rms

General

Target

221107-hzpp9sded3_pw_infected.zip
Size

60.1MB
Sample

221117-e328zsdf69
MD5

feb01da21ab174bcbe90f377ca93b57c
SHA1

a4b44b71d19ee65d8870cbc74c1e975caea25de1
SHA256

cde3720e9c1d758e606495f4eb216e165e0e2bbe80c9018f32287ae31f553693
SHA512

29a09cfdc3b9e72f2a82699e32e5401ac8728d31ff8cc070cad9bfc26cfca63832bb42c9341a8669fc9cc92798691ef92e2c543eda219dfb4a79a8d1528a56f4
SSDEEP

786432:Cu6OhMOeGbkv7+Js+n95UrwBurSL7bJRqY4tZ8uWbtbphjymJ7UBaH555knSfyGF:25hQk7+JhHvLR7uONomVoaH54e4eLwiX

Score

10^/10

Malware Config

Targets

- Target
  
  update.rar
- Size
  
  60.2MB
- MD5
  
  b77955061c0f46de8059c20128ebb156
- SHA1
  
  bd9ba700caec09387bfcf97bd9cc0a2e846836ca
- SHA256
  
  ca94c8bbbb10febb8187f8c709affaa91911f646cf0ac99e857bf45b3a709091
- SHA512
  
  83f07b66be1138e5f3f1c1f2504d3222bcc1bb1c1626a98e2346408cde7c771a64a998fa38c23ac66097f0b610f70c6309ea914e0c9c95ecff588a385aeb69aa
- SSDEEP
  
  1572864:DdjkMwgaV4gRNzu1zCcFA4o/UDDvX94UKfytNxZhDa:FJGuMzuHnXDKfeN5Da
Score

10^/10

evasion persistence themida trojan rms xmrig discovery miner rat upx
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- RMS
  Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
  trojan rat rms
- Suspicious use of NtCreateUserProcessOtherParentProcess
- UAC bypass
  evasion trojan
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Registers new Print Monitor
  persistence
- Sets DLL path for service in the registry
  persistence
- Stops running service(s)
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies WinLogon
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2