rms | cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29

Analysis

max time kernel
35s
max time network
150s
platform
windows7_x64
resource
win7-20220414-en
submitted
24-05-2022 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
Size

4.0MB
MD5

acf3ffe4ef28ee077026078d3aef11be
SHA1

3e349d572a82b1df3bd61970640aa50ef6bbed78
SHA256

cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29
SHA512

00715f0162e8490a743eb307be942373528347e5b9cdfa92b5ab63c16d03ebac2a3925b54e40ad3e7023b2b0b6f9ffb71f09d213b76b7fc7245bae24ebfd0b72

Score

10^/10

rms rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 1 IoCs

pid	Process
1528	rutserv.exe

Loads dropped DLL 1 IoCs

pid	Process
1284	cmd.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\rutserv.exe	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
File created	C:\Program Files (x86)\vp8decoder.dll	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
File created	C:\Program Files (x86)\rfusclient.exe	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
File opened for modification	C:\Program Files (x86)\rfusclient.exe	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
File created	C:\Program Files (x86)\regedit.reg	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
File opened for modification	C:\Program Files (x86)\install.vbs	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
File created	C:\Program Files (x86)\vp8encoder.dll	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
File opened for modification	C:\Program Files (x86)\vp8encoder.dll	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
File opened for modification	C:\Program Files (x86)\regedit.reg	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
File created	C:\Program Files (x86)\install.vbs	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
File created	C:\Program Files (x86)\__tmp_rar_sfx_access_check_7108887	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
File created	C:\Program Files (x86)\install.bat	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
File opened for modification	C:\Program Files (x86)\install.bat	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
File created	C:\Program Files (x86)\rutserv.exe	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
File opened for modification	C:\Program Files (x86)\vp8decoder.dll	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1384	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
364	taskkill.exe
1764	taskkill.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1572	regedit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	364	taskkill.exe
Token: SeDebugPrivilege	1764	taskkill.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1728	1364	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe	27
PID 1364 wrote to memory of 1728	1364	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe	27
PID 1364 wrote to memory of 1728	1364	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe	27
PID 1364 wrote to memory of 1728	1364	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe	27
PID 1364 wrote to memory of 1728	1364	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe	27
PID 1364 wrote to memory of 1728	1364	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe	27
PID 1364 wrote to memory of 1728	1364	cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe	27
PID 1728 wrote to memory of 1284	1728	WScript.exe	31
PID 1728 wrote to memory of 1284	1728	WScript.exe	31
PID 1728 wrote to memory of 1284	1728	WScript.exe	31
PID 1728 wrote to memory of 1284	1728	WScript.exe	31
PID 1728 wrote to memory of 1284	1728	WScript.exe	31
PID 1728 wrote to memory of 1284	1728	WScript.exe	31
PID 1728 wrote to memory of 1284	1728	WScript.exe	31
PID 1284 wrote to memory of 364	1284	cmd.exe	30
PID 1284 wrote to memory of 364	1284	cmd.exe	30
PID 1284 wrote to memory of 364	1284	cmd.exe	30
PID 1284 wrote to memory of 364	1284	cmd.exe	30
PID 1284 wrote to memory of 364	1284	cmd.exe	30
PID 1284 wrote to memory of 364	1284	cmd.exe	30
PID 1284 wrote to memory of 364	1284	cmd.exe	30
PID 1284 wrote to memory of 1764	1284	cmd.exe	35
PID 1284 wrote to memory of 1764	1284	cmd.exe	35
PID 1284 wrote to memory of 1764	1284	cmd.exe	35
PID 1284 wrote to memory of 1764	1284	cmd.exe	35
PID 1284 wrote to memory of 1764	1284	cmd.exe	35
PID 1284 wrote to memory of 1764	1284	cmd.exe	35
PID 1284 wrote to memory of 1764	1284	cmd.exe	35
PID 1284 wrote to memory of 1048	1284	cmd.exe	34
PID 1284 wrote to memory of 1048	1284	cmd.exe	34
PID 1284 wrote to memory of 1048	1284	cmd.exe	34
PID 1284 wrote to memory of 1048	1284	cmd.exe	34
PID 1284 wrote to memory of 1048	1284	cmd.exe	34
PID 1284 wrote to memory of 1048	1284	cmd.exe	34
PID 1284 wrote to memory of 1048	1284	cmd.exe	34
PID 1284 wrote to memory of 1572	1284	cmd.exe	33
PID 1284 wrote to memory of 1572	1284	cmd.exe	33
PID 1284 wrote to memory of 1572	1284	cmd.exe	33
PID 1284 wrote to memory of 1572	1284	cmd.exe	33
PID 1284 wrote to memory of 1572	1284	cmd.exe	33
PID 1284 wrote to memory of 1572	1284	cmd.exe	33
PID 1284 wrote to memory of 1572	1284	cmd.exe	33
PID 1284 wrote to memory of 1384	1284	cmd.exe	36
PID 1284 wrote to memory of 1384	1284	cmd.exe	36
PID 1284 wrote to memory of 1384	1284	cmd.exe	36
PID 1284 wrote to memory of 1384	1284	cmd.exe	36
PID 1284 wrote to memory of 1384	1284	cmd.exe	36
PID 1284 wrote to memory of 1384	1284	cmd.exe	36
PID 1284 wrote to memory of 1384	1284	cmd.exe	36
PID 1284 wrote to memory of 1528	1284	cmd.exe	37
PID 1284 wrote to memory of 1528	1284	cmd.exe	37
PID 1284 wrote to memory of 1528	1284	cmd.exe	37
PID 1284 wrote to memory of 1528	1284	cmd.exe	37
PID 1284 wrote to memory of 1528	1284	cmd.exe	37
PID 1284 wrote to memory of 1528	1284	cmd.exe	37
PID 1284 wrote to memory of 1528	1284	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe
"C:\Users\Admin\AppData\Local\Temp\cb37229f83a7f00da748cddb5fa77777c20dca45f3d92db247521af009307e29.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\install.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Program Files (x86)\install.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s "regedit.reg"
      4⤵
      Runs .reg file with regedit
      PID:1572
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
      4⤵
      PID:1048
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rfusclient.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1764
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 2
      4⤵
      Delays execution with timeout.exe
      PID:1384
  - - C:\Program Files (x86)\rutserv.exe
      rutserv.exe /silentinstall
      4⤵
      Executes dropped EXE
      PID:1528
  - - C:\Program Files (x86)\rutserv.exe
      rutserv.exe /firewall
      4⤵
      PID:2040
  - - C:\Program Files (x86)\rutserv.exe
      rutserv.exe /start
      4⤵
      PID:1260

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rutserv.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:364

C:\Program Files (x86)\rutserv.exe
"C:\Program Files (x86)\rutserv.exe"
1⤵
PID:2012
- C:\Program Files (x86)\rfusclient.exe
  "C:\Program Files (x86)\rfusclient.exe" /tray
  2⤵
  PID:2044
- C:\Program Files (x86)\rfusclient.exe
  "C:\Program Files (x86)\rfusclient.exe"
  2⤵
  PID:1372
- - C:\Program Files (x86)\rfusclient.exe
    "C:\Program Files (x86)\rfusclient.exe" /tray
    3⤵
    PID:620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-136-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/620-133-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/620-138-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/620-135-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/620-134-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/620-137-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/1260-98-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1260-119-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1260-100-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1260-101-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1260-97-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1260-99-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1364-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1372-121-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/1372-123-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/1372-120-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/1372-125-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/1372-127-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/1528-81-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1528-77-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1528-80-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1528-79-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1528-82-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1528-78-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/2012-106-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/2012-107-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/2012-104-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/2012-105-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/2012-108-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/2040-87-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/2040-88-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/2040-89-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/2040-90-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/2040-92-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/2040-91-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/2044-128-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/2044-129-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/2044-126-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/2044-122-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download
memory/2044-124-0x0000000000400000-0x00000000009B6000-memory.dmp

Filesize
5.7MB

Download