Malware Analysis Report

2024-11-15 08:39

Sample ID 220427-rwlc4shcg9
Target 9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379
SHA256 9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379
Tags
rms evasion rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379

Threat Level: Known bad

The file 9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379 was found to be: Known bad.

Malicious Activity Summary

rms evasion rat trojan upx

RMS

Executes dropped EXE

Sets file to hidden

UPX packed file

Checks computer location settings

Loads dropped DLL

Drops file in Program Files directory

Enumerates physical storage devices

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: SetClipboardViewer

Runs .reg file with regedit

Delays execution with timeout.exe

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Suspicious use of AdjustPrivilegeToken

Kills process with taskkill

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-04-27 14:32

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-04-27 14:32

Reported

2022-04-27 15:03

Platform

win7-20220414-en

Max time kernel

152s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe"

Signatures

RMS

trojan rat rms

Sets file to hidden

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Games\pr.exe C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe N/A
File created C:\Program Files\Server\rfusclient.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\Microsoft Games\1.bat C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe N/A
File created C:\Program Files\Microsoft Games\pr.exe C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe N/A
File opened for modification C:\Program Files\Server\vp8decoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\Server\vp8encoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\rutserv.exe C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\Server\vp8decoder.dll C:\Windows\SysWOW64\attrib.exe N/A
File created C:\Program Files\Microsoft Games\__tmp_rar_sfx_access_check_7097577 C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe N/A
File opened for modification C:\Program Files\Server\rutserv.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\vp8encoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\rfusclient.exe C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\Server\vp8encoder.dll C:\Windows\SysWOW64\attrib.exe N/A
File created C:\Program Files\Server\rutserv.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\Server\vp8decoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Microsoft Games\1.bat C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe N/A
File opened for modification C:\Program Files\Server\rfusclient.exe C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\Server\rutserv.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Server\rutserv.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1828 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe C:\Windows\SysWOW64\cmd.exe
PID 1828 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe C:\Windows\SysWOW64\cmd.exe
PID 1828 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe C:\Windows\SysWOW64\cmd.exe
PID 1828 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe C:\Windows\SysWOW64\cmd.exe
PID 1456 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Microsoft Games\pr.exe
PID 1456 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Microsoft Games\pr.exe
PID 1456 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Microsoft Games\pr.exe
PID 1456 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Microsoft Games\pr.exe
PID 1808 wrote to memory of 1780 N/A C:\Program Files\Microsoft Games\pr.exe C:\Windows\SysWOW64\WScript.exe
PID 1808 wrote to memory of 1780 N/A C:\Program Files\Microsoft Games\pr.exe C:\Windows\SysWOW64\WScript.exe
PID 1808 wrote to memory of 1780 N/A C:\Program Files\Microsoft Games\pr.exe C:\Windows\SysWOW64\WScript.exe
PID 1808 wrote to memory of 1780 N/A C:\Program Files\Microsoft Games\pr.exe C:\Windows\SysWOW64\WScript.exe
PID 1780 wrote to memory of 1608 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1780 wrote to memory of 1608 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1780 wrote to memory of 1608 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1780 wrote to memory of 1608 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1780 wrote to memory of 1608 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1780 wrote to memory of 1608 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1780 wrote to memory of 1608 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1608 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1608 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1608 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1608 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1608 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1608 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1608 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1608 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1608 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 1608 wrote to memory of 1752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1608 wrote to memory of 1752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1608 wrote to memory of 1752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1608 wrote to memory of 1752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1608 wrote to memory of 1136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1608 wrote to memory of 1136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1608 wrote to memory of 1136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1608 wrote to memory of 1136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1608 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1608 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1608 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1608 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1608 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 1608 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 1608 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 1608 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 1608 wrote to memory of 1056 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 1608 wrote to memory of 1056 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 1608 wrote to memory of 1056 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 1608 wrote to memory of 1056 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 1608 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 1608 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 1608 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 1608 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 1476 wrote to memory of 1680 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 1476 wrote to memory of 1680 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 1476 wrote to memory of 1680 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 1476 wrote to memory of 1680 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 1476 wrote to memory of 1556 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe

"C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Program Files\Microsoft Games\1.bat" "

C:\Program Files\Microsoft Games\pr.exe

pr stx.exe -p123 -dC:\Program Files\Microsoft Games

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Program\install.vbs"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Program\install.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rutserv.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rfusclient.exe

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\SysWOW64\regedit.exe

regedit /s "regedit.reg"

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 2

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Program Files\Server\*.*"

C:\Program Files\Server\rutserv.exe

rutserv.exe /silentinstall

C:\Program Files\Server\rutserv.exe

rutserv.exe /firewall

C:\Program Files\Server\rutserv.exe

rutserv.exe /start

C:\Program Files\Server\rutserv.exe

"C:\Program Files\Server\rutserv.exe"

C:\Program Files\Server\rfusclient.exe

"C:\Program Files\Server\rfusclient.exe" /tray

C:\Program Files\Server\rfusclient.exe

"C:\Program Files\Server\rfusclient.exe"

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Program Files\Server\rfusclient.exe

"C:\Program Files\Server\rfusclient.exe" /tray

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

memory/1828-54-0x0000000075741000-0x0000000075743000-memory.dmp

memory/1456-55-0x0000000000000000-mapping.dmp

C:\Program Files\Microsoft Games\1.bat

MD5 a13092696a05b6b80083e042102f8e27
SHA1 e47d31664f0ae6263ea3ca439c8dfcfebecb167d
SHA256 d2ba7625bce55b56654bed236a8d8fcb8a1c028bea4a2b7b6e93b3fbd002631b
SHA512 540a15faa82081e0c68345f86fc30e39bb99ed550eeb34aba3b0b556e90093c257a735e34b26c7cb48193e4c1bc1f0e4ede857508b0d90600cf6cf4d67c6b62b

\Program Files\Microsoft Games\pr.exe

MD5 a7106656ff2c7f40df421e52ff887e01
SHA1 735932c2ce630e8fd65ed8eb475bcaa24b70d979
SHA256 7216b1f398d9a277db705515ad260d766b9c5719f726987080cf8454fa4e6315
SHA512 a9f56fd5f7550465e1059c28dace97101e6af9235b236cf3de85770ab214159cb6e6f2b6e0e2f1c5eb92555a3dd5a0e3e31521bcf98e4b21bc1f0903207287b0

C:\Program Files\Microsoft Games\pr.exe

MD5 a7106656ff2c7f40df421e52ff887e01
SHA1 735932c2ce630e8fd65ed8eb475bcaa24b70d979
SHA256 7216b1f398d9a277db705515ad260d766b9c5719f726987080cf8454fa4e6315
SHA512 a9f56fd5f7550465e1059c28dace97101e6af9235b236cf3de85770ab214159cb6e6f2b6e0e2f1c5eb92555a3dd5a0e3e31521bcf98e4b21bc1f0903207287b0

C:\Program Files\Microsoft Games\pr.exe

MD5 a7106656ff2c7f40df421e52ff887e01
SHA1 735932c2ce630e8fd65ed8eb475bcaa24b70d979
SHA256 7216b1f398d9a277db705515ad260d766b9c5719f726987080cf8454fa4e6315
SHA512 a9f56fd5f7550465e1059c28dace97101e6af9235b236cf3de85770ab214159cb6e6f2b6e0e2f1c5eb92555a3dd5a0e3e31521bcf98e4b21bc1f0903207287b0

memory/1808-59-0x0000000000000000-mapping.dmp

memory/1780-62-0x0000000000000000-mapping.dmp

C:\Program\install.vbs

MD5 53b4089b17b50772970facafacef3941
SHA1 8f69320a1a627488d8d7adc5daef8ee7d0a70ff9
SHA256 3211edb49cce04b4611d91ac235966d542678e4434ca1c2b236975c990b0935c
SHA512 e0da4f4f4d7a29c62746942488f73e09b9f484be781366f94e7f981ee431a4c013dc4b479ff1525831922ec162e0fdc235dd919ab96fdc4fdd3de55b5ad6d531

C:\Program\install.bat

MD5 4c20504c645f84bce230745131dc1919
SHA1 8c18cede047b4e810090e55187dc776548821d82
SHA256 7cd4f05d659e3ceeb104907a47ea875fc5bf0a32aad02f5a4f38b1b725b688c6
SHA512 58286ef8df7249d3fc6d76c3e163ff3e709b10c31de893da16787b9a685f66475e876af40972c530bf8e2671fdcb66f3f92083cec128694df8906b0b92bb3eb7

memory/1608-66-0x0000000000000000-mapping.dmp

memory/1776-67-0x0000000000000000-mapping.dmp

memory/1688-68-0x0000000000000000-mapping.dmp

memory/1720-69-0x0000000000000000-mapping.dmp

memory/592-70-0x0000000000000000-mapping.dmp

C:\Program\regedit.reg

MD5 6751ac3d0065b80ca2b9629974cc5850
SHA1 33306bdf0a65933634bd3a1652bb846de83f6688
SHA256 834c8ee696b6a27095481d0212d9dffd2cf292132a088882f9af4454af4001b9
SHA512 af160339c2c8d177456909d800eed1c16b5b1a94a02ebd2a69f5c24eaa77576f8a79d647d54c25e6a74190e78cf03e14832a33536ea7461326d3c740b202bf2f

memory/1752-73-0x0000000000000000-mapping.dmp

memory/1136-74-0x0000000000000000-mapping.dmp

C:\Program\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

C:\Program\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Program\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Program\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

memory/1732-79-0x0000000000000000-mapping.dmp

C:\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Program Files\Server\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Program Files\Server\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

memory/1904-85-0x0000000000000000-mapping.dmp

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

memory/1056-88-0x0000000000000000-mapping.dmp

memory/1508-91-0x0000000000000000-mapping.dmp

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

memory/1556-99-0x0000000000000000-mapping.dmp

memory/1680-98-0x0000000000000000-mapping.dmp

C:\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

memory/1784-102-0x0000000000000000-mapping.dmp

C:\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

memory/1820-103-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-04-27 14:32

Reported

2022-04-27 15:03

Platform

win10v2004-20220414-en

Max time kernel

150s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe"

Signatures

RMS

trojan rat rms

Sets file to hidden

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation C:\Program Files\Microsoft Games\pr.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Games\pr.exe C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe N/A
File created C:\Program Files\Server\vp8decoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\Server\vp8encoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\vp8decoder.dll C:\Windows\SysWOW64\attrib.exe N/A
File created C:\Program Files\Microsoft Games\1.bat C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe N/A
File created C:\Program Files\Microsoft Games\pr.exe C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe N/A
File opened for modification C:\Program Files\Server\rutserv.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\vp8decoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\vp8encoder.dll C:\Windows\SysWOW64\attrib.exe N/A
File created C:\Program Files\Microsoft Games\__tmp_rar_sfx_access_check_240587781 C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe N/A
File created C:\Program Files\Server\rfusclient.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\rfusclient.exe C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Program Files\Server\rutserv.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\vp8encoder.dll C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Program Files\Server\rfusclient.exe C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Program Files\Microsoft Games C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe N/A
File opened for modification C:\Program Files\Microsoft Games\1.bat C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe N/A
File opened for modification C:\Program Files\Server\rutserv.exe C:\Windows\SysWOW64\attrib.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings C:\Program Files\Microsoft Games\pr.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files\Server\rfusclient.exe N/A
N/A N/A C:\Program Files\Server\rfusclient.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\Server\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\Server\rutserv.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Server\rutserv.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A
N/A N/A C:\Program Files\Server\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3412 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe C:\Windows\SysWOW64\cmd.exe
PID 3412 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe C:\Windows\SysWOW64\cmd.exe
PID 3412 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe C:\Windows\SysWOW64\cmd.exe
PID 3356 wrote to memory of 4636 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Microsoft Games\pr.exe
PID 3356 wrote to memory of 4636 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Microsoft Games\pr.exe
PID 3356 wrote to memory of 4636 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Microsoft Games\pr.exe
PID 4636 wrote to memory of 1420 N/A C:\Program Files\Microsoft Games\pr.exe C:\Windows\SysWOW64\WScript.exe
PID 4636 wrote to memory of 1420 N/A C:\Program Files\Microsoft Games\pr.exe C:\Windows\SysWOW64\WScript.exe
PID 4636 wrote to memory of 1420 N/A C:\Program Files\Microsoft Games\pr.exe C:\Windows\SysWOW64\WScript.exe
PID 1420 wrote to memory of 3448 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1420 wrote to memory of 3448 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1420 wrote to memory of 3448 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3448 wrote to memory of 3988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3448 wrote to memory of 3988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3448 wrote to memory of 3988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3448 wrote to memory of 4520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3448 wrote to memory of 4520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3448 wrote to memory of 4520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3448 wrote to memory of 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3448 wrote to memory of 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3448 wrote to memory of 3644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3448 wrote to memory of 4356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 3448 wrote to memory of 4356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 3448 wrote to memory of 4356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\regedit.exe
PID 3448 wrote to memory of 3516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3448 wrote to memory of 3516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3448 wrote to memory of 3516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3448 wrote to memory of 5072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3448 wrote to memory of 5072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3448 wrote to memory of 5072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3448 wrote to memory of 1404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3448 wrote to memory of 1404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3448 wrote to memory of 1404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3448 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 3448 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 3448 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 3448 wrote to memory of 1128 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 3448 wrote to memory of 1128 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 3448 wrote to memory of 1128 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 3448 wrote to memory of 1272 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 3448 wrote to memory of 1272 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 3448 wrote to memory of 1272 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Server\rutserv.exe
PID 2548 wrote to memory of 3672 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 2548 wrote to memory of 3672 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 2548 wrote to memory of 3672 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 2548 wrote to memory of 4756 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 2548 wrote to memory of 4756 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 2548 wrote to memory of 4756 N/A C:\Program Files\Server\rutserv.exe C:\Program Files\Server\rfusclient.exe
PID 3448 wrote to memory of 4400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3448 wrote to memory of 4400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3448 wrote to memory of 4400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4756 wrote to memory of 4560 N/A C:\Program Files\Server\rfusclient.exe C:\Program Files\Server\rfusclient.exe
PID 4756 wrote to memory of 4560 N/A C:\Program Files\Server\rfusclient.exe C:\Program Files\Server\rfusclient.exe
PID 4756 wrote to memory of 4560 N/A C:\Program Files\Server\rfusclient.exe C:\Program Files\Server\rfusclient.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe

"C:\Users\Admin\AppData\Local\Temp\9d3bd35fb7ff01941e927cf476ff39cef2dd8ce608fa307a3484c1c522f5f379.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files\Microsoft Games\1.bat" "

C:\Program Files\Microsoft Games\pr.exe

pr stx.exe -p123 -dC:\Program Files\Microsoft Games

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Program\install.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program\install.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rutserv.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im rfusclient.exe

C:\Windows\SysWOW64\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\SysWOW64\regedit.exe

regedit /s "regedit.reg"

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Windows\SysWOW64\timeout.exe

timeout 2

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Program Files\Server\*.*"

C:\Program Files\Server\rutserv.exe

rutserv.exe /silentinstall

C:\Program Files\Server\rutserv.exe

rutserv.exe /firewall

C:\Program Files\Server\rutserv.exe

rutserv.exe /start

C:\Program Files\Server\rutserv.exe

"C:\Program Files\Server\rutserv.exe"

C:\Program Files\Server\rfusclient.exe

"C:\Program Files\Server\rfusclient.exe" /tray

C:\Program Files\Server\rfusclient.exe

"C:\Program Files\Server\rfusclient.exe"

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Program Files\Server\rfusclient.exe

"C:\Program Files\Server\rfusclient.exe" /tray

Network

Country Destination Domain Proto
NL 104.110.191.133:80 tcp
US 20.189.173.2:443 tcp
NL 104.110.191.133:80 tcp
NL 104.110.191.133:80 tcp
NL 104.110.191.133:80 tcp
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

memory/3356-130-0x0000000000000000-mapping.dmp

C:\Program Files\Microsoft Games\1.bat

MD5 a13092696a05b6b80083e042102f8e27
SHA1 e47d31664f0ae6263ea3ca439c8dfcfebecb167d
SHA256 d2ba7625bce55b56654bed236a8d8fcb8a1c028bea4a2b7b6e93b3fbd002631b
SHA512 540a15faa82081e0c68345f86fc30e39bb99ed550eeb34aba3b0b556e90093c257a735e34b26c7cb48193e4c1bc1f0e4ede857508b0d90600cf6cf4d67c6b62b

memory/4636-132-0x0000000000000000-mapping.dmp

C:\Program Files\Microsoft Games\pr.exe

MD5 a7106656ff2c7f40df421e52ff887e01
SHA1 735932c2ce630e8fd65ed8eb475bcaa24b70d979
SHA256 7216b1f398d9a277db705515ad260d766b9c5719f726987080cf8454fa4e6315
SHA512 a9f56fd5f7550465e1059c28dace97101e6af9235b236cf3de85770ab214159cb6e6f2b6e0e2f1c5eb92555a3dd5a0e3e31521bcf98e4b21bc1f0903207287b0

C:\Program Files\Microsoft Games\pr.exe

MD5 a7106656ff2c7f40df421e52ff887e01
SHA1 735932c2ce630e8fd65ed8eb475bcaa24b70d979
SHA256 7216b1f398d9a277db705515ad260d766b9c5719f726987080cf8454fa4e6315
SHA512 a9f56fd5f7550465e1059c28dace97101e6af9235b236cf3de85770ab214159cb6e6f2b6e0e2f1c5eb92555a3dd5a0e3e31521bcf98e4b21bc1f0903207287b0

memory/1420-135-0x0000000000000000-mapping.dmp

C:\Program\install.vbs

MD5 53b4089b17b50772970facafacef3941
SHA1 8f69320a1a627488d8d7adc5daef8ee7d0a70ff9
SHA256 3211edb49cce04b4611d91ac235966d542678e4434ca1c2b236975c990b0935c
SHA512 e0da4f4f4d7a29c62746942488f73e09b9f484be781366f94e7f981ee431a4c013dc4b479ff1525831922ec162e0fdc235dd919ab96fdc4fdd3de55b5ad6d531

C:\Program\install.bat

MD5 4c20504c645f84bce230745131dc1919
SHA1 8c18cede047b4e810090e55187dc776548821d82
SHA256 7cd4f05d659e3ceeb104907a47ea875fc5bf0a32aad02f5a4f38b1b725b688c6
SHA512 58286ef8df7249d3fc6d76c3e163ff3e709b10c31de893da16787b9a685f66475e876af40972c530bf8e2671fdcb66f3f92083cec128694df8906b0b92bb3eb7

memory/3448-138-0x0000000000000000-mapping.dmp

memory/3988-139-0x0000000000000000-mapping.dmp

memory/4520-140-0x0000000000000000-mapping.dmp

memory/3644-141-0x0000000000000000-mapping.dmp

memory/4356-142-0x0000000000000000-mapping.dmp

C:\Program\regedit.reg

MD5 6751ac3d0065b80ca2b9629974cc5850
SHA1 33306bdf0a65933634bd3a1652bb846de83f6688
SHA256 834c8ee696b6a27095481d0212d9dffd2cf292132a088882f9af4454af4001b9
SHA512 af160339c2c8d177456909d800eed1c16b5b1a94a02ebd2a69f5c24eaa77576f8a79d647d54c25e6a74190e78cf03e14832a33536ea7461326d3c740b202bf2f

memory/3516-144-0x0000000000000000-mapping.dmp

memory/5072-145-0x0000000000000000-mapping.dmp

C:\Program\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

C:\Program\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Program\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Program\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Program Files\Server\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Program Files\Server\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

memory/1404-150-0x0000000000000000-mapping.dmp

memory/4192-155-0x0000000000000000-mapping.dmp

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

memory/1128-157-0x0000000000000000-mapping.dmp

memory/1272-159-0x0000000000000000-mapping.dmp

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

C:\Program Files\Server\rutserv.exe

MD5 3d378bcfec79805a04de89d6a2d917b4
SHA1 e47758259358246a8989c6e79a433a91830deb79
SHA256 7b687c8ce7f8aaa9ab8b955914c0ecd6542be9c34de3f2a3b2c6cbba6ed7b1f2
SHA512 4d20c4332bc7d9b6b16885d1fbf5cd019e46eb4acd7fe2e02db7c727e1e9ebc98a37fdccf8da22331ba04d33febd21a31782a7c3cc03b94ba57d43531a0d93dd

memory/4756-163-0x0000000000000000-mapping.dmp

memory/3672-162-0x0000000000000000-mapping.dmp

C:\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

C:\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae

memory/4400-166-0x0000000000000000-mapping.dmp

memory/4560-167-0x0000000000000000-mapping.dmp

C:\Program Files\Server\rfusclient.exe

MD5 8b9cd29aa7c2ea3cfaa1080ada962d5a
SHA1 7cf5e9e0efe0fde132a4a0ae1034f4c6442bdcd0
SHA256 15f5556a83e752812f9d9a33e8f3a027a24d435cfc336fd2316f74257ea8721a
SHA512 29c7105ff149ffc5edfa502d2a13c508375ada8c08b9bfece1ef77cf0faa8351a5649b6b694701f65f972dbcfa3c24865941dc9bd83895a3bdd9e1fe8e9427ae