Malware Analysis Report

2024-11-13 16:21

Sample ID 220508-sj5rnadcbj
Target 0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce
SHA256 0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce
Tags
rms aspackv2 rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce

Threat Level: Known bad

The file 0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce was found to be: Known bad.

Malicious Activity Summary

rms aspackv2 rat trojan upx

RMS

ACProtect 1.3x - 1.4x DLL software

ASPack v2.12-2.42

UPX packed file

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious behavior: SetClipboardViewer

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Kills process with taskkill

Runs .reg file with regedit

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-08 15:10

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-08 15:10

Reported

2022-05-08 17:01

Platform

win7-20220414-en

Max time kernel

149s

Max time network

178s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe"

Signatures

RMS

trojan rat rms

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Hello from Freak602\Freak602.exe C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe N/A
File opened for modification C:\Program Files (x86)\Hello from Freak602\Freak602.exe C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe N/A
File created C:\Program Files (x86)\Hello from Freak602\install.exe C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe N/A
File opened for modification C:\Program Files (x86)\Hello from Freak602\install.exe C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe N/A
File opened for modification C:\Program Files (x86)\Hello from Freak602 C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe N/A
File created C:\Program Files (x86)\Hello from Freak602\__tmp_rar_sfx_access_check_7109386 C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\regedit.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Hello from Freak602\Freak602.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rfusclient.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program\rfusclient.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Program\rutserv.exe N/A
Token: SeDebugPrivilege N/A C:\Program\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program\rutserv.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1424 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe C:\Program Files (x86)\Hello from Freak602\install.exe
PID 1424 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe C:\Program Files (x86)\Hello from Freak602\install.exe
PID 1424 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe C:\Program Files (x86)\Hello from Freak602\install.exe
PID 1424 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe C:\Program Files (x86)\Hello from Freak602\install.exe
PID 1424 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe C:\Program Files (x86)\Hello from Freak602\install.exe
PID 1424 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe C:\Program Files (x86)\Hello from Freak602\install.exe
PID 1424 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe C:\Program Files (x86)\Hello from Freak602\install.exe
PID 1164 wrote to memory of 944 N/A C:\Program Files (x86)\Hello from Freak602\install.exe C:\Windows\system32\cmd.exe
PID 1164 wrote to memory of 944 N/A C:\Program Files (x86)\Hello from Freak602\install.exe C:\Windows\system32\cmd.exe
PID 1164 wrote to memory of 944 N/A C:\Program Files (x86)\Hello from Freak602\install.exe C:\Windows\system32\cmd.exe
PID 1164 wrote to memory of 944 N/A C:\Program Files (x86)\Hello from Freak602\install.exe C:\Windows\system32\cmd.exe
PID 944 wrote to memory of 880 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Hello from Freak602\Freak602.exe
PID 944 wrote to memory of 880 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Hello from Freak602\Freak602.exe
PID 944 wrote to memory of 880 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Hello from Freak602\Freak602.exe
PID 944 wrote to memory of 880 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Hello from Freak602\Freak602.exe
PID 880 wrote to memory of 432 N/A C:\Program Files (x86)\Hello from Freak602\Freak602.exe C:\Program\install.exe
PID 880 wrote to memory of 432 N/A C:\Program Files (x86)\Hello from Freak602\Freak602.exe C:\Program\install.exe
PID 880 wrote to memory of 432 N/A C:\Program Files (x86)\Hello from Freak602\Freak602.exe C:\Program\install.exe
PID 880 wrote to memory of 432 N/A C:\Program Files (x86)\Hello from Freak602\Freak602.exe C:\Program\install.exe
PID 880 wrote to memory of 432 N/A C:\Program Files (x86)\Hello from Freak602\Freak602.exe C:\Program\install.exe
PID 880 wrote to memory of 432 N/A C:\Program Files (x86)\Hello from Freak602\Freak602.exe C:\Program\install.exe
PID 880 wrote to memory of 432 N/A C:\Program Files (x86)\Hello from Freak602\Freak602.exe C:\Program\install.exe
PID 432 wrote to memory of 1624 N/A C:\Program\install.exe C:\Windows\system32\cmd.exe
PID 432 wrote to memory of 1624 N/A C:\Program\install.exe C:\Windows\system32\cmd.exe
PID 432 wrote to memory of 1624 N/A C:\Program\install.exe C:\Windows\system32\cmd.exe
PID 432 wrote to memory of 1624 N/A C:\Program\install.exe C:\Windows\system32\cmd.exe
PID 1624 wrote to memory of 1880 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1624 wrote to memory of 1880 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1624 wrote to memory of 1880 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1624 wrote to memory of 1716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1624 wrote to memory of 1716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1624 wrote to memory of 1716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1624 wrote to memory of 1788 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1624 wrote to memory of 1788 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1624 wrote to memory of 1788 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1624 wrote to memory of 1236 N/A C:\Windows\system32\cmd.exe C:\Windows\regedit.exe
PID 1624 wrote to memory of 1236 N/A C:\Windows\system32\cmd.exe C:\Windows\regedit.exe
PID 1624 wrote to memory of 1236 N/A C:\Windows\system32\cmd.exe C:\Windows\regedit.exe
PID 1624 wrote to memory of 1640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 1624 wrote to memory of 1640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 1624 wrote to memory of 1640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 1624 wrote to memory of 624 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 624 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 624 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 624 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 1412 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 1412 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 1412 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 1412 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 996 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 996 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 996 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 996 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1596 wrote to memory of 1824 N/A C:\Program\rutserv.exe C:\Program\rfusclient.exe
PID 1596 wrote to memory of 1824 N/A C:\Program\rutserv.exe C:\Program\rfusclient.exe
PID 1596 wrote to memory of 1824 N/A C:\Program\rutserv.exe C:\Program\rfusclient.exe
PID 1596 wrote to memory of 1824 N/A C:\Program\rutserv.exe C:\Program\rfusclient.exe
PID 1596 wrote to memory of 1092 N/A C:\Program\rutserv.exe C:\Program\rfusclient.exe
PID 1596 wrote to memory of 1092 N/A C:\Program\rutserv.exe C:\Program\rfusclient.exe
PID 1596 wrote to memory of 1092 N/A C:\Program\rutserv.exe C:\Program\rfusclient.exe
PID 1596 wrote to memory of 1092 N/A C:\Program\rutserv.exe C:\Program\rfusclient.exe
PID 1824 wrote to memory of 1592 N/A C:\Program\rfusclient.exe C:\Program\rfusclient.exe
PID 1824 wrote to memory of 1592 N/A C:\Program\rfusclient.exe C:\Program\rfusclient.exe
PID 1824 wrote to memory of 1592 N/A C:\Program\rfusclient.exe C:\Program\rfusclient.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe

"C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe"

C:\Program Files (x86)\Hello from Freak602\install.exe

"C:\Program Files (x86)\Hello from Freak602\install.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im rutserv.exe

C:\Windows\regedit.exe

regedit /s "regedit.reg"

C:\Windows\system32\timeout.exe

timeout 2

C:\Windows\system32\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\system32\taskkill.exe

taskkill /f /im rfusclient.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\81FD.tmp\81FE.bat C:\Program\install.exe"

C:\Program\install.exe

"C:\Program\install.exe"

C:\Program Files (x86)\Hello from Freak602\Freak602.exe

Freak602.exe -p123 -dC:\Program Files (x86)\Internet ExpIorer

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\80F3.tmp\80F4.bat "C:\Program Files (x86)\Hello from Freak602\install.exe""

C:\Program\rutserv.exe

rutserv.exe /silentinstall

C:\Program\rutserv.exe

rutserv.exe /firewall

C:\Program\rutserv.exe

rutserv.exe /start

C:\Program\rutserv.exe

C:\Program\rutserv.exe

C:\Program\rfusclient.exe

C:\Program\rfusclient.exe

C:\Program\rfusclient.exe

C:\Program\rfusclient.exe /tray

C:\Program\rfusclient.exe

C:\Program\rfusclient.exe /tray

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

memory/1424-54-0x0000000075951000-0x0000000075953000-memory.dmp

\Program Files (x86)\Hello from Freak602\install.exe

MD5 c381db6cf3be28cf4ae6b79f80feffd4
SHA1 03b002ad4b04d390f0dab1799118b1be5144730b
SHA256 e1873454940771162e763cb47c875901afd8940001288d90abfc17f14cec258f
SHA512 77bd00c1c958684a16e9d4b9e17bb381e63910c09b3ce6bbe56f724af143126daab21c55f5a5c854f4a452accfc6af2b8128c3ccb9115bca278dd88f0aadd5a6

C:\Users\Admin\AppData\Local\Temp\80F3.tmp\80F4.bat

MD5 a7e5780f23499911ab8b1ad76cabc8fd
SHA1 ac20933c872b61de3664c7966786f35dc62aa5be
SHA256 ad74668679d07bed771a554d4c73af37cfd662c00b3e74aa95791670dc1e9b9e
SHA512 73cc1b4be9b576056a94344435b6cfcbac727b9b1ce0a857acf305dc4798fdfccb512e8a8d707f2d4523a456bac10b72096d89f268ba06059d8a265dd095b6bd

C:\Program Files (x86)\Hello from Freak602\Freak602.exe

MD5 9c61fd9b195b3f0db1286ca342a94f35
SHA1 fc76941ba7d11d41f811196f93bc0f0193750851
SHA256 44be6e163d6b84e037adfa24a8c3619a82df0ba194331e5da60ed55f32cfaf28
SHA512 f31705f4539e50646c233b219233539338ff3c9b44b245a9289f21cc7be564eba10b86a7e34b399dff7c95c0a816a4f0c3a095e4e0b2e1811096a57289cc3cef

memory/880-64-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Hello from Freak602\Freak602.exe

MD5 9c61fd9b195b3f0db1286ca342a94f35
SHA1 fc76941ba7d11d41f811196f93bc0f0193750851
SHA256 44be6e163d6b84e037adfa24a8c3619a82df0ba194331e5da60ed55f32cfaf28
SHA512 f31705f4539e50646c233b219233539338ff3c9b44b245a9289f21cc7be564eba10b86a7e34b399dff7c95c0a816a4f0c3a095e4e0b2e1811096a57289cc3cef

\Program\install.exe

MD5 30b3e1b01711c9f4cf0893595260c21c
SHA1 fa1fa67f2d1e1a0b9085abd34079563f967ec935
SHA256 df9fffcb8b167d7b2f9bf994afe07d2ce9da19bb11b53771d6401c6149cb34f5
SHA512 9845e390471afef210cad5d088adcf900178853475a6ffbcc388c8da43598b1b69c42aefaff0a83aac820b760e8d4b1bb796df1b920d5a9ba2764f4a46e967ec

memory/1880-75-0x0000000000000000-mapping.dmp

memory/1716-76-0x0000000000000000-mapping.dmp

memory/1640-81-0x0000000000000000-mapping.dmp

C:\Program\regedit.reg

MD5 5c53b55d69309ccea66eeec02ce649d8
SHA1 bb14f532c9ba8975650cf0c93a7023b47bb26ab0
SHA256 db6a980f0b87fb10181783e016aa50a3915d1d4a87a40f226e18e8886d5203e4
SHA512 98fadf4890b451855c336fb906e75e034ec95ec5e867b900d1bfadf84f791758182dea33c00d36e107478ccf5dfc91a00d37928cc4232e2e23f60833f32a1c61

memory/1236-79-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

memory/1236-78-0x0000000000000000-mapping.dmp

memory/1788-77-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\81FD.tmp\81FE.bat

MD5 43da2ef898696e8d17e9171e4af013ff
SHA1 5d78dc219f7572ca5e552c1d029c0de8f60bd237
SHA256 17e49e926d6f3442909e7e289d044335b357f6c070e3c0e8e415e7cf351c14c8
SHA512 dbcfd5afedfe53ec30365b93e4d0454de4c6ddede85c43ab11f855a98103ad47dd6d18dee8bb21e9b61e90906236bfd35a9252d96b7c1909495024600c7ffae4

memory/1624-73-0x0000000000000000-mapping.dmp

C:\Program\install.exe

MD5 30b3e1b01711c9f4cf0893595260c21c
SHA1 fa1fa67f2d1e1a0b9085abd34079563f967ec935
SHA256 df9fffcb8b167d7b2f9bf994afe07d2ce9da19bb11b53771d6401c6149cb34f5
SHA512 9845e390471afef210cad5d088adcf900178853475a6ffbcc388c8da43598b1b69c42aefaff0a83aac820b760e8d4b1bb796df1b920d5a9ba2764f4a46e967ec

memory/432-70-0x0000000000000000-mapping.dmp

\Program\install.exe

MD5 30b3e1b01711c9f4cf0893595260c21c
SHA1 fa1fa67f2d1e1a0b9085abd34079563f967ec935
SHA256 df9fffcb8b167d7b2f9bf994afe07d2ce9da19bb11b53771d6401c6149cb34f5
SHA512 9845e390471afef210cad5d088adcf900178853475a6ffbcc388c8da43598b1b69c42aefaff0a83aac820b760e8d4b1bb796df1b920d5a9ba2764f4a46e967ec

\Program\install.exe

MD5 30b3e1b01711c9f4cf0893595260c21c
SHA1 fa1fa67f2d1e1a0b9085abd34079563f967ec935
SHA256 df9fffcb8b167d7b2f9bf994afe07d2ce9da19bb11b53771d6401c6149cb34f5
SHA512 9845e390471afef210cad5d088adcf900178853475a6ffbcc388c8da43598b1b69c42aefaff0a83aac820b760e8d4b1bb796df1b920d5a9ba2764f4a46e967ec

memory/944-61-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Hello from Freak602\install.exe

MD5 c381db6cf3be28cf4ae6b79f80feffd4
SHA1 03b002ad4b04d390f0dab1799118b1be5144730b
SHA256 e1873454940771162e763cb47c875901afd8940001288d90abfc17f14cec258f
SHA512 77bd00c1c958684a16e9d4b9e17bb381e63910c09b3ce6bbe56f724af143126daab21c55f5a5c854f4a452accfc6af2b8128c3ccb9115bca278dd88f0aadd5a6

memory/1164-58-0x0000000000000000-mapping.dmp

\Program Files (x86)\Hello from Freak602\install.exe

MD5 c381db6cf3be28cf4ae6b79f80feffd4
SHA1 03b002ad4b04d390f0dab1799118b1be5144730b
SHA256 e1873454940771162e763cb47c875901afd8940001288d90abfc17f14cec258f
SHA512 77bd00c1c958684a16e9d4b9e17bb381e63910c09b3ce6bbe56f724af143126daab21c55f5a5c854f4a452accfc6af2b8128c3ccb9115bca278dd88f0aadd5a6

\Program Files (x86)\Hello from Freak602\install.exe

MD5 c381db6cf3be28cf4ae6b79f80feffd4
SHA1 03b002ad4b04d390f0dab1799118b1be5144730b
SHA256 e1873454940771162e763cb47c875901afd8940001288d90abfc17f14cec258f
SHA512 77bd00c1c958684a16e9d4b9e17bb381e63910c09b3ce6bbe56f724af143126daab21c55f5a5c854f4a452accfc6af2b8128c3ccb9115bca278dd88f0aadd5a6

C:\Program\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

C:\Program\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/624-83-0x0000000000000000-mapping.dmp

memory/624-86-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/624-87-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/624-88-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/624-89-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/624-90-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/1412-92-0x0000000000000000-mapping.dmp

memory/624-91-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1412-95-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1412-96-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1412-97-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1412-98-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1412-99-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/996-101-0x0000000000000000-mapping.dmp

memory/1412-100-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/996-104-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/996-105-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/996-107-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/996-108-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/996-106-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/1596-111-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1596-112-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1596-113-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1596-114-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1596-115-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

C:\Program\vp8encoder.dll

MD5 6298c0af3d1d563834a218a9cc9f54bd
SHA1 0185cd591e454ed072e5a5077b25c612f6849dc9
SHA256 81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512 389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

C:\Program\vp8decoder.dll

MD5 88318158527985702f61d169434a4940
SHA1 3cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA256 4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA512 5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

\Program\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

memory/1092-123-0x0000000000000000-mapping.dmp

C:\Program\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

C:\Program\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

memory/1824-120-0x0000000000000000-mapping.dmp

memory/1092-127-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1824-126-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1824-128-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1092-129-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1092-131-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1092-133-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1824-134-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1092-136-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/996-135-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/1824-132-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1824-130-0x0000000000400000-0x00000000009B6000-memory.dmp

C:\Program\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

memory/1592-137-0x0000000000000000-mapping.dmp

memory/1592-140-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1592-141-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1592-143-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1592-142-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1592-144-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1592-145-0x0000000000400000-0x00000000009B6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-08 15:10

Reported

2022-05-08 17:01

Platform

win10v2004-20220414-en

Max time kernel

193s

Max time network

234s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe"

Signatures

RMS

trojan rat rms

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Hello from Freak602\install.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Hello from Freak602\Freak602.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Program\install.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Hello from Freak602\__tmp_rar_sfx_access_check_240631781 C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe N/A
File created C:\Program Files (x86)\Hello from Freak602\Freak602.exe C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe N/A
File opened for modification C:\Program Files (x86)\Hello from Freak602\Freak602.exe C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe N/A
File created C:\Program Files (x86)\Hello from Freak602\install.exe C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe N/A
File opened for modification C:\Program Files (x86)\Hello from Freak602\install.exe C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe N/A
File opened for modification C:\Program Files (x86)\Hello from Freak602 C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\regedit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Program\rutserv.exe N/A
Token: SeDebugPrivilege N/A C:\Program\rutserv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program\rutserv.exe N/A
Token: SeTcbPrivilege N/A C:\Program\rutserv.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Hello from Freak602\install.exe N/A
N/A N/A C:\Program\install.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A
N/A N/A C:\Program\rutserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3644 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe C:\Program Files (x86)\Hello from Freak602\install.exe
PID 3644 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe C:\Program Files (x86)\Hello from Freak602\install.exe
PID 3644 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe C:\Program Files (x86)\Hello from Freak602\install.exe
PID 4144 wrote to memory of 1376 N/A C:\Program Files (x86)\Hello from Freak602\install.exe C:\Windows\system32\cmd.exe
PID 4144 wrote to memory of 1376 N/A C:\Program Files (x86)\Hello from Freak602\install.exe C:\Windows\system32\cmd.exe
PID 1376 wrote to memory of 4148 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Hello from Freak602\Freak602.exe
PID 1376 wrote to memory of 4148 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Hello from Freak602\Freak602.exe
PID 1376 wrote to memory of 4148 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Hello from Freak602\Freak602.exe
PID 4148 wrote to memory of 1028 N/A C:\Program Files (x86)\Hello from Freak602\Freak602.exe C:\Program\install.exe
PID 4148 wrote to memory of 1028 N/A C:\Program Files (x86)\Hello from Freak602\Freak602.exe C:\Program\install.exe
PID 4148 wrote to memory of 1028 N/A C:\Program Files (x86)\Hello from Freak602\Freak602.exe C:\Program\install.exe
PID 1028 wrote to memory of 1624 N/A C:\Program\install.exe C:\Windows\system32\cmd.exe
PID 1028 wrote to memory of 1624 N/A C:\Program\install.exe C:\Windows\system32\cmd.exe
PID 1624 wrote to memory of 696 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1624 wrote to memory of 696 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1624 wrote to memory of 2564 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1624 wrote to memory of 2564 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1624 wrote to memory of 480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1624 wrote to memory of 480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1624 wrote to memory of 2288 N/A C:\Windows\system32\cmd.exe C:\Windows\regedit.exe
PID 1624 wrote to memory of 2288 N/A C:\Windows\system32\cmd.exe C:\Windows\regedit.exe
PID 1624 wrote to memory of 3212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 1624 wrote to memory of 3212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 1624 wrote to memory of 3920 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 3920 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 3920 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 2120 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 2120 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 2120 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 3376 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 3376 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 1624 wrote to memory of 3376 N/A C:\Windows\system32\cmd.exe C:\Program\rutserv.exe
PID 928 wrote to memory of 2804 N/A C:\Program\rutserv.exe C:\Program\rfusclient.exe
PID 928 wrote to memory of 2804 N/A C:\Program\rutserv.exe C:\Program\rfusclient.exe
PID 928 wrote to memory of 2804 N/A C:\Program\rutserv.exe C:\Program\rfusclient.exe
PID 928 wrote to memory of 3952 N/A C:\Program\rutserv.exe C:\Program\rfusclient.exe
PID 928 wrote to memory of 3952 N/A C:\Program\rutserv.exe C:\Program\rfusclient.exe
PID 928 wrote to memory of 3952 N/A C:\Program\rutserv.exe C:\Program\rfusclient.exe
PID 2804 wrote to memory of 1896 N/A C:\Program\rfusclient.exe C:\Program\rfusclient.exe
PID 2804 wrote to memory of 1896 N/A C:\Program\rfusclient.exe C:\Program\rfusclient.exe
PID 2804 wrote to memory of 1896 N/A C:\Program\rfusclient.exe C:\Program\rfusclient.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe

"C:\Users\Admin\AppData\Local\Temp\0b07a4e1ab0727b4c216f5921c7c035985963f44d9e207911ebdf496ebc551ce.exe"

C:\Program Files (x86)\Hello from Freak602\install.exe

"C:\Program Files (x86)\Hello from Freak602\install.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5A50.tmp\5A51.bat "C:\Program Files (x86)\Hello from Freak602\install.exe""

C:\Program Files (x86)\Hello from Freak602\Freak602.exe

Freak602.exe -p123 -dC:\Program Files (x86)\Internet ExpIorer

C:\Program\install.exe

"C:\Program\install.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\68B8.tmp\68B9.bat C:\Program\install.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im rutserv.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im rfusclient.exe

C:\Windows\system32\reg.exe

reg delete "HKLM\SYSTEM\Remote Manipulator System" /f

C:\Windows\regedit.exe

regedit /s "regedit.reg"

C:\Windows\system32\timeout.exe

timeout 2

C:\Program\rutserv.exe

rutserv.exe /silentinstall

C:\Program\rutserv.exe

rutserv.exe /firewall

C:\Program\rutserv.exe

rutserv.exe /start

C:\Program\rutserv.exe

C:\Program\rutserv.exe

C:\Program\rfusclient.exe

C:\Program\rfusclient.exe /tray

C:\Program\rfusclient.exe

C:\Program\rfusclient.exe

C:\Program\rfusclient.exe

C:\Program\rfusclient.exe /tray

Network

Country Destination Domain Proto
US 20.44.10.123:443 tcp
IE 13.69.239.73:443 tcp
NL 104.110.191.133:80 tcp
NL 8.248.7.254:80 tcp
US 8.8.8.8:53 176.122.125.40.in-addr.arpa udp
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

memory/4144-130-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Hello from Freak602\install.exe

MD5 c381db6cf3be28cf4ae6b79f80feffd4
SHA1 03b002ad4b04d390f0dab1799118b1be5144730b
SHA256 e1873454940771162e763cb47c875901afd8940001288d90abfc17f14cec258f
SHA512 77bd00c1c958684a16e9d4b9e17bb381e63910c09b3ce6bbe56f724af143126daab21c55f5a5c854f4a452accfc6af2b8128c3ccb9115bca278dd88f0aadd5a6

C:\Program Files (x86)\Hello from Freak602\install.exe

MD5 c381db6cf3be28cf4ae6b79f80feffd4
SHA1 03b002ad4b04d390f0dab1799118b1be5144730b
SHA256 e1873454940771162e763cb47c875901afd8940001288d90abfc17f14cec258f
SHA512 77bd00c1c958684a16e9d4b9e17bb381e63910c09b3ce6bbe56f724af143126daab21c55f5a5c854f4a452accfc6af2b8128c3ccb9115bca278dd88f0aadd5a6

memory/1376-133-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\5A50.tmp\5A51.bat

MD5 a7e5780f23499911ab8b1ad76cabc8fd
SHA1 ac20933c872b61de3664c7966786f35dc62aa5be
SHA256 ad74668679d07bed771a554d4c73af37cfd662c00b3e74aa95791670dc1e9b9e
SHA512 73cc1b4be9b576056a94344435b6cfcbac727b9b1ce0a857acf305dc4798fdfccb512e8a8d707f2d4523a456bac10b72096d89f268ba06059d8a265dd095b6bd

C:\Program Files (x86)\Hello from Freak602\Freak602.exe

MD5 9c61fd9b195b3f0db1286ca342a94f35
SHA1 fc76941ba7d11d41f811196f93bc0f0193750851
SHA256 44be6e163d6b84e037adfa24a8c3619a82df0ba194331e5da60ed55f32cfaf28
SHA512 f31705f4539e50646c233b219233539338ff3c9b44b245a9289f21cc7be564eba10b86a7e34b399dff7c95c0a816a4f0c3a095e4e0b2e1811096a57289cc3cef

memory/4148-135-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Hello from Freak602\Freak602.exe

MD5 9c61fd9b195b3f0db1286ca342a94f35
SHA1 fc76941ba7d11d41f811196f93bc0f0193750851
SHA256 44be6e163d6b84e037adfa24a8c3619a82df0ba194331e5da60ed55f32cfaf28
SHA512 f31705f4539e50646c233b219233539338ff3c9b44b245a9289f21cc7be564eba10b86a7e34b399dff7c95c0a816a4f0c3a095e4e0b2e1811096a57289cc3cef

memory/1028-138-0x0000000000000000-mapping.dmp

C:\Program\install.exe

MD5 30b3e1b01711c9f4cf0893595260c21c
SHA1 fa1fa67f2d1e1a0b9085abd34079563f967ec935
SHA256 df9fffcb8b167d7b2f9bf994afe07d2ce9da19bb11b53771d6401c6149cb34f5
SHA512 9845e390471afef210cad5d088adcf900178853475a6ffbcc388c8da43598b1b69c42aefaff0a83aac820b760e8d4b1bb796df1b920d5a9ba2764f4a46e967ec

C:\Program\install.exe

MD5 30b3e1b01711c9f4cf0893595260c21c
SHA1 fa1fa67f2d1e1a0b9085abd34079563f967ec935
SHA256 df9fffcb8b167d7b2f9bf994afe07d2ce9da19bb11b53771d6401c6149cb34f5
SHA512 9845e390471afef210cad5d088adcf900178853475a6ffbcc388c8da43598b1b69c42aefaff0a83aac820b760e8d4b1bb796df1b920d5a9ba2764f4a46e967ec

memory/1624-141-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\68B8.tmp\68B9.bat

MD5 43da2ef898696e8d17e9171e4af013ff
SHA1 5d78dc219f7572ca5e552c1d029c0de8f60bd237
SHA256 17e49e926d6f3442909e7e289d044335b357f6c070e3c0e8e415e7cf351c14c8
SHA512 dbcfd5afedfe53ec30365b93e4d0454de4c6ddede85c43ab11f855a98103ad47dd6d18dee8bb21e9b61e90906236bfd35a9252d96b7c1909495024600c7ffae4

memory/696-143-0x0000000000000000-mapping.dmp

memory/2564-144-0x0000000000000000-mapping.dmp

memory/480-145-0x0000000000000000-mapping.dmp

memory/2288-146-0x0000000000000000-mapping.dmp

C:\Program\regedit.reg

MD5 5c53b55d69309ccea66eeec02ce649d8
SHA1 bb14f532c9ba8975650cf0c93a7023b47bb26ab0
SHA256 db6a980f0b87fb10181783e016aa50a3915d1d4a87a40f226e18e8886d5203e4
SHA512 98fadf4890b451855c336fb906e75e034ec95ec5e867b900d1bfadf84f791758182dea33c00d36e107478ccf5dfc91a00d37928cc4232e2e23f60833f32a1c61

memory/3212-148-0x0000000000000000-mapping.dmp

memory/3920-149-0x0000000000000000-mapping.dmp

C:\Program\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

C:\Program\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/3920-152-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3920-153-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3920-154-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3920-155-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3920-156-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3920-157-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/2120-158-0x0000000000000000-mapping.dmp

memory/2120-160-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/2120-161-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/2120-162-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/2120-163-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/2120-164-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3376-166-0x0000000000000000-mapping.dmp

memory/2120-165-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/3376-168-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3376-169-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3376-170-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3376-171-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/3376-172-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program\rutserv.exe

MD5 37a8802017a212bb7f5255abc7857969
SHA1 cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA256 1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA512 4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

memory/928-174-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/928-175-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/928-176-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/928-177-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/928-178-0x0000000000400000-0x0000000000AB9000-memory.dmp

C:\Program\vp8decoder.dll

MD5 88318158527985702f61d169434a4940
SHA1 3cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA256 4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA512 5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

C:\Program\vp8encoder.dll

MD5 6298c0af3d1d563834a218a9cc9f54bd
SHA1 0185cd591e454ed072e5a5077b25c612f6849dc9
SHA256 81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512 389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

C:\Program\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

memory/3952-183-0x0000000000000000-mapping.dmp

memory/2804-182-0x0000000000000000-mapping.dmp

C:\Program\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

C:\Program\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

memory/3376-186-0x0000000000400000-0x0000000000AB9000-memory.dmp

memory/2804-188-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/3952-187-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/2804-189-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/3952-190-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/2804-193-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/3952-192-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/3952-194-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/2804-191-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/2804-195-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/3952-196-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1896-197-0x0000000000000000-mapping.dmp

C:\Program\rfusclient.exe

MD5 b8667a1e84567fcf7821bcefb6a444af
SHA1 9c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256 dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512 ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

memory/1896-199-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1896-200-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1896-201-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1896-202-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1896-203-0x0000000000400000-0x00000000009B6000-memory.dmp

memory/1896-204-0x0000000000400000-0x00000000009B6000-memory.dmp