Overview

overview

10

Static

static

6679713eff...e7.exe

windows7-x64

10

6679713eff...e7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6679713eff98fb9688c93ea4fbf18b3e032951b87de9f92c78a72fce8ce01ce7

  • Size

    2.0MB

  • Sample

    221126-fkqynsgd9y

  • MD5

    b116dea2cc37290ca470c0897b525003

  • SHA1

    fb949ccd1adc5588268fdb1e6664a6acdf05e2d7

  • SHA256

    6679713eff98fb9688c93ea4fbf18b3e032951b87de9f92c78a72fce8ce01ce7

  • SHA512

    e20d51db38fc449087737759f9898baff38c32cbec87a0b887d8cf30fae78f4c7622eaf52722c405fc96db233233d2d18673315125e423c09bf0243073ef9fac

  • SSDEEP

    49152:vcH5bKv+aDrXbxG6lHVXkHkTfdDer4kE+5cc1rHVXsKAT21GBxF37o:vcZq+aDrbxxHlckxqbE+5Z1rSe1Gf6

Score
10/10
rmsevasionpersistencerattrojan

Malware Config

Targets

    • Target

      6679713eff98fb9688c93ea4fbf18b3e032951b87de9f92c78a72fce8ce01ce7

    • Size

      2.0MB

    • MD5

      b116dea2cc37290ca470c0897b525003

    • SHA1

      fb949ccd1adc5588268fdb1e6664a6acdf05e2d7

    • SHA256

      6679713eff98fb9688c93ea4fbf18b3e032951b87de9f92c78a72fce8ce01ce7

    • SHA512

      e20d51db38fc449087737759f9898baff38c32cbec87a0b887d8cf30fae78f4c7622eaf52722c405fc96db233233d2d18673315125e423c09bf0243073ef9fac

    • SSDEEP

      49152:vcH5bKv+aDrXbxG6lHVXkHkTfdDer4kE+5cc1rHVXsKAT21GBxF37o:vcZq+aDrbxxHlckxqbE+5Z1rSe1Gf6

    Score
    10/10
    rmsevasionpersistencerattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks