Overview

overview

10

Static

static

3

winserv.exe

windows7-x64

10

winserv.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    winserv.exe

  • Size

    10.2MB

  • Sample

    230526-mcyf4sfe3x

  • MD5

    3f4f5a6cb95047fea6102bd7d2226aa9

  • SHA1

    fc09dd898b6e7ff546e4a7517a715928fbafc297

  • SHA256

    99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98

  • SHA512

    de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688

  • SSDEEP

    196608:iz+UZcWP4jBrfWgEgIV8Rzy7Vj4FZvEo:i6UZcWWeVj4FZ

Score
10/10
rmsdiscoveryrattrojan

Malware Config

Targets

    • Target

      winserv.exe

    • Size

      10.2MB

    • MD5

      3f4f5a6cb95047fea6102bd7d2226aa9

    • SHA1

      fc09dd898b6e7ff546e4a7517a715928fbafc297

    • SHA256

      99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98

    • SHA512

      de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688

    • SSDEEP

      196608:iz+UZcWP4jBrfWgEgIV8Rzy7Vj4FZvEo:i6UZcWWeVj4FZ

    Score
    10/10
    rmsrattrojandiscovery

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks