Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-04-2022 15:48

General

  • Target

    1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe

  • Size

    4.5MB

  • MD5

    fd21e5aae8d898331b46b428986ad774

  • SHA1

    4a8f9681e6ad126b9b0860af71021b65ea7e3e17

  • SHA256

    1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c

  • SHA512

    1a5405ff6fbecf4debe3556e1271c0a6b4e097c0f92d63b9bd6bbfc22ecb675ad7a1dd90590a46c43afae309cb33b5b6c2d2d43b4a1788de23941170ab17d371

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 7 IoCs
  • Sets file to hidden 1 TTPs

    Modifies file attributes to stop it showing in Explorer etc.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 28 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies registry class 1 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe
    "C:\Users\Admin\AppData\Local\Temp\1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3696
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\System\install.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3408
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\System\install.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2528
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Program Files (x86)\System" +H +S /S /D
          4⤵
          • Drops file in Program Files directory
          • Views/modifies file attributes
          PID:4232
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Program Files (x86)\System\*.*" +H +S /S /D
          4⤵
          • Drops file in Program Files directory
          • Views/modifies file attributes
          PID:2128
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im rutserv.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2832
        • C:\Windows\SysWOW64\taskkill.exe
          Taskkill /f /im rutserv.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2624
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im rfusclient.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3512
        • C:\Windows\SysWOW64\taskkill.exe
          Taskkill /f /im rfusclient.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4400
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
          4⤵
            PID:4260
          • C:\Windows\SysWOW64\regedit.exe
            regedit /s "regedit.reg"
            4⤵
            • Runs .reg file with regedit
            PID:4076
          • C:\Windows\SysWOW64\timeout.exe
            timeout 2
            4⤵
            • Delays execution with timeout.exe
            PID:3852
          • C:\Program Files (x86)\System\rutserv.exe
            rutserv.exe /silentinstall
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:880
          • C:\Program Files (x86)\System\rutserv.exe
            rutserv.exe /firewall
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:1228
          • C:\Program Files (x86)\System\rutserv.exe
            rutserv.exe /start
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:788
          • C:\Windows\SysWOW64\sc.exe
            sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
            4⤵
              PID:4312
            • C:\Windows\SysWOW64\sc.exe
              sc config RManService obj= LocalSystem type= interact type= own
              4⤵
                PID:1412
              • C:\Windows\SysWOW64\sc.exe
                sc config RManService DisplayName= "Windows_Defender v6.3"
                4⤵
                  PID:2272
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 120
                  4⤵
                  • Delays execution with timeout.exe
                  PID:1952
          • C:\Program Files (x86)\System\rutserv.exe
            "C:\Program Files (x86)\System\rutserv.exe"
            1⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4280
            • C:\Program Files (x86)\System\rfusclient.exe
              "C:\Program Files (x86)\System\rfusclient.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4780
              • C:\Program Files (x86)\System\rfusclient.exe
                "C:\Program Files (x86)\System\rfusclient.exe" /tray
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: SetClipboardViewer
                PID:3660
            • C:\Program Files (x86)\System\rfusclient.exe
              "C:\Program Files (x86)\System\rfusclient.exe" /tray
              2⤵
              • Executes dropped EXE
              PID:3412

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\System\install.bat

            Filesize

            1KB

            MD5

            9f46308a60d92aef5131243f7c1ecdf8

            SHA1

            d26868c6c80d3dad7cb1f3891fa7a8ef2cf9700b

            SHA256

            e6dd5d940dccce5e843c6addabf5bd28b533c2f286e555ac274c022cc5e55a54

            SHA512

            f685e12f067838e913a94615f5742832ae9527e4aaf785188dfbf13f8c53ceceba5179187fc09e98909399f315b32414b52f81b3c6b9a0854ac070cf1ce82fd8

          • C:\Program Files (x86)\System\install.vbs

            Filesize

            120B

            MD5

            c719a030434d3fa96d62868f27e904a6

            SHA1

            f2f750a752dd1fda8915a47b082af7cf2d3e3655

            SHA256

            2696ee4302a85c6b4101fc6d1ce8e38b94fd9c2bbd1acc73b553576b3aacb92f

            SHA512

            47a9367f7596d19c0636766cd34ca3701d3b1239a284f2333fd04a48422f53b0df21002fd38a4f229f6a2f9f9e8163267e13ecb24d9ce6de1863d5f59ab04ff0

          • C:\Program Files (x86)\System\mailsend.exe

            Filesize

            1.2MB

            MD5

            ac23b87f8ec60ddd3f555556f89a6af8

            SHA1

            3cea6f84757d15ee8d7fa19d3dfc4992c50aa90c

            SHA256

            80a1d0a15066c7af67cf5377e59e450c2a96018505236f8f3352173282b27ae4

            SHA512

            57e67eab9c2a3b94161500eb0091533a539454e9bfddd47c61477299de9455b7ca11c498c5d8a7d77f4763a2053acb4ff96868a9313fede29969edc16d35b167

          • C:\Program Files (x86)\System\regedit.reg

            Filesize

            12KB

            MD5

            251212852a073e6fc5fbe3af92f66adb

            SHA1

            6ee07cb20f57830325c11867e68fea49ae0e87ea

            SHA256

            f2c83f4cc13b0cd28090dd128ec5ff221681118f6100eddaead88526070ceecb

            SHA512

            f3853ece99edc6d39edbf1c7bca471e71aa034684a85358b033e50418ffa061f1e8724cba76065048901c20c9f9a6dbd86a17ee33756c0452d4d3358047296be

          • C:\Program Files (x86)\System\rfusclient.exe

            Filesize

            1.5MB

            MD5

            b8667a1e84567fcf7821bcefb6a444af

            SHA1

            9c1f91fe77ad357c8f81205d65c9067a270d61f0

            SHA256

            dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

            SHA512

            ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

          • C:\Program Files (x86)\System\rfusclient.exe

            Filesize

            1.5MB

            MD5

            b8667a1e84567fcf7821bcefb6a444af

            SHA1

            9c1f91fe77ad357c8f81205d65c9067a270d61f0

            SHA256

            dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

            SHA512

            ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

          • C:\Program Files (x86)\System\rfusclient.exe

            Filesize

            1.5MB

            MD5

            b8667a1e84567fcf7821bcefb6a444af

            SHA1

            9c1f91fe77ad357c8f81205d65c9067a270d61f0

            SHA256

            dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

            SHA512

            ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

          • C:\Program Files (x86)\System\rfusclient.exe

            Filesize

            1.5MB

            MD5

            b8667a1e84567fcf7821bcefb6a444af

            SHA1

            9c1f91fe77ad357c8f81205d65c9067a270d61f0

            SHA256

            dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

            SHA512

            ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

          • C:\Program Files (x86)\System\rutserv.exe

            Filesize

            1.7MB

            MD5

            37a8802017a212bb7f5255abc7857969

            SHA1

            cb10c0d343c54538d12db8ed664d0a1fa35b6109

            SHA256

            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

            SHA512

            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

          • C:\Program Files (x86)\System\rutserv.exe

            Filesize

            1.7MB

            MD5

            37a8802017a212bb7f5255abc7857969

            SHA1

            cb10c0d343c54538d12db8ed664d0a1fa35b6109

            SHA256

            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

            SHA512

            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

          • C:\Program Files (x86)\System\rutserv.exe

            Filesize

            1.7MB

            MD5

            37a8802017a212bb7f5255abc7857969

            SHA1

            cb10c0d343c54538d12db8ed664d0a1fa35b6109

            SHA256

            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

            SHA512

            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

          • C:\Program Files (x86)\System\rutserv.exe

            Filesize

            1.7MB

            MD5

            37a8802017a212bb7f5255abc7857969

            SHA1

            cb10c0d343c54538d12db8ed664d0a1fa35b6109

            SHA256

            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

            SHA512

            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

          • C:\Program Files (x86)\System\rutserv.exe

            Filesize

            1.7MB

            MD5

            37a8802017a212bb7f5255abc7857969

            SHA1

            cb10c0d343c54538d12db8ed664d0a1fa35b6109

            SHA256

            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

            SHA512

            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

          • C:\Program Files (x86)\System\vp8decoder.dll

            Filesize

            155KB

            MD5

            88318158527985702f61d169434a4940

            SHA1

            3cc751ba256b5727eb0713aad6f554ff1e7bca57

            SHA256

            4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74

            SHA512

            5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

          • C:\Program Files (x86)\System\vp8encoder.dll

            Filesize

            593KB

            MD5

            6298c0af3d1d563834a218a9cc9f54bd

            SHA1

            0185cd591e454ed072e5a5077b25c612f6849dc9

            SHA256

            81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172

            SHA512

            389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

          • memory/788-170-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/788-169-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/788-168-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/788-167-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/788-171-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/788-184-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/788-165-0x0000000000000000-mapping.dmp

          • memory/880-149-0x0000000000000000-mapping.dmp

          • memory/880-153-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/880-154-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/880-155-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/880-156-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/880-151-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/880-152-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1228-163-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1228-160-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1228-161-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1228-162-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1228-159-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1228-164-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1228-157-0x0000000000000000-mapping.dmp

          • memory/1412-194-0x0000000000000000-mapping.dmp

          • memory/1952-196-0x0000000000000000-mapping.dmp

          • memory/2128-135-0x0000000000000000-mapping.dmp

          • memory/2272-195-0x0000000000000000-mapping.dmp

          • memory/2528-133-0x0000000000000000-mapping.dmp

          • memory/2624-143-0x0000000000000000-mapping.dmp

          • memory/2832-142-0x0000000000000000-mapping.dmp

          • memory/3408-130-0x0000000000000000-mapping.dmp

          • memory/3412-178-0x0000000000000000-mapping.dmp

          • memory/3412-189-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3412-186-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3412-188-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3412-192-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3412-182-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3512-144-0x0000000000000000-mapping.dmp

          • memory/3660-199-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3660-200-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3660-197-0x0000000000000000-mapping.dmp

          • memory/3660-201-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3660-202-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3660-203-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3660-204-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3852-148-0x0000000000000000-mapping.dmp

          • memory/4076-147-0x0000000000000000-mapping.dmp

          • memory/4232-134-0x0000000000000000-mapping.dmp

          • memory/4260-146-0x0000000000000000-mapping.dmp

          • memory/4280-205-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4280-176-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4280-177-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4280-175-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4280-174-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4280-173-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4312-193-0x0000000000000000-mapping.dmp

          • memory/4400-145-0x0000000000000000-mapping.dmp

          • memory/4780-179-0x0000000000000000-mapping.dmp

          • memory/4780-183-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/4780-185-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/4780-190-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/4780-187-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/4780-191-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB