Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 16:22
General
-
Target
1083ba242a5d21a2531680aa455555e6daaf73fc40284cd590c67e9f7a06dfa2.exe
-
Size
6.2MB
-
MD5
d958d021ae8bfcdb4b94427dcedd002d
-
SHA1
d8ca9ce4eb4447867defc6c18475a1714eae8703
-
SHA256
1083ba242a5d21a2531680aa455555e6daaf73fc40284cd590c67e9f7a06dfa2
-
SHA512
9f606b61d626b89f50966c16cda46d65d2339eaddd34d57f0ffd9c37917aa4f797239d9ba3b0265a49f6b16cffdb4f189ef21b15f96f8c59f5cdd53a512c77a8
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
-
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
-
Executes dropped EXE 7 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 13 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs .reg file with regedit 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1083ba242a5d21a2531680aa455555e6daaf73fc40284cd590c67e9f7a06dfa2.exe"C:\Users\Admin\AppData\Local\Temp\1083ba242a5d21a2531680aa455555e6daaf73fc40284cd590c67e9f7a06dfa2.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System64\1systemsmss.exe"C:\Windows\System64\1systemsmss.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s "C:\Windows\Zont911\Regedit.reg"3⤵
- Runs .reg file with regedit
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\Zont911\Tupe.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comChcp 12514⤵
-
-
C:\Windows\System64\svnhost.exe"C:\Windows\System64\svnhost.exe" /silentinstall4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System64\svnhost.exe"C:\Windows\System64\svnhost.exe" /firewall4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System64\svnhost.exe"C:\Windows\System64\svnhost.exe" /start4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\System64\svnhost.exeC:\Windows\System64\svnhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System64\systemsmss.exeC:\Windows\System64\systemsmss.exe /tray2⤵
- Executes dropped EXE
-
-
C:\Windows\System64\systemsmss.exeC:\Windows\System64\systemsmss.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.2MB
MD5d958d021ae8bfcdb4b94427dcedd002d
SHA1d8ca9ce4eb4447867defc6c18475a1714eae8703
SHA2561083ba242a5d21a2531680aa455555e6daaf73fc40284cd590c67e9f7a06dfa2
SHA5129f606b61d626b89f50966c16cda46d65d2339eaddd34d57f0ffd9c37917aa4f797239d9ba3b0265a49f6b16cffdb4f189ef21b15f96f8c59f5cdd53a512c77a8
-
Filesize
6.2MB
MD5d958d021ae8bfcdb4b94427dcedd002d
SHA1d8ca9ce4eb4447867defc6c18475a1714eae8703
SHA2561083ba242a5d21a2531680aa455555e6daaf73fc40284cd590c67e9f7a06dfa2
SHA5129f606b61d626b89f50966c16cda46d65d2339eaddd34d57f0ffd9c37917aa4f797239d9ba3b0265a49f6b16cffdb4f189ef21b15f96f8c59f5cdd53a512c77a8
-
Filesize
6.0MB
MD5e437e8730f2163cba2552a5a374a885a
SHA1514497f668ae7b80a698bd8cda6de2dcf104e450
SHA256dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6
SHA512e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445
-
Filesize
6.0MB
MD5e437e8730f2163cba2552a5a374a885a
SHA1514497f668ae7b80a698bd8cda6de2dcf104e450
SHA256dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6
SHA512e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445
-
Filesize
6.0MB
MD5e437e8730f2163cba2552a5a374a885a
SHA1514497f668ae7b80a698bd8cda6de2dcf104e450
SHA256dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6
SHA512e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445
-
Filesize
6.0MB
MD5e437e8730f2163cba2552a5a374a885a
SHA1514497f668ae7b80a698bd8cda6de2dcf104e450
SHA256dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6
SHA512e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445
-
Filesize
6.0MB
MD5e437e8730f2163cba2552a5a374a885a
SHA1514497f668ae7b80a698bd8cda6de2dcf104e450
SHA256dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6
SHA512e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445
-
Filesize
5.1MB
MD5bd458a26931f960f13958510e88a61a8
SHA1be9fff29f269d649688e941e97ac03e669571837
SHA256d295538301a5513d3e605e43586e48504ec22f87666a31ef06f697b5c9b611f3
SHA512afe9e6209ade2846f31efb7b9977d42b28cd082eb0a4b9c4ba4b9c91d528afbc7efe748be0c78c938d042dc9d200c23d2f0552a7498ab23becac828df53245e7
-
Filesize
5.1MB
MD5bd458a26931f960f13958510e88a61a8
SHA1be9fff29f269d649688e941e97ac03e669571837
SHA256d295538301a5513d3e605e43586e48504ec22f87666a31ef06f697b5c9b611f3
SHA512afe9e6209ade2846f31efb7b9977d42b28cd082eb0a4b9c4ba4b9c91d528afbc7efe748be0c78c938d042dc9d200c23d2f0552a7498ab23becac828df53245e7
-
Filesize
5.1MB
MD5bd458a26931f960f13958510e88a61a8
SHA1be9fff29f269d649688e941e97ac03e669571837
SHA256d295538301a5513d3e605e43586e48504ec22f87666a31ef06f697b5c9b611f3
SHA512afe9e6209ade2846f31efb7b9977d42b28cd082eb0a4b9c4ba4b9c91d528afbc7efe748be0c78c938d042dc9d200c23d2f0552a7498ab23becac828df53245e7
-
Filesize
378KB
MD5d43fa82fab5337ce20ad14650085c5d9
SHA1678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d
-
Filesize
1.6MB
MD5dab4646806dfca6d0e0b4d80fa9209d6
SHA18244dfe22ec2090eee89dad103e6b2002059d16a
SHA256cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7
-
Filesize
11KB
MD57c7d1b063c006e283ff8ac21aa2aacb6
SHA195fff3faca742e74e1310dfd42299e3adb433e7f
SHA256c57ac10ca021745aa34fa1a9b7510a1d58cfa873ab086e92d2f2e0df9848c2ab
SHA512bdc8564d3b5fa06550a269cda474e1b11b60cff00ffad7556b022845bd0c35d27ede605fae7ed1f6be39eb83200acdfb8fbeac8d3f44d76b5316259d2dcd6cbf
-
Filesize
281B
MD5691f040de6d335962416b319dcd416dc
SHA1db49109c0917910f7fce8b6de690a1c7e2026226
SHA256605d0b9c2fd1972c4ee60d8eefd336be636884dcdf54a4e5f2829c46e80fdcea
SHA512f34ba36bdeaa43a1265ec69acfa0f199f2b4d5d90b4ea890327478f4f48ec7597d660b922dd1e149de3a1ff9b48c79e4c9c53e8a482b4cb5842bc0976f93bf89