Overview

overview

10

Static

static

8

fd2658a7e9...17.exe

windows7-x64

10

fd2658a7e9...17.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd2658a7e96f5babb9efc15b7df7c10da1c25593b3f9ad9b36c6148037503117

  • Size

    2.0MB

  • Sample

    221127-1h2bvaah93

  • MD5

    f1c647b4a3319a764fd6e8ed0ce85ff1

  • SHA1

    900b636dc9e88874f72ff119315091a5cacf0452

  • SHA256

    fd2658a7e96f5babb9efc15b7df7c10da1c25593b3f9ad9b36c6148037503117

  • SHA512

    bd3e4aeb733dd7ef72ee58a55b1efae71bd6afa49e9fe3e5d49c1fac6f60c3beec77f6bf1d230d7e836d03f2bd6c119025189edcbb69ad783bc310f12db9accf

  • SSDEEP

    49152:a1LwvJ8WH0S6nBiSlqo5ulwGULRbI2I4kk7Ykg8p3pxgN0:sIcNqlwJL1XLkvyp3peO

Score
10/10
rmsevasionpersistencerattrojanupx

Malware Config

Targets

    • Target

      fd2658a7e96f5babb9efc15b7df7c10da1c25593b3f9ad9b36c6148037503117

    • Size

      2.0MB

    • MD5

      f1c647b4a3319a764fd6e8ed0ce85ff1

    • SHA1

      900b636dc9e88874f72ff119315091a5cacf0452

    • SHA256

      fd2658a7e96f5babb9efc15b7df7c10da1c25593b3f9ad9b36c6148037503117

    • SHA512

      bd3e4aeb733dd7ef72ee58a55b1efae71bd6afa49e9fe3e5d49c1fac6f60c3beec77f6bf1d230d7e836d03f2bd6c119025189edcbb69ad783bc310f12db9accf

    • SSDEEP

      49152:a1LwvJ8WH0S6nBiSlqo5ulwGULRbI2I4kk7Ykg8p3pxgN0:sIcNqlwJL1XLkvyp3peO

    Score
    10/10
    rmsevasionpersistencerattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks