Overview

overview

10

Static

static

310a090e8c...60.exe

windows7_x64

10

310a090e8c...60.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25-06-2022 03:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    310a090e8c001419cdcb694d92a3ab2f8356eae8467a3317a2bdee8e3b9c8e60.exe

  • Size

    6.3MB

  • MD5

    1a677c62a46e22491dd7723687ebb212

  • SHA1

    4af1c12b3b3300fa6e8ebf80f76238ccbaa12b0d

  • SHA256

    310a090e8c001419cdcb694d92a3ab2f8356eae8467a3317a2bdee8e3b9c8e60

  • SHA512

    34e55b3d2393e0bd188101de12958ea610a39dbf301417248a8bc84ab7224bd4dc67d9815b1228cedaefa9bb123c103ba160c9b9ce8d490ddd6d3e93aeaed143

Score
10/10
rmspersistencerattrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
    persistence
  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • Executes dropped EXE 5 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\310a090e8c001419cdcb694d92a3ab2f8356eae8467a3317a2bdee8e3b9c8e60.exe
    "C:\Users\Admin\AppData\Local\Temp\310a090e8c001419cdcb694d92a3ab2f8356eae8467a3317a2bdee8e3b9c8e60.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Windows\System64\1systemsmss.exe
      "C:\Windows\System64\1systemsmss.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1172
      • C:\Windows\SysWOW64\regedit.exe
        "C:\Windows\System32\regedit.exe" /s "C:\Windows\Zont911\Regedit.reg"
        3⤵
        • Runs .reg file with regedit
        PID:2520
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Windows\Zont911\Tupe.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4584
        • C:\Windows\SysWOW64\chcp.com
          Chcp 1251
          4⤵
            PID:4544
          • C:\Windows\System64\svnhost.exe
            "C:\Windows\System64\svnhost.exe" /silentinstall
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4572
          • C:\Windows\System64\svnhost.exe
            "C:\Windows\System64\svnhost.exe" /firewall
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4488
          • C:\Windows\System64\svnhost.exe
            "C:\Windows\System64\svnhost.exe" /start
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4692
    • C:\Windows\System64\svnhost.exe
      C:\Windows\System64\svnhost.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4616

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\System64\1systemsmss.exe
      Filesize

      6.3MB

      MD5

      1a677c62a46e22491dd7723687ebb212

      SHA1

      4af1c12b3b3300fa6e8ebf80f76238ccbaa12b0d

      SHA256

      310a090e8c001419cdcb694d92a3ab2f8356eae8467a3317a2bdee8e3b9c8e60

      SHA512

      34e55b3d2393e0bd188101de12958ea610a39dbf301417248a8bc84ab7224bd4dc67d9815b1228cedaefa9bb123c103ba160c9b9ce8d490ddd6d3e93aeaed143

      Download Submit

    • C:\Windows\System64\1systemsmss.exe
      Filesize

      6.3MB

      MD5

      1a677c62a46e22491dd7723687ebb212

      SHA1

      4af1c12b3b3300fa6e8ebf80f76238ccbaa12b0d

      SHA256

      310a090e8c001419cdcb694d92a3ab2f8356eae8467a3317a2bdee8e3b9c8e60

      SHA512

      34e55b3d2393e0bd188101de12958ea610a39dbf301417248a8bc84ab7224bd4dc67d9815b1228cedaefa9bb123c103ba160c9b9ce8d490ddd6d3e93aeaed143

      Download Submit

    • C:\Windows\System64\svnhost.exe
      Filesize

      6.0MB

      MD5

      e437e8730f2163cba2552a5a374a885a

      SHA1

      514497f668ae7b80a698bd8cda6de2dcf104e450

      SHA256

      dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

      SHA512

      e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

      Download Submit

    • C:\Windows\System64\svnhost.exe
      Filesize

      6.0MB

      MD5

      e437e8730f2163cba2552a5a374a885a

      SHA1

      514497f668ae7b80a698bd8cda6de2dcf104e450

      SHA256

      dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

      SHA512

      e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

      Download Submit

    • C:\Windows\System64\svnhost.exe
      Filesize

      6.0MB

      MD5

      e437e8730f2163cba2552a5a374a885a

      SHA1

      514497f668ae7b80a698bd8cda6de2dcf104e450

      SHA256

      dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

      SHA512

      e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

      Download Submit

    • C:\Windows\System64\svnhost.exe
      Filesize

      6.0MB

      MD5

      e437e8730f2163cba2552a5a374a885a

      SHA1

      514497f668ae7b80a698bd8cda6de2dcf104e450

      SHA256

      dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

      SHA512

      e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

      Download Submit

    • C:\Windows\System64\svnhost.exe
      Filesize

      6.0MB

      MD5

      e437e8730f2163cba2552a5a374a885a

      SHA1

      514497f668ae7b80a698bd8cda6de2dcf104e450

      SHA256

      dde1cc7b34ad434fb515b4b315c2ec22a74e3b1b4d50fe83421fab4d6055b3a6

      SHA512

      e924929176c60f00bfd45f0ec991279d4bbb96be4f5f270e636594d4faad681c318cbc9374dd2126170e18f7b4e9db54b193c147b452655c2806921d8c76c445

      Download Submit

    • C:\Windows\System64\systemsmss.exe
      Filesize

      5.1MB

      MD5

      bd458a26931f960f13958510e88a61a8

      SHA1

      be9fff29f269d649688e941e97ac03e669571837

      SHA256

      d295538301a5513d3e605e43586e48504ec22f87666a31ef06f697b5c9b611f3

      SHA512

      afe9e6209ade2846f31efb7b9977d42b28cd082eb0a4b9c4ba4b9c91d528afbc7efe748be0c78c938d042dc9d200c23d2f0552a7498ab23becac828df53245e7

      Download Submit

    • C:\Windows\System64\vp8decoder.dll
      Filesize

      378KB

      MD5

      d43fa82fab5337ce20ad14650085c5d9

      SHA1

      678aa092075ff65b6815ffc2d8fdc23af8425981

      SHA256

      c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b

      SHA512

      103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

      Download Submit

    • C:\Windows\System64\vp8encoder.dll
      Filesize

      1.6MB

      MD5

      dab4646806dfca6d0e0b4d80fa9209d6

      SHA1

      8244dfe22ec2090eee89dad103e6b2002059d16a

      SHA256

      cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587

      SHA512

      aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

      Download Submit

    • C:\Windows\Zont911\Regedit.reg
      Filesize

      11KB

      MD5

      8652240acb0c567db26f15721b4eb7a1

      SHA1

      8e302e822bd83dc106d735343267dcb7c2384b93

      SHA256

      d86fc93ea8d3f3a2c7b09c64942ddffd1cc6fbbbf002fec07815138fa634f1b8

      SHA512

      e95d58d7525c16659705522bbb700ee94985da8084ca55d59d5be04e86ca5a51186c287eabf9f78e1aa6403823011323ffded3964c73691a71ef2d0036acc4d9

      Download Submit

    • C:\Windows\Zont911\Tupe.bat
      Filesize

      281B

      MD5

      691f040de6d335962416b319dcd416dc

      SHA1

      db49109c0917910f7fce8b6de690a1c7e2026226

      SHA256

      605d0b9c2fd1972c4ee60d8eefd336be636884dcdf54a4e5f2829c46e80fdcea

      SHA512

      f34ba36bdeaa43a1265ec69acfa0f199f2b4d5d90b4ea890327478f4f48ec7597d660b922dd1e149de3a1ff9b48c79e4c9c53e8a482b4cb5842bc0976f93bf89

      Download Submit