resource	yara_rule
behavioral2/files/0x0006000000022e43-156.dat	acprotect
behavioral2/files/0x0006000000022e42-155.dat	acprotect

pid	Process
4944	screen%E2%80%AEgnp (1).scr
2112	Image.scr
3460	rutserv.exe
5100	rutserv.exe
1952	rutserv.exe
2964	rutserv.exe
772	rfusclient.exe
2532	rfusclient.exe
5088	rfusclient.exe

resource	yara_rule
behavioral2/files/0x0006000000022e4a-152.dat	upx
behavioral2/files/0x0006000000022e48-153.dat	upx
behavioral2/files/0x0006000000022e43-156.dat	upx
behavioral2/files/0x0006000000022e42-155.dat	upx
behavioral2/files/0x0006000000022e4a-166.dat	upx
behavioral2/memory/3460-168-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral2/files/0x0006000000022e4a-171.dat	upx
behavioral2/memory/5100-173-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral2/memory/5100-175-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral2/files/0x0006000000022e4a-179.dat	upx
behavioral2/files/0x0006000000022e4a-181.dat	upx
behavioral2/memory/1952-183-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral2/memory/2964-185-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral2/files/0x0006000000022e48-190.dat	upx
behavioral2/memory/772-192-0x0000000000400000-0x0000000000971000-memory.dmp	upx
behavioral2/memory/1952-194-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral2/files/0x0006000000022e48-189.dat	upx
behavioral2/memory/2532-198-0x0000000000400000-0x0000000000971000-memory.dmp	upx
behavioral2/files/0x0006000000022e48-200.dat	upx
behavioral2/memory/5088-202-0x0000000000400000-0x0000000000971000-memory.dmp	upx
behavioral2/memory/5088-204-0x0000000000400000-0x0000000000971000-memory.dmp	upx
behavioral2/memory/2964-205-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral2/memory/772-206-0x0000000000400000-0x0000000000971000-memory.dmp	upx
behavioral2/memory/2532-207-0x0000000000400000-0x0000000000971000-memory.dmp	upx

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Image.scr
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	28ea428f96d48a053033677f2bae666287038c2f9279a903bb351cca2970471b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	screen%E2%80%AEgnp (1).scr

description	ioc	Process
File created	C:\Windows\SysWOW64\de.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\de.exe	cmd.exe

description	ioc	Process
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8encoder.dll	attrib.exe
File created	C:\Windows\control.ini	cmd.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\winmm.dll	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rutserv.exe	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8decoder.dll	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8encoder.dll	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8decoder.dll	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe	attrib.exe
File opened for modification	C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\russian.lg	attrib.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	screen%E2%80%AEgnp (1).scr
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	Image.scr

description	pid	Process
Token: SeDebugPrivilege	4276	taskkill.exe
Token: SeDebugPrivilege	3736	taskkill.exe
Token: SeDebugPrivilege	3460	rutserv.exe
Token: SeDebugPrivilege	1952	rutserv.exe
Token: SeTakeOwnershipPrivilege	2964	rutserv.exe
Token: SeTcbPrivilege	2964	rutserv.exe
Token: SeTcbPrivilege	2964	rutserv.exe

description	pid	Process	procid_target
PID 2040 wrote to memory of 4944	2040	28ea428f96d48a053033677f2bae666287038c2f9279a903bb351cca2970471b.exe	78
PID 2040 wrote to memory of 4944	2040	28ea428f96d48a053033677f2bae666287038c2f9279a903bb351cca2970471b.exe	78
PID 2040 wrote to memory of 4944	2040	28ea428f96d48a053033677f2bae666287038c2f9279a903bb351cca2970471b.exe	78
PID 4944 wrote to memory of 3476	4944	screen%E2%80%AEgnp (1).scr	82
PID 4944 wrote to memory of 3476	4944	screen%E2%80%AEgnp (1).scr	82
PID 4944 wrote to memory of 3476	4944	screen%E2%80%AEgnp (1).scr	82
PID 3476 wrote to memory of 2436	3476	WScript.exe	83
PID 3476 wrote to memory of 2436	3476	WScript.exe	83
PID 3476 wrote to memory of 2436	3476	WScript.exe	83
PID 4944 wrote to memory of 1320	4944	screen%E2%80%AEgnp (1).scr	85
PID 4944 wrote to memory of 1320	4944	screen%E2%80%AEgnp (1).scr	85
PID 4944 wrote to memory of 1320	4944	screen%E2%80%AEgnp (1).scr	85
PID 2436 wrote to memory of 2112	2436	cmd.exe	87
PID 2436 wrote to memory of 2112	2436	cmd.exe	87
PID 2436 wrote to memory of 2112	2436	cmd.exe	87
PID 2436 wrote to memory of 1176	2436	cmd.exe	88
PID 2436 wrote to memory of 1176	2436	cmd.exe	88
PID 2436 wrote to memory of 1176	2436	cmd.exe	88
PID 2112 wrote to memory of 2312	2112	Image.scr	89
PID 2112 wrote to memory of 2312	2112	Image.scr	89
PID 2112 wrote to memory of 2312	2112	Image.scr	89
PID 2312 wrote to memory of 1672	2312	WScript.exe	90
PID 2312 wrote to memory of 1672	2312	WScript.exe	90
PID 2312 wrote to memory of 1672	2312	WScript.exe	90
PID 1672 wrote to memory of 2444	1672	cmd.exe	92
PID 1672 wrote to memory of 2444	1672	cmd.exe	92
PID 1672 wrote to memory of 2444	1672	cmd.exe	92
PID 1672 wrote to memory of 4276	1672	cmd.exe	93
PID 1672 wrote to memory of 4276	1672	cmd.exe	93
PID 1672 wrote to memory of 4276	1672	cmd.exe	93
PID 1672 wrote to memory of 3736	1672	cmd.exe	94
PID 1672 wrote to memory of 3736	1672	cmd.exe	94
PID 1672 wrote to memory of 3736	1672	cmd.exe	94
PID 1672 wrote to memory of 2796	1672	cmd.exe	95
PID 1672 wrote to memory of 2796	1672	cmd.exe	95
PID 1672 wrote to memory of 2796	1672	cmd.exe	95
PID 1672 wrote to memory of 3508	1672	cmd.exe	96
PID 1672 wrote to memory of 3508	1672	cmd.exe	96
PID 1672 wrote to memory of 3508	1672	cmd.exe	96
PID 1672 wrote to memory of 3696	1672	cmd.exe	97
PID 1672 wrote to memory of 3696	1672	cmd.exe	97
PID 1672 wrote to memory of 3696	1672	cmd.exe	97
PID 1672 wrote to memory of 4564	1672	cmd.exe	98
PID 1672 wrote to memory of 4564	1672	cmd.exe	98
PID 1672 wrote to memory of 4564	1672	cmd.exe	98
PID 1672 wrote to memory of 3340	1672	cmd.exe	99
PID 1672 wrote to memory of 3340	1672	cmd.exe	99
PID 1672 wrote to memory of 3340	1672	cmd.exe	99
PID 1672 wrote to memory of 3460	1672	cmd.exe	100
PID 1672 wrote to memory of 3460	1672	cmd.exe	100
PID 1672 wrote to memory of 3460	1672	cmd.exe	100
PID 1672 wrote to memory of 5100	1672	cmd.exe	101
PID 1672 wrote to memory of 5100	1672	cmd.exe	101
PID 1672 wrote to memory of 5100	1672	cmd.exe	101
PID 1672 wrote to memory of 4464	1672	cmd.exe	102
PID 1672 wrote to memory of 4464	1672	cmd.exe	102
PID 1672 wrote to memory of 4464	1672	cmd.exe	102
PID 1672 wrote to memory of 800	1672	cmd.exe	103
PID 1672 wrote to memory of 800	1672	cmd.exe	103
PID 1672 wrote to memory of 800	1672	cmd.exe	103
PID 1672 wrote to memory of 1952	1672	cmd.exe	104
PID 1672 wrote to memory of 1952	1672	cmd.exe	104
PID 1672 wrote to memory of 1952	1672	cmd.exe	104
PID 2964 wrote to memory of 772	2964	rutserv.exe	106

pid	Process
1176	timeout.exe
5044	timeout.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.