccc70898a

memory/1348-60-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\OpenJVC\drvhost.exe

MD5 2d8bef5c87c297073eb19739ad3f6fe5
SHA1 5634208b9374b21fd5a0d8872333b1753b58c760
SHA256 2d3a2e40afb18ed3946c38c155f85072d9cfd7604a76d8c646ce3ce15ab795eb
SHA512 ca06b03ca87d71dcb0fb583f79fa6fbe56c1f4a49129e4022158e5ca50706fc52e5fb23a5ebf2d5db7db9fdd3bd8fd8c9bf6477775b9c1878db3dc1ccc70898a

C:\Program Files (x86)\OpenJVC\libeay32.dll

MD5 4cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1 a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256 a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA512 46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

\Program Files (x86)\OpenJVC\libeay32.dll

MD5 4cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1 a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256 a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA512 46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

C:\Program Files (x86)\OpenJVC\ssleay32.dll

MD5 5c268ca919854fc22d85f916d102ee7f
SHA1 0957cf86e0334673eb45945985b5c033b412be0e
SHA256 1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA512 76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

\Program Files (x86)\OpenJVC\ssleay32.dll

MD5 5c268ca919854fc22d85f916d102ee7f
SHA1 0957cf86e0334673eb45945985b5c033b412be0e
SHA256 1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA512 76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

C:\Program Files (x86)\OpenJVC\drvhost.exe

MD5 2d8bef5c87c297073eb19739ad3f6fe5
SHA1 5634208b9374b21fd5a0d8872333b1753b58c760
SHA256 2d3a2e40afb18ed3946c38c155f85072d9cfd7604a76d8c646ce3ce15ab795eb
SHA512 ca06b03ca87d71dcb0fb583f79fa6fbe56c1f4a49129e4022158e5ca50706fc52e5fb23a5ebf2d5db7db9fdd3bd8fd8c9bf6477775b9c1878db3dc1ccc70898a

C:\Program Files (x86)\OpenJVC\drvhost.exe

MD5 2d8bef5c87c297073eb19739ad3f6fe5
SHA1 5634208b9374b21fd5a0d8872333b1753b58c760
SHA256 2d3a2e40afb18ed3946c38c155f85072d9cfd7604a76d8c646ce3ce15ab795eb
SHA512 ca06b03ca87d71dcb0fb583f79fa6fbe56c1f4a49129e4022158e5ca50706fc52e5fb23a5ebf2d5db7db9fdd3bd8fd8c9bf6477775b9c1878db3dc1ccc70898a

\Program Files (x86)\OpenJVC\ssleay32.dll

MD5 5c268ca919854fc22d85f916d102ee7f
SHA1 0957cf86e0334673eb45945985b5c033b412be0e
SHA256 1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA512 76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

\Program Files (x86)\OpenJVC\libeay32.dll

MD5 4cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1 a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256 a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA512 46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

\Users\Admin\AppData\Local\Temp\nsy263.tmp\nsExec.dll

MD5 f27689c513e7d12c7c974d5f8ef710d6
SHA1 e305f2a2898d765a64c82c449dfb528665b4a892
SHA256 1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47
SHA512 734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc

memory/320-73-0x0000000000000000-mapping.dmp

memory/2020-74-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Log43.xml

MD5 d91f1a2c8a4fc1378a4bc5a2ce8510fb
SHA1 0ebfc0a627a4a0df62170402032ab80dcbaefb09
SHA256 ac175ed03340afa53ee19927e265291a735a29a7effc75afd69fc0a23e5b2c57
SHA512 47f8c97b6f7eaf68346b787cc7eeb9d94a0fcb6b242704cd30ce06edf155adac79b4659b27fb693a4c3fb82ca425ffa22674a91c12dc27ccf8add860e271c933

memory/1528-76-0x0000000000000000-mapping.dmp

memory/1588-77-0x0000000000000000-mapping.dmp

memory/1908-78-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\OpenJVC\drvhost.exe

MD5 2d8bef5c87c297073eb19739ad3f6fe5
SHA1 5634208b9374b21fd5a0d8872333b1753b58c760
SHA256 2d3a2e40afb18ed3946c38c155f85072d9cfd7604a76d8c646ce3ce15ab795eb
SHA512 ca06b03ca87d71dcb0fb583f79fa6fbe56c1f4a49129e4022158e5ca50706fc52e5fb23a5ebf2d5db7db9fdd3bd8fd8c9bf6477775b9c1878db3dc1ccc70898a

\Program Files (x86)\OpenJVC\ssleay32.dll

MD5 5c268ca919854fc22d85f916d102ee7f
SHA1 0957cf86e0334673eb45945985b5c033b412be0e
SHA256 1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA512 76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

\Program Files (x86)\OpenJVC\libeay32.dll

MD5 4cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1 a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256 a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA512 46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

Analysis: behavioral2

Detonation Overview

Submitted

2022-04-20 09:12

Reported

2022-04-20 09:16

Platform

win10v2004-20220414-en

Max time kernel

153s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe"

Signatures

RMS

trojan rat rms

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2948 created 1588 N/A C:\Windows\system32\svchost.exe C:\Program Files (x86)\OpenJVC\drvhost.exe

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\OpenJVC\drvhost.exe N/A
N/A N/A C:\Program Files (x86)\OpenJVC\drvhost.exe N/A
N/A N/A C:\Program Files (x86)\OpenJVC\drvhost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\OpenJVC\drvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\OpenJVC\drvhost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\OpenJVC\drvhost.exe C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe N/A
File created C:\Program Files (x86)\OpenJVC\ssleay32.dll C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe N/A
File created C:\Program Files (x86)\OpenJVC\libeay32.dll C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files (x86)\OpenJVC\drvhost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\OpenJVC\drvhost.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files (x86)\OpenJVC\drvhost.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files (x86)\OpenJVC\drvhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4964 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe C:\Program Files (x86)\OpenJVC\drvhost.exe
PID 4964 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe C:\Program Files (x86)\OpenJVC\drvhost.exe
PID 4964 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe C:\Program Files (x86)\OpenJVC\drvhost.exe
PID 2948 wrote to memory of 4980 N/A C:\Windows\system32\svchost.exe C:\Program Files (x86)\OpenJVC\drvhost.exe
PID 2948 wrote to memory of 4980 N/A C:\Windows\system32\svchost.exe C:\Program Files (x86)\OpenJVC\drvhost.exe
PID 2948 wrote to memory of 4980 N/A C:\Windows\system32\svchost.exe C:\Program Files (x86)\OpenJVC\drvhost.exe
PID 4964 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe C:\Windows\SysWOW64\cmd.exe
PID 4964 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe C:\Windows\SysWOW64\cmd.exe
PID 4964 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe C:\Windows\SysWOW64\cmd.exe
PID 4064 wrote to memory of 4140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4064 wrote to memory of 4140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4064 wrote to memory of 4140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4064 wrote to memory of 4836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4064 wrote to memory of 4836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4064 wrote to memory of 4836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4064 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4064 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4064 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe

"C:\Users\Admin\AppData\Local\Temp\D3E198D02970C41C83DC1564901DF7870AE8753450EB1.exe"

C:\Program Files (x86)\OpenJVC\drvhost.exe

"C:\Program Files (x86)\OpenJVC\drvhost.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon

C:\Program Files (x86)\OpenJVC\drvhost.exe

"C:\Program Files (x86)\OpenJVC\drvhost.exe" -second

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c SchTasks /create /f /XML %temp%\Log43.xml /TN \microsoft\windows\defrag\scheduleddefrag && schtasks /Change /TN \microsoft\windows\defrag\scheduleddefrag /ENABLE && schtasks /run /TN \microsoft\windows\defrag\scheduleddefrag

C:\Windows\SysWOW64\schtasks.exe

SchTasks /create /f /XML C:\Users\Admin\AppData\Local\Temp\Log43.xml /TN \microsoft\windows\defrag\scheduleddefrag

C:\Windows\SysWOW64\schtasks.exe

schtasks /Change /TN \microsoft\windows\defrag\scheduleddefrag /ENABLE

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /TN \microsoft\windows\defrag\scheduleddefrag

C:\Program Files (x86)\OpenJVC\drvhost.exe

"C:\Program Files (x86)\OpenJVC\drvhost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rms.megatonz.ru udp
NL 185.82.202.138:5655 rms.megatonz.ru tcp
US 20.42.65.84:443 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
NL 185.82.202.138:5655 rms.megatonz.ru tcp
N/A 127.0.0.1:5650 tcp
NL 185.82.202.138:5655 rms.megatonz.ru tcp
N/A 127.0.0.1:5650 tcp

Files

C:\Users\Admin\AppData\Local\Temp\nswBF7D.tmp\System.dll

MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

C:\Users\Admin\AppData\Local\Temp\nswBF7D.tmp\NSISList.dll

MD5 4b0617493f32b2b5fe5e838eeb885819
SHA1 336e84380420a9caaa9c12af7c8e530135e63c57
SHA256 df3621f83e9d11be45e0e617b899c4ab0241f60ed56494e892dc449482058402
SHA512 5c50cf97cd9a6c699ec7928a08f77f4eaa68105e87a974432e39b637f926f0df8a95ec19bd63465fc438a4ef6349398938bc8d7651de125d13ccab89d1d49143

C:\Users\Admin\AppData\Local\Temp\nswBF7D.tmp\NSISList.dll

MD5 4b0617493f32b2b5fe5e838eeb885819
SHA1 336e84380420a9caaa9c12af7c8e530135e63c57
SHA256 df3621f83e9d11be45e0e617b899c4ab0241f60ed56494e892dc449482058402
SHA512 5c50cf97cd9a6c699ec7928a08f77f4eaa68105e87a974432e39b637f926f0df8a95ec19bd63465fc438a4ef6349398938bc8d7651de125d13ccab89d1d49143

memory/4964-133-0x00000000022B0000-0x00000000022D4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nswBF7D.tmp\registry.dll

MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

memory/1588-135-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\OpenJVC\drvhost.exe

MD5 2d8bef5c87c297073eb19739ad3f6fe5
SHA1 5634208b9374b21fd5a0d8872333b1753b58c760
SHA256 2d3a2e40afb18ed3946c38c155f85072d9cfd7604a76d8c646ce3ce15ab795eb
SHA512 ca06b03ca87d71dcb0fb583f79fa6fbe56c1f4a49129e4022158e5ca50706fc52e5fb23a5ebf2d5db7db9fdd3bd8fd8c9bf6477775b9c1878db3dc1ccc70898a

C:\Program Files (x86)\OpenJVC\libeay32.dll

MD5 4cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1 a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256 a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA512 46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

C:\Program Files (x86)\OpenJVC\libeay32.dll

MD5 4cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1 a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256 a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA512 46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

C:\Program Files (x86)\OpenJVC\ssleay32.dll

MD5 5c268ca919854fc22d85f916d102ee7f
SHA1 0957cf86e0334673eb45945985b5c033b412be0e
SHA256 1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA512 76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

C:\Program Files (x86)\OpenJVC\ssleay32.dll

MD5 5c268ca919854fc22d85f916d102ee7f
SHA1 0957cf86e0334673eb45945985b5c033b412be0e
SHA256 1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA512 76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

C:\Program Files (x86)\OpenJVC\drvhost.exe

MD5 2d8bef5c87c297073eb19739ad3f6fe5
SHA1 5634208b9374b21fd5a0d8872333b1753b58c760
SHA256 2d3a2e40afb18ed3946c38c155f85072d9cfd7604a76d8c646ce3ce15ab795eb
SHA512 ca06b03ca87d71dcb0fb583f79fa6fbe56c1f4a49129e4022158e5ca50706fc52e5fb23a5ebf2d5db7db9fdd3bd8fd8c9bf6477775b9c1878db3dc1ccc70898a

memory/4980-142-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\OpenJVC\drvhost.exe

MD5 2d8bef5c87c297073eb19739ad3f6fe5
SHA1 5634208b9374b21fd5a0d8872333b1753b58c760
SHA256 2d3a2e40afb18ed3946c38c155f85072d9cfd7604a76d8c646ce3ce15ab795eb
SHA512 ca06b03ca87d71dcb0fb583f79fa6fbe56c1f4a49129e4022158e5ca50706fc52e5fb23a5ebf2d5db7db9fdd3bd8fd8c9bf6477775b9c1878db3dc1ccc70898a

C:\Program Files (x86)\OpenJVC\ssleay32.dll

MD5 5c268ca919854fc22d85f916d102ee7f
SHA1 0957cf86e0334673eb45945985b5c033b412be0e
SHA256 1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA512 76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

C:\Program Files (x86)\OpenJVC\libeay32.dll

MD5 4cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1 a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256 a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA512 46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

C:\Users\Admin\AppData\Local\Temp\nswBF7D.tmp\nsExec.dll

MD5 f27689c513e7d12c7c974d5f8ef710d6
SHA1 e305f2a2898d765a64c82c449dfb528665b4a892
SHA256 1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47
SHA512 734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc

memory/4064-147-0x0000000000000000-mapping.dmp

memory/4140-148-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Log43.xml

MD5 d91f1a2c8a4fc1378a4bc5a2ce8510fb
SHA1 0ebfc0a627a4a0df62170402032ab80dcbaefb09
SHA256 ac175ed03340afa53ee19927e265291a735a29a7effc75afd69fc0a23e5b2c57
SHA512 47f8c97b6f7eaf68346b787cc7eeb9d94a0fcb6b242704cd30ce06edf155adac79b4659b27fb693a4c3fb82ca425ffa22674a91c12dc27ccf8add860e271c933

memory/4836-150-0x0000000000000000-mapping.dmp

memory/2000-151-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\OpenJVC\drvhost.exe

MD5 2d8bef5c87c297073eb19739ad3f6fe5
SHA1 5634208b9374b21fd5a0d8872333b1753b58c760
SHA256 2d3a2e40afb18ed3946c38c155f85072d9cfd7604a76d8c646ce3ce15ab795eb
SHA512 ca06b03ca87d71dcb0fb583f79fa6fbe56c1f4a49129e4022158e5ca50706fc52e5fb23a5ebf2d5db7db9fdd3bd8fd8c9bf6477775b9c1878db3dc1ccc70898a

C:\Program Files (x86)\OpenJVC\libeay32.dll

MD5 4cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1 a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256 a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA512 46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

C:\Program Files (x86)\OpenJVC\ssleay32.dll

MD5 5c268ca919854fc22d85f916d102ee7f
SHA1 0957cf86e0334673eb45945985b5c033b412be0e
SHA256 1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA512 76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310