Analysis Overview
SHA256
1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c
Threat Level: Known bad
The file 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c was found to be: Known bad.
Malicious Activity Summary
RMS
ACProtect 1.3x - 1.4x DLL software
ASPack v2.12-2.42
Sets file to hidden
Executes dropped EXE
UPX packed file
Loads dropped DLL
Checks computer location settings
Drops file in Program Files directory
Launches sc.exe
Enumerates physical storage devices
Views/modifies file attributes
Suspicious use of AdjustPrivilegeToken
Runs .reg file with regedit
Suspicious behavior: EnumeratesProcesses
Modifies registry class
Suspicious use of WriteProcessMemory
Delays execution with timeout.exe
Kills process with taskkill
Suspicious use of SetWindowsHookEx
Suspicious behavior: SetClipboardViewer
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-04-20 15:48
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-04-20 15:48
Reported
2022-04-20 16:33
Platform
win7-20220414-en
Max time kernel
200s
Max time network
210s
Command Line
Signatures
RMS
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rfusclient.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rfusclient.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rfusclient.exe | N/A |
Sets file to hidden
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
Drops file in Program Files directory
Launches sc.exe
Enumerates physical storage devices
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Runs .reg file with regedit
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\regedit.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rfusclient.exe | N/A |
Suspicious behavior: SetClipboardViewer
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\System\rfusclient.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe
"C:\Users\Admin\AppData\Local\Temp\1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\System\install.vbs"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Program Files (x86)\System\install.bat" "
C:\Windows\SysWOW64\attrib.exe
attrib "C:\Program Files (x86)\System" +H +S /S /D
C:\Windows\SysWOW64\attrib.exe
attrib "C:\Program Files (x86)\System\*.*" +H +S /S /D
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rutserv.exe
C:\Windows\SysWOW64\taskkill.exe
Taskkill /f /im rutserv.exe
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfusclient.exe
C:\Windows\SysWOW64\taskkill.exe
Taskkill /f /im rfusclient.exe
C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
C:\Windows\SysWOW64\regedit.exe
regedit /s "regedit.reg"
C:\Windows\SysWOW64\timeout.exe
timeout 2
C:\Program Files (x86)\System\rutserv.exe
rutserv.exe /silentinstall
C:\Program Files (x86)\System\rutserv.exe
rutserv.exe /firewall
C:\Program Files (x86)\System\rutserv.exe
rutserv.exe /start
C:\Program Files (x86)\System\rutserv.exe
"C:\Program Files (x86)\System\rutserv.exe"
C:\Program Files (x86)\System\rfusclient.exe
"C:\Program Files (x86)\System\rfusclient.exe"
C:\Program Files (x86)\System\rfusclient.exe
"C:\Program Files (x86)\System\rfusclient.exe" /tray
C:\Windows\SysWOW64\sc.exe
sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
C:\Program Files (x86)\System\rfusclient.exe
"C:\Program Files (x86)\System\rfusclient.exe" /tray
C:\Windows\SysWOW64\sc.exe
sc config RManService obj= LocalSystem type= interact type= own
C:\Windows\SysWOW64\sc.exe
sc config RManService DisplayName= "Windows_Defender v6.3"
C:\Windows\SysWOW64\timeout.exe
timeout 120
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | rmansys.ru | udp |
| RU | 31.31.198.18:80 | rmansys.ru | tcp |
| RU | 31.31.198.18:80 | rmansys.ru | tcp |
| US | 8.8.8.8:53 | rms-server.tektonit.ru | udp |
| RU | 95.213.205.83:5655 | rms-server.tektonit.ru | tcp |
Files
memory/1852-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp
memory/1360-55-0x0000000000000000-mapping.dmp
C:\Program Files (x86)\System\install.vbs
| MD5 | c719a030434d3fa96d62868f27e904a6 |
| SHA1 | f2f750a752dd1fda8915a47b082af7cf2d3e3655 |
| SHA256 | 2696ee4302a85c6b4101fc6d1ce8e38b94fd9c2bbd1acc73b553576b3aacb92f |
| SHA512 | 47a9367f7596d19c0636766cd34ca3701d3b1239a284f2333fd04a48422f53b0df21002fd38a4f229f6a2f9f9e8163267e13ecb24d9ce6de1863d5f59ab04ff0 |
C:\Program Files (x86)\System\install.bat
| MD5 | 9f46308a60d92aef5131243f7c1ecdf8 |
| SHA1 | d26868c6c80d3dad7cb1f3891fa7a8ef2cf9700b |
| SHA256 | e6dd5d940dccce5e843c6addabf5bd28b533c2f286e555ac274c022cc5e55a54 |
| SHA512 | f685e12f067838e913a94615f5742832ae9527e4aaf785188dfbf13f8c53ceceba5179187fc09e98909399f315b32414b52f81b3c6b9a0854ac070cf1ce82fd8 |
memory/1216-59-0x0000000000000000-mapping.dmp
memory/2032-61-0x0000000000000000-mapping.dmp
memory/1796-63-0x0000000000000000-mapping.dmp
C:\Program Files (x86)\System\mailsend.exe
| MD5 | ac23b87f8ec60ddd3f555556f89a6af8 |
| SHA1 | 3cea6f84757d15ee8d7fa19d3dfc4992c50aa90c |
| SHA256 | 80a1d0a15066c7af67cf5377e59e450c2a96018505236f8f3352173282b27ae4 |
| SHA512 | 57e67eab9c2a3b94161500eb0091533a539454e9bfddd47c61477299de9455b7ca11c498c5d8a7d77f4763a2053acb4ff96868a9313fede29969edc16d35b167 |
C:\Program Files (x86)\System\regedit.reg
| MD5 | 251212852a073e6fc5fbe3af92f66adb |
| SHA1 | 6ee07cb20f57830325c11867e68fea49ae0e87ea |
| SHA256 | f2c83f4cc13b0cd28090dd128ec5ff221681118f6100eddaead88526070ceecb |
| SHA512 | f3853ece99edc6d39edbf1c7bca471e71aa034684a85358b033e50418ffa061f1e8724cba76065048901c20c9f9a6dbd86a17ee33756c0452d4d3358047296be |
C:\Program Files (x86)\System\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
C:\Program Files (x86)\System\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
C:\Program Files (x86)\System\vp8encoder.dll
| MD5 | 6298c0af3d1d563834a218a9cc9f54bd |
| SHA1 | 0185cd591e454ed072e5a5077b25c612f6849dc9 |
| SHA256 | 81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172 |
| SHA512 | 389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe |
C:\Program Files (x86)\System\vp8decoder.dll
| MD5 | 88318158527985702f61d169434a4940 |
| SHA1 | 3cc751ba256b5727eb0713aad6f554ff1e7bca57 |
| SHA256 | 4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74 |
| SHA512 | 5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff |
memory/1892-71-0x0000000000000000-mapping.dmp
memory/932-73-0x0000000000000000-mapping.dmp
memory/436-75-0x0000000000000000-mapping.dmp
memory/1140-77-0x0000000000000000-mapping.dmp
memory/1036-79-0x0000000000000000-mapping.dmp
memory/1188-81-0x0000000000000000-mapping.dmp
memory/1452-83-0x0000000000000000-mapping.dmp
\Program Files (x86)\System\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/1924-86-0x0000000000000000-mapping.dmp
C:\Program Files (x86)\System\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/1924-89-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1924-90-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1924-91-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1924-92-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1924-93-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1924-94-0x0000000000400000-0x0000000000AB9000-memory.dmp
\Program Files (x86)\System\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
C:\Program Files (x86)\System\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/1916-96-0x0000000000000000-mapping.dmp
memory/1916-99-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1916-100-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1916-101-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1916-102-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1916-103-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1916-104-0x0000000000400000-0x0000000000AB9000-memory.dmp
\Program Files (x86)\System\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
C:\Program Files (x86)\System\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/832-106-0x0000000000000000-mapping.dmp
memory/832-109-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/832-110-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/832-111-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/832-112-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/832-113-0x0000000000400000-0x0000000000AB9000-memory.dmp
C:\Program Files (x86)\System\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/964-116-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/964-117-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/964-118-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/964-119-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/964-120-0x0000000000400000-0x0000000000AB9000-memory.dmp
\Program Files (x86)\System\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
memory/1624-122-0x0000000000000000-mapping.dmp
C:\Program Files (x86)\System\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
memory/568-125-0x0000000000000000-mapping.dmp
memory/1624-126-0x0000000000400000-0x00000000009B6000-memory.dmp
C:\Program Files (x86)\System\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
memory/1624-129-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/1624-130-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/568-131-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/832-132-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1624-133-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/1624-134-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/568-135-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/568-136-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/1388-137-0x0000000000000000-mapping.dmp
memory/568-138-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/568-139-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/808-141-0x0000000000000000-mapping.dmp
C:\Program Files (x86)\System\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
memory/808-144-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/808-145-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/808-146-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/808-147-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/808-148-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/808-149-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/1516-150-0x0000000000000000-mapping.dmp
memory/1924-152-0x0000000000000000-mapping.dmp
memory/612-154-0x0000000000000000-mapping.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-04-20 15:48
Reported
2022-04-20 16:30
Platform
win10v2004-20220414-en
Max time kernel
150s
Max time network
155s
Command Line
Signatures
RMS
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rfusclient.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rfusclient.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rfusclient.exe | N/A |
Sets file to hidden
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\WScript.exe | N/A |
Drops file in Program Files directory
Launches sc.exe
Enumerates physical storage devices
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings | C:\Users\Admin\AppData\Local\Temp\1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe | N/A |
Runs .reg file with regedit
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\regedit.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: SetClipboardViewer
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\System\rfusclient.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\System\rutserv.exe | N/A |
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe
"C:\Users\Admin\AppData\Local\Temp\1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\System\install.vbs"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\System\install.bat" "
C:\Windows\SysWOW64\attrib.exe
attrib "C:\Program Files (x86)\System" +H +S /S /D
C:\Windows\SysWOW64\attrib.exe
attrib "C:\Program Files (x86)\System\*.*" +H +S /S /D
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rutserv.exe
C:\Windows\SysWOW64\taskkill.exe
Taskkill /f /im rutserv.exe
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfusclient.exe
C:\Windows\SysWOW64\taskkill.exe
Taskkill /f /im rfusclient.exe
C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
C:\Windows\SysWOW64\regedit.exe
regedit /s "regedit.reg"
C:\Windows\SysWOW64\timeout.exe
timeout 2
C:\Program Files (x86)\System\rutserv.exe
rutserv.exe /silentinstall
C:\Program Files (x86)\System\rutserv.exe
rutserv.exe /firewall
C:\Program Files (x86)\System\rutserv.exe
rutserv.exe /start
C:\Program Files (x86)\System\rutserv.exe
"C:\Program Files (x86)\System\rutserv.exe"
C:\Program Files (x86)\System\rfusclient.exe
"C:\Program Files (x86)\System\rfusclient.exe"
C:\Program Files (x86)\System\rfusclient.exe
"C:\Program Files (x86)\System\rfusclient.exe" /tray
C:\Windows\SysWOW64\sc.exe
sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
C:\Windows\SysWOW64\sc.exe
sc config RManService obj= LocalSystem type= interact type= own
C:\Windows\SysWOW64\sc.exe
sc config RManService DisplayName= "Windows_Defender v6.3"
C:\Windows\SysWOW64\timeout.exe
timeout 120
C:\Program Files (x86)\System\rfusclient.exe
"C:\Program Files (x86)\System\rfusclient.exe" /tray
Network
| Country | Destination | Domain | Proto |
| NL | 104.110.191.140:80 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| IE | 52.109.76.30:443 | tcp | |
| US | 8.8.8.8:53 | rmansys.ru | udp |
| RU | 31.31.198.18:80 | rmansys.ru | tcp |
| RU | 31.31.198.18:80 | rmansys.ru | tcp |
| US | 8.8.8.8:53 | rms-server.tektonit.ru | udp |
| US | 20.42.65.84:443 | tcp | |
| RU | 95.213.205.83:5655 | rms-server.tektonit.ru | tcp |
| NL | 104.110.191.140:80 | tcp | |
| NL | 104.110.191.133:80 | tcp | |
| US | 209.197.3.8:80 | tcp |
Files
memory/3408-130-0x0000000000000000-mapping.dmp
C:\Program Files (x86)\System\install.vbs
| MD5 | c719a030434d3fa96d62868f27e904a6 |
| SHA1 | f2f750a752dd1fda8915a47b082af7cf2d3e3655 |
| SHA256 | 2696ee4302a85c6b4101fc6d1ce8e38b94fd9c2bbd1acc73b553576b3aacb92f |
| SHA512 | 47a9367f7596d19c0636766cd34ca3701d3b1239a284f2333fd04a48422f53b0df21002fd38a4f229f6a2f9f9e8163267e13ecb24d9ce6de1863d5f59ab04ff0 |
C:\Program Files (x86)\System\install.bat
| MD5 | 9f46308a60d92aef5131243f7c1ecdf8 |
| SHA1 | d26868c6c80d3dad7cb1f3891fa7a8ef2cf9700b |
| SHA256 | e6dd5d940dccce5e843c6addabf5bd28b533c2f286e555ac274c022cc5e55a54 |
| SHA512 | f685e12f067838e913a94615f5742832ae9527e4aaf785188dfbf13f8c53ceceba5179187fc09e98909399f315b32414b52f81b3c6b9a0854ac070cf1ce82fd8 |
memory/2528-133-0x0000000000000000-mapping.dmp
memory/4232-134-0x0000000000000000-mapping.dmp
memory/2128-135-0x0000000000000000-mapping.dmp
C:\Program Files (x86)\System\vp8decoder.dll
| MD5 | 88318158527985702f61d169434a4940 |
| SHA1 | 3cc751ba256b5727eb0713aad6f554ff1e7bca57 |
| SHA256 | 4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74 |
| SHA512 | 5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff |
C:\Program Files (x86)\System\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
C:\Program Files (x86)\System\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
C:\Program Files (x86)\System\regedit.reg
| MD5 | 251212852a073e6fc5fbe3af92f66adb |
| SHA1 | 6ee07cb20f57830325c11867e68fea49ae0e87ea |
| SHA256 | f2c83f4cc13b0cd28090dd128ec5ff221681118f6100eddaead88526070ceecb |
| SHA512 | f3853ece99edc6d39edbf1c7bca471e71aa034684a85358b033e50418ffa061f1e8724cba76065048901c20c9f9a6dbd86a17ee33756c0452d4d3358047296be |
C:\Program Files (x86)\System\vp8encoder.dll
| MD5 | 6298c0af3d1d563834a218a9cc9f54bd |
| SHA1 | 0185cd591e454ed072e5a5077b25c612f6849dc9 |
| SHA256 | 81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172 |
| SHA512 | 389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe |
memory/2832-142-0x0000000000000000-mapping.dmp
C:\Program Files (x86)\System\mailsend.exe
| MD5 | ac23b87f8ec60ddd3f555556f89a6af8 |
| SHA1 | 3cea6f84757d15ee8d7fa19d3dfc4992c50aa90c |
| SHA256 | 80a1d0a15066c7af67cf5377e59e450c2a96018505236f8f3352173282b27ae4 |
| SHA512 | 57e67eab9c2a3b94161500eb0091533a539454e9bfddd47c61477299de9455b7ca11c498c5d8a7d77f4763a2053acb4ff96868a9313fede29969edc16d35b167 |
memory/2624-143-0x0000000000000000-mapping.dmp
memory/3512-144-0x0000000000000000-mapping.dmp
memory/4400-145-0x0000000000000000-mapping.dmp
memory/4260-146-0x0000000000000000-mapping.dmp
memory/4076-147-0x0000000000000000-mapping.dmp
memory/3852-148-0x0000000000000000-mapping.dmp
memory/880-149-0x0000000000000000-mapping.dmp
C:\Program Files (x86)\System\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/880-151-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/880-152-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/880-153-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/880-154-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/880-155-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/880-156-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1228-157-0x0000000000000000-mapping.dmp
C:\Program Files (x86)\System\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/1228-159-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1228-160-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1228-161-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1228-162-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1228-163-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/1228-164-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/788-165-0x0000000000000000-mapping.dmp
C:\Program Files (x86)\System\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/788-167-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/788-168-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/788-169-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/788-170-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/788-171-0x0000000000400000-0x0000000000AB9000-memory.dmp
C:\Program Files (x86)\System\rutserv.exe
| MD5 | 37a8802017a212bb7f5255abc7857969 |
| SHA1 | cb10c0d343c54538d12db8ed664d0a1fa35b6109 |
| SHA256 | 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6 |
| SHA512 | 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0 |
memory/4280-173-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/4280-174-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/4280-175-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/4280-176-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/4280-177-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/3412-178-0x0000000000000000-mapping.dmp
C:\Program Files (x86)\System\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
memory/4780-179-0x0000000000000000-mapping.dmp
C:\Program Files (x86)\System\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
memory/788-184-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/4780-183-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/3412-182-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/4780-185-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/4780-187-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/3412-188-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/3412-186-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/3412-189-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/4780-190-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/4780-191-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/3412-192-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/4312-193-0x0000000000000000-mapping.dmp
memory/1412-194-0x0000000000000000-mapping.dmp
memory/2272-195-0x0000000000000000-mapping.dmp
memory/1952-196-0x0000000000000000-mapping.dmp
C:\Program Files (x86)\System\rfusclient.exe
| MD5 | b8667a1e84567fcf7821bcefb6a444af |
| SHA1 | 9c1f91fe77ad357c8f81205d65c9067a270d61f0 |
| SHA256 | dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9 |
| SHA512 | ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852 |
memory/3660-197-0x0000000000000000-mapping.dmp
memory/3660-200-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/3660-199-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/3660-201-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/3660-202-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/3660-203-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/3660-204-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/4280-205-0x0000000000400000-0x0000000000AB9000-memory.dmp