Analysis

  • max time kernel
    146s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    16-05-2022 19:19

General

  • Target

    1dbf988be32a5b726b64471a3eda92d7c8bb40414c53a6f8f5b2382ddd42ac56.exe

  • Size

    4.5MB

  • MD5

    160149ffe7de385c711f621e2a8539c1

  • SHA1

    06cc191aa38cedbf4c35f3f7359127e53caca1fd

  • SHA256

    1dbf988be32a5b726b64471a3eda92d7c8bb40414c53a6f8f5b2382ddd42ac56

  • SHA512

    6770440accb6ef6a38105a9c411892f02657006725cb2e5abb7946ffe3a06c50a0487e4afceb64df804e76c0ab019114845042e8a00469bb70b2056ee4f005d2

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 7 IoCs
  • Sets file to hidden 1 TTPs

    Modifies file attributes to stop it showing in Explorer etc.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 28 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies registry class 1 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1dbf988be32a5b726b64471a3eda92d7c8bb40414c53a6f8f5b2382ddd42ac56.exe
    "C:\Users\Admin\AppData\Local\Temp\1dbf988be32a5b726b64471a3eda92d7c8bb40414c53a6f8f5b2382ddd42ac56.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1252
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\System\install.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\System\install.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3756
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Program Files (x86)\System" +H +S /S /D
          4⤵
          • Drops file in Program Files directory
          • Views/modifies file attributes
          PID:4964
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Program Files (x86)\System\*.*" +H +S /S /D
          4⤵
          • Drops file in Program Files directory
          • Views/modifies file attributes
          PID:312
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im rutserv.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2000
        • C:\Windows\SysWOW64\taskkill.exe
          Taskkill /f /im rutserv.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1372
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im rfusclient.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1204
        • C:\Windows\SysWOW64\taskkill.exe
          Taskkill /f /im rfusclient.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5060
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
          4⤵
            PID:3128
          • C:\Windows\SysWOW64\regedit.exe
            regedit /s "regedit.reg"
            4⤵
            • Runs .reg file with regedit
            PID:2336
          • C:\Windows\SysWOW64\timeout.exe
            timeout 2
            4⤵
            • Delays execution with timeout.exe
            PID:2904
          • C:\Program Files (x86)\System\rutserv.exe
            rutserv.exe /silentinstall
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2260
          • C:\Program Files (x86)\System\rutserv.exe
            rutserv.exe /firewall
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:4428
          • C:\Program Files (x86)\System\rutserv.exe
            rutserv.exe /start
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1324
          • C:\Windows\SysWOW64\timeout.exe
            timeout 120
            4⤵
            • Delays execution with timeout.exe
            PID:4952
          • C:\Windows\SysWOW64\sc.exe
            sc config RManService DisplayName= "Windows_Defender v6.3"
            4⤵
              PID:3372
            • C:\Windows\SysWOW64\sc.exe
              sc config RManService obj= LocalSystem type= interact type= own
              4⤵
                PID:4944
              • C:\Windows\SysWOW64\sc.exe
                sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
                4⤵
                  PID:4908
          • C:\Program Files (x86)\System\rutserv.exe
            "C:\Program Files (x86)\System\rutserv.exe"
            1⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1960
            • C:\Program Files (x86)\System\rfusclient.exe
              "C:\Program Files (x86)\System\rfusclient.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2456
              • C:\Program Files (x86)\System\rfusclient.exe
                "C:\Program Files (x86)\System\rfusclient.exe" /tray
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: SetClipboardViewer
                PID:3672
            • C:\Program Files (x86)\System\rfusclient.exe
              "C:\Program Files (x86)\System\rfusclient.exe" /tray
              2⤵
              • Executes dropped EXE
              PID:2916

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\System\install.bat

            Filesize

            1KB

            MD5

            b80886fab5a9365c59ca3cf922f9040c

            SHA1

            700afde846ad832b6c5b6673e1be1dd483cb21ea

            SHA256

            30cb2ffa14d73d4ae3d4b1047731048fcf405d9bd968d51f3ec1a954c08e0adf

            SHA512

            104e8169de8d2b841cc63af2dc4eba5e82434ebdca7996e208d57c69fb14d89d28541b1d7ca25426f38f5950c84cf62baad5530de018cd676e062b265c680f7a

          • C:\Program Files (x86)\System\install.vbs

            Filesize

            120B

            MD5

            c719a030434d3fa96d62868f27e904a6

            SHA1

            f2f750a752dd1fda8915a47b082af7cf2d3e3655

            SHA256

            2696ee4302a85c6b4101fc6d1ce8e38b94fd9c2bbd1acc73b553576b3aacb92f

            SHA512

            47a9367f7596d19c0636766cd34ca3701d3b1239a284f2333fd04a48422f53b0df21002fd38a4f229f6a2f9f9e8163267e13ecb24d9ce6de1863d5f59ab04ff0

          • C:\Program Files (x86)\System\mailsend.exe

            Filesize

            1.2MB

            MD5

            ac23b87f8ec60ddd3f555556f89a6af8

            SHA1

            3cea6f84757d15ee8d7fa19d3dfc4992c50aa90c

            SHA256

            80a1d0a15066c7af67cf5377e59e450c2a96018505236f8f3352173282b27ae4

            SHA512

            57e67eab9c2a3b94161500eb0091533a539454e9bfddd47c61477299de9455b7ca11c498c5d8a7d77f4763a2053acb4ff96868a9313fede29969edc16d35b167

          • C:\Program Files (x86)\System\regedit.reg

            Filesize

            12KB

            MD5

            251212852a073e6fc5fbe3af92f66adb

            SHA1

            6ee07cb20f57830325c11867e68fea49ae0e87ea

            SHA256

            f2c83f4cc13b0cd28090dd128ec5ff221681118f6100eddaead88526070ceecb

            SHA512

            f3853ece99edc6d39edbf1c7bca471e71aa034684a85358b033e50418ffa061f1e8724cba76065048901c20c9f9a6dbd86a17ee33756c0452d4d3358047296be

          • C:\Program Files (x86)\System\rfusclient.exe

            Filesize

            1.5MB

            MD5

            b8667a1e84567fcf7821bcefb6a444af

            SHA1

            9c1f91fe77ad357c8f81205d65c9067a270d61f0

            SHA256

            dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

            SHA512

            ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

          • C:\Program Files (x86)\System\rfusclient.exe

            Filesize

            1.5MB

            MD5

            b8667a1e84567fcf7821bcefb6a444af

            SHA1

            9c1f91fe77ad357c8f81205d65c9067a270d61f0

            SHA256

            dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

            SHA512

            ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

          • C:\Program Files (x86)\System\rfusclient.exe

            Filesize

            1.5MB

            MD5

            b8667a1e84567fcf7821bcefb6a444af

            SHA1

            9c1f91fe77ad357c8f81205d65c9067a270d61f0

            SHA256

            dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

            SHA512

            ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

          • C:\Program Files (x86)\System\rfusclient.exe

            Filesize

            1.5MB

            MD5

            b8667a1e84567fcf7821bcefb6a444af

            SHA1

            9c1f91fe77ad357c8f81205d65c9067a270d61f0

            SHA256

            dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

            SHA512

            ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

          • C:\Program Files (x86)\System\rutserv.exe

            Filesize

            1.7MB

            MD5

            37a8802017a212bb7f5255abc7857969

            SHA1

            cb10c0d343c54538d12db8ed664d0a1fa35b6109

            SHA256

            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

            SHA512

            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

          • C:\Program Files (x86)\System\rutserv.exe

            Filesize

            1.7MB

            MD5

            37a8802017a212bb7f5255abc7857969

            SHA1

            cb10c0d343c54538d12db8ed664d0a1fa35b6109

            SHA256

            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

            SHA512

            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

          • C:\Program Files (x86)\System\rutserv.exe

            Filesize

            1.7MB

            MD5

            37a8802017a212bb7f5255abc7857969

            SHA1

            cb10c0d343c54538d12db8ed664d0a1fa35b6109

            SHA256

            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

            SHA512

            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

          • C:\Program Files (x86)\System\rutserv.exe

            Filesize

            1.7MB

            MD5

            37a8802017a212bb7f5255abc7857969

            SHA1

            cb10c0d343c54538d12db8ed664d0a1fa35b6109

            SHA256

            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

            SHA512

            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

          • C:\Program Files (x86)\System\rutserv.exe

            Filesize

            1.7MB

            MD5

            37a8802017a212bb7f5255abc7857969

            SHA1

            cb10c0d343c54538d12db8ed664d0a1fa35b6109

            SHA256

            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

            SHA512

            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

          • C:\Program Files (x86)\System\vp8decoder.dll

            Filesize

            155KB

            MD5

            88318158527985702f61d169434a4940

            SHA1

            3cc751ba256b5727eb0713aad6f554ff1e7bca57

            SHA256

            4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74

            SHA512

            5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

          • C:\Program Files (x86)\System\vp8encoder.dll

            Filesize

            593KB

            MD5

            6298c0af3d1d563834a218a9cc9f54bd

            SHA1

            0185cd591e454ed072e5a5077b25c612f6849dc9

            SHA256

            81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172

            SHA512

            389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

          • memory/312-135-0x0000000000000000-mapping.dmp

          • memory/1204-144-0x0000000000000000-mapping.dmp

          • memory/1324-171-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1324-170-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1324-165-0x0000000000000000-mapping.dmp

          • memory/1324-167-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1324-168-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1324-169-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1324-186-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1372-143-0x0000000000000000-mapping.dmp

          • memory/1960-173-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1960-176-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1960-174-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1960-175-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1960-205-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/1960-177-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/2000-142-0x0000000000000000-mapping.dmp

          • memory/2260-149-0x0000000000000000-mapping.dmp

          • memory/2260-152-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/2260-151-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/2260-153-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/2260-154-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/2260-155-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/2260-156-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/2336-147-0x0000000000000000-mapping.dmp

          • memory/2456-181-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2456-190-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2456-185-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2456-192-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2456-182-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2456-178-0x0000000000000000-mapping.dmp

          • memory/2904-148-0x0000000000000000-mapping.dmp

          • memory/2916-187-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2916-189-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2916-179-0x0000000000000000-mapping.dmp

          • memory/2916-191-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2916-188-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2916-184-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3128-146-0x0000000000000000-mapping.dmp

          • memory/3372-195-0x0000000000000000-mapping.dmp

          • memory/3672-200-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3672-202-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3672-199-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3672-204-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3672-201-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3672-197-0x0000000000000000-mapping.dmp

          • memory/3672-203-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/3756-133-0x0000000000000000-mapping.dmp

          • memory/4428-161-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4428-162-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4428-164-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4428-160-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4428-163-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4428-159-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4428-157-0x0000000000000000-mapping.dmp

          • memory/4700-130-0x0000000000000000-mapping.dmp

          • memory/4908-193-0x0000000000000000-mapping.dmp

          • memory/4944-194-0x0000000000000000-mapping.dmp

          • memory/4952-196-0x0000000000000000-mapping.dmp

          • memory/4964-134-0x0000000000000000-mapping.dmp

          • memory/5060-145-0x0000000000000000-mapping.dmp