Overview

overview

10

Static

static

4362e62ad6...e2.exe

windows7_x64

10

4362e62ad6...e2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4362e62ad6f87529b654e32272fcce35829a6ff769e240120de7fc382d5d7ee2

  • Size

    13.2MB

  • Sample

    220707-2166gsffhq

  • MD5

    9eeba047a2d40dcdbe5ce6d31b4ec760

  • SHA1

    6bb0db6b1b06c018523db4de51e7ba6ed16baf5d

  • SHA256

    4362e62ad6f87529b654e32272fcce35829a6ff769e240120de7fc382d5d7ee2

  • SHA512

    82ae396b6fd34803dd36bcedc76b28da5ea20e92feff6d407676616b2a5ca828d02a48d45855a19b2bd343c0f7391cd85dee967883e7afa5c42cd55d28754e03

Score
10/10
rmsrattrojan

Malware Config

Targets

    • Target

      4362e62ad6f87529b654e32272fcce35829a6ff769e240120de7fc382d5d7ee2

    • Size

      13.2MB

    • MD5

      9eeba047a2d40dcdbe5ce6d31b4ec760

    • SHA1

      6bb0db6b1b06c018523db4de51e7ba6ed16baf5d

    • SHA256

      4362e62ad6f87529b654e32272fcce35829a6ff769e240120de7fc382d5d7ee2

    • SHA512

      82ae396b6fd34803dd36bcedc76b28da5ea20e92feff6d407676616b2a5ca828d02a48d45855a19b2bd343c0f7391cd85dee967883e7afa5c42cd55d28754e03

    Score
    10/10
    rmsrattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks