Overview

overview

10

Static

static

8

1B8406FD53...B1.exe

windows7-x64

10

1B8406FD53...B1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1B8406FD53D3EFE2E48DDB665B3AD38B2ED56EA8554B1.exe

  • Size

    16.9MB

  • Sample

    221230-yx9knabg2x

  • MD5

    4363a033ca0d3926b5660a23dbac5443

  • SHA1

    6e9be146051594d8745ec3ad52b1976b38f2933b

  • SHA256

    1b8406fd53d3efe2e48ddb665b3ad38b2ed56ea8554b147ca9d73d636ce19fa5

  • SHA512

    5484bf0367f801c9de2fb6d4da955572d90332ad26fc2c243638c14566a67bc6de4e57d05f53c992f50a1845d57e873bfc97b2b23e05b5aa882da4af7c895042

  • SSDEEP

    393216:4uDuv/ef+TC7J50c07ex18ykc5hpiNs+ykHfe9fvPRvsw:Ov/e7J67eD8yHvpos+LHMvPZ

Score
10/10
rmsrattrojanupx

Malware Config

Targets

    • Target

      1B8406FD53D3EFE2E48DDB665B3AD38B2ED56EA8554B1.exe

    • Size

      16.9MB

    • MD5

      4363a033ca0d3926b5660a23dbac5443

    • SHA1

      6e9be146051594d8745ec3ad52b1976b38f2933b

    • SHA256

      1b8406fd53d3efe2e48ddb665b3ad38b2ed56ea8554b147ca9d73d636ce19fa5

    • SHA512

      5484bf0367f801c9de2fb6d4da955572d90332ad26fc2c243638c14566a67bc6de4e57d05f53c992f50a1845d57e873bfc97b2b23e05b5aa882da4af7c895042

    • SSDEEP

      393216:4uDuv/ef+TC7J50c07ex18ykc5hpiNs+ykHfe9fvPRvsw:Ov/e7J67eD8yHvpos+LHMvPZ

    Score
    10/10
    rmsrattrojanupx

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks