Overview

overview

10

Static

static

f63cb63580...df.exe

windows7-x64

10

f63cb63580...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f63cb635800af0847c1c734fac6721903314438945e1e6bcfe2eca3a36a9f7df

  • Size

    2.0MB

  • Sample

    221124-e89v1shf58

  • MD5

    11d06c992e460873209753ac74c7ab6c

  • SHA1

    1fb3b05fc348bcf1042d8db1f72dda141aeab7d1

  • SHA256

    f63cb635800af0847c1c734fac6721903314438945e1e6bcfe2eca3a36a9f7df

  • SHA512

    98b469f6500aa367d70cdf1048ce49ce421f75909dfc6c00be0bbc03009f989c122a1dc1a1f4c03756f7204bce8f3f41c49788dac17f73c5cbc8a9522185f905

  • SSDEEP

    49152:AOH5bKbqBFyLmP/aTX8fO3GOOvEG5zRL0W2B23+aDrv:AOZ/VK7l2OgL0g+aDj

Score
10/10
rmsevasionpersistencerattrojan

Malware Config

Targets

    • Target

      f63cb635800af0847c1c734fac6721903314438945e1e6bcfe2eca3a36a9f7df

    • Size

      2.0MB

    • MD5

      11d06c992e460873209753ac74c7ab6c

    • SHA1

      1fb3b05fc348bcf1042d8db1f72dda141aeab7d1

    • SHA256

      f63cb635800af0847c1c734fac6721903314438945e1e6bcfe2eca3a36a9f7df

    • SHA512

      98b469f6500aa367d70cdf1048ce49ce421f75909dfc6c00be0bbc03009f989c122a1dc1a1f4c03756f7204bce8f3f41c49788dac17f73c5cbc8a9522185f905

    • SSDEEP

      49152:AOH5bKbqBFyLmP/aTX8fO3GOOvEG5zRL0W2B23+aDrv:AOZ/VK7l2OgL0g+aDj

    Score
    10/10
    rmsevasionpersistencerattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks