General

  • Target

    cd981a20183b128f674579669e130c0c9dc66ff1d3de45c28b6ac62fa9de7668

  • Size

    4.3MB

  • Sample

    221203-a33sasde5t

  • MD5

    e8cac02b1c6407ee2ab0b08d6c669fb1

  • SHA1

    497ff2c6f0f4612d63ec5eaded75f74f28e729f3

  • SHA256

    cd981a20183b128f674579669e130c0c9dc66ff1d3de45c28b6ac62fa9de7668

  • SHA512

    4ea97a5e0a60c995e66ecc3d62dab5868db16319ccea223bc6daa3ef1617d9d0d1eb90571f0a4bffc0eac6b4478e135b424eda47c7b6887458c8f592c49d818c

  • SSDEEP

    98304:7JYvakukyg+fCpLG9fevK46z4hF42Xp+wsTWgIZY3TOavcQ4IkxfY:7JAaHDnfCBsfewzcF42Xp+wZgIm3DcQD

Malware Config

Targets

    • Target

      cd981a20183b128f674579669e130c0c9dc66ff1d3de45c28b6ac62fa9de7668

    • Size

      4.3MB

    • MD5

      e8cac02b1c6407ee2ab0b08d6c669fb1

    • SHA1

      497ff2c6f0f4612d63ec5eaded75f74f28e729f3

    • SHA256

      cd981a20183b128f674579669e130c0c9dc66ff1d3de45c28b6ac62fa9de7668

    • SHA512

      4ea97a5e0a60c995e66ecc3d62dab5868db16319ccea223bc6daa3ef1617d9d0d1eb90571f0a4bffc0eac6b4478e135b424eda47c7b6887458c8f592c49d818c

    • SSDEEP

      98304:7JYvakukyg+fCpLG9fevK46z4hF42Xp+wsTWgIZY3TOavcQ4IkxfY:7JAaHDnfCBsfewzcF42Xp+wZgIm3DcQD

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks