Overview

overview

10

Static

static

3

1825933106...74.exe

windows7-x64

10

1825933106...74.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    182593310607f0f7b47ad80cbf5fbe74.bin

  • Size

    7.5MB

  • Sample

    230923-bj1n9sdb59

  • MD5

    182593310607f0f7b47ad80cbf5fbe74

  • SHA1

    f74bdec42f5bb2dbbde3898e9e0bc2d16eb0fe99

  • SHA256

    393b4de1154e2b1164c0db18643ed0accc95efe44687cd41af730422ed6bbccf

  • SHA512

    dfb88e5b7de63e4a79df542c4d47f7d5b288e0f88fbe30d59284d8f275acb29bb93c776edc16c649a1daf511ffb302980ee19175c9f4ee4aae38db679dcc71e8

  • SSDEEP

    196608:V7iFSsOfzkZj1Cwx8fMZYe+1ClL4oQ0utRkNk:V7Rza1dxAMZmVdtWNk

Score
10/10
rmsdiscoveryevasionpersistencerattrojan

Malware Config

Targets

    • Target

      182593310607f0f7b47ad80cbf5fbe74.bin

    • Size

      7.5MB

    • MD5

      182593310607f0f7b47ad80cbf5fbe74

    • SHA1

      f74bdec42f5bb2dbbde3898e9e0bc2d16eb0fe99

    • SHA256

      393b4de1154e2b1164c0db18643ed0accc95efe44687cd41af730422ed6bbccf

    • SHA512

      dfb88e5b7de63e4a79df542c4d47f7d5b288e0f88fbe30d59284d8f275acb29bb93c776edc16c649a1daf511ffb302980ee19175c9f4ee4aae38db679dcc71e8

    • SSDEEP

      196608:V7iFSsOfzkZj1Cwx8fMZYe+1ClL4oQ0utRkNk:V7Rza1dxAMZmVdtWNk

    Score
    10/10
    rmsdiscoveryevasionpersistencerattrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • UAC bypass

      evasiontrojan

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks