Analysis
-
max time kernel
158s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
18-10-2023 18:38
General
-
Target
NEAS.NEASNEASab331fd318fdc268d79d9bd4a4e01a02292041b70403da4f36fe8f310122cc72exeexeexe_JC.exe
-
Size
11.2MB
-
MD5
415f6adef4388556501cb4ff794af055
-
SHA1
1486055a9fc888a50e1e41c5004a04e61fd59879
-
SHA256
ab331fd318fdc268d79d9bd4a4e01a02292041b70403da4f36fe8f310122cc72
-
SHA512
7d22b9f0cc6ed8309e19591ad4ef58b40f45499c44b4251e99a379d3701737391f90d64942944c9423485d6b9bf56072794b3429449be2dee618b65ec4f08ba6
-
SSDEEP
196608:9oP6UZ0dTdMShx5GBzSSEGdIBCFucTCreKQay7x2FV3cuvsZIC192LDXz68bu0:9oSBTmHIBwHL7x2FV32l92/Xzhu0
Malware Config
Signatures
-
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 4 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEASab331fd318fdc268d79d9bd4a4e01a02292041b70403da4f36fe8f310122cc72exeexeexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEASab331fd318fdc268d79d9bd4a4e01a02292041b70403da4f36fe8f310122cc72exeexeexe_JC.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RMS Agent\69105\699DE852C7\rfusclient.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\69105\699DE852C7\rfusclient.exe" -run_agent2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RMS Agent\69105\699DE852C7\rutserv.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\69105\699DE852C7\rutserv.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\RMS Agent\69105\699DE852C7\rutserv.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\69105\699DE852C7\rutserv.exe" -second4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RMS Agent\69105\699DE852C7\rfusclient.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\69105\699DE852C7\rfusclient.exe" /tray /user5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD5c3d7db3461db0dbb8a1d2a937b1d6252
SHA135fafe6c6812f20454c709b0a43a21bf7e9f66bf
SHA256cf8e39ce145e36d672cb2a140b3f33e0a1337975d7840e1d6a1920ce560bba46
SHA5129759895e5d4f289e6227f65f46b24ad7f2607443bebd9b039f1cf42bd74c986a597d5de4bef70510c4463874a01695ca2f7ccbd231d6ef5316250d7492c48675
-
Filesize
58KB
MD5246286feb0ed55eaf4251e256d2fe47e
SHA1bc76b013918e4c1bd6dff44708a760496d8c717c
SHA25664c70065830cc623be55c73a940aa3da57c134ee459afbd983ff17960dc57c27
SHA512900e670259fb3b5762c0242236ce86fcdd04300407fc4d79959edfed99bbec58b4e10048a2b9ef54e709d00717870bf09c7b5fb2f5fa3cfe844682d2bb36f12f
-
Filesize
58KB
MD5246286feb0ed55eaf4251e256d2fe47e
SHA1bc76b013918e4c1bd6dff44708a760496d8c717c
SHA25664c70065830cc623be55c73a940aa3da57c134ee459afbd983ff17960dc57c27
SHA512900e670259fb3b5762c0242236ce86fcdd04300407fc4d79959edfed99bbec58b4e10048a2b9ef54e709d00717870bf09c7b5fb2f5fa3cfe844682d2bb36f12f
-
Filesize
64KB
MD5ff01d823419a6c243257aedfba479030
SHA100d307827b42c4ca7180c52f2f79000bfc274cd3
SHA256b4fb1ae9896834dae6f20a1d79ca07ce0d6096eff589e2b48f1a5464995e96c1
SHA512768c5dc72ed3700795fc985f1ebe60906d738471b35aadfc542994d960ff3f4fe7d35b3ebd7134dc3e0e35d8e10ebec4c0f7a382c3741ef87de5783766ad7c6a
-
Filesize
64KB
MD5ff01d823419a6c243257aedfba479030
SHA100d307827b42c4ca7180c52f2f79000bfc274cd3
SHA256b4fb1ae9896834dae6f20a1d79ca07ce0d6096eff589e2b48f1a5464995e96c1
SHA512768c5dc72ed3700795fc985f1ebe60906d738471b35aadfc542994d960ff3f4fe7d35b3ebd7134dc3e0e35d8e10ebec4c0f7a382c3741ef87de5783766ad7c6a
-
Filesize
424B
MD5c15a34733ee9fda863f29b7fecb644b5
SHA16bac89ceea9cbc8853acfc591c12b8f955797760
SHA25613d219b400a096de5fc6eef8bd00be1c9c934819bee64efde4d87fa7458d7762
SHA512e9095137c130056ac444e137ef7e3daca2097850f87e3c7a5a6103993be9658d850488ea3223a91eac8ef7e901d289c28d078dcbadbda75957366513f93a0012
-
Filesize
424B
MD5c15a34733ee9fda863f29b7fecb644b5
SHA16bac89ceea9cbc8853acfc591c12b8f955797760
SHA25613d219b400a096de5fc6eef8bd00be1c9c934819bee64efde4d87fa7458d7762
SHA512e9095137c130056ac444e137ef7e3daca2097850f87e3c7a5a6103993be9658d850488ea3223a91eac8ef7e901d289c28d078dcbadbda75957366513f93a0012
-
Filesize
1.3MB
MD54cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA51246cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb
-
Filesize
1.3MB
MD54cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA51246cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb
-
Filesize
1.3MB
MD54cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA51246cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb
-
Filesize
1.3MB
MD54cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA51246cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb
-
Filesize
19KB
MD503baf00347abc3f74b729f93e2058a9f
SHA166d44177346c2e29e0ab88a03685a460b0f8ad17
SHA25616cd765dab99345a23b49f20014a9e722462945be6cac1066e4e4e9d4a1ebb81
SHA5120fbde857aa34e9e2dfb0f088e18b9ef6db6edb0ffdd9f09c197c9df51aa99a1c28d5d527adcdc47bf39b9322bd03cc9ed2f24bdfd006a61b0dee13f10c1c5975
-
Filesize
19KB
MD503baf00347abc3f74b729f93e2058a9f
SHA166d44177346c2e29e0ab88a03685a460b0f8ad17
SHA25616cd765dab99345a23b49f20014a9e722462945be6cac1066e4e4e9d4a1ebb81
SHA5120fbde857aa34e9e2dfb0f088e18b9ef6db6edb0ffdd9f09c197c9df51aa99a1c28d5d527adcdc47bf39b9322bd03cc9ed2f24bdfd006a61b0dee13f10c1c5975
-
Filesize
6.3MB
MD5cc0e82ce66ebf0f5fd7fe222731aa7d6
SHA1e8e33ff4e0c6768add1ebb8faee3ac86351a20c5
SHA256d284ddda27eb89d873286e8d72e6613ee01c9c799d6532733a81c383143242ec
SHA512374ac7a867a7f646570eea65198675ce946b54904dc8262f479009c2cf732ecb3fb20b3bfc61a80f4bda9bdda24d76c76423a345da33cc9c0206b33bb7013637
-
Filesize
6.3MB
MD5cc0e82ce66ebf0f5fd7fe222731aa7d6
SHA1e8e33ff4e0c6768add1ebb8faee3ac86351a20c5
SHA256d284ddda27eb89d873286e8d72e6613ee01c9c799d6532733a81c383143242ec
SHA512374ac7a867a7f646570eea65198675ce946b54904dc8262f479009c2cf732ecb3fb20b3bfc61a80f4bda9bdda24d76c76423a345da33cc9c0206b33bb7013637
-
Filesize
6.3MB
MD5cc0e82ce66ebf0f5fd7fe222731aa7d6
SHA1e8e33ff4e0c6768add1ebb8faee3ac86351a20c5
SHA256d284ddda27eb89d873286e8d72e6613ee01c9c799d6532733a81c383143242ec
SHA512374ac7a867a7f646570eea65198675ce946b54904dc8262f479009c2cf732ecb3fb20b3bfc61a80f4bda9bdda24d76c76423a345da33cc9c0206b33bb7013637
-
Filesize
6.3MB
MD5cc0e82ce66ebf0f5fd7fe222731aa7d6
SHA1e8e33ff4e0c6768add1ebb8faee3ac86351a20c5
SHA256d284ddda27eb89d873286e8d72e6613ee01c9c799d6532733a81c383143242ec
SHA512374ac7a867a7f646570eea65198675ce946b54904dc8262f479009c2cf732ecb3fb20b3bfc61a80f4bda9bdda24d76c76423a345da33cc9c0206b33bb7013637
-
Filesize
12.5MB
MD5c13556a6c7ea9539becff13e11c22586
SHA1c4780408f3ea282d66ed1cfec12e3b4326e94664
SHA256d811dd3978dc7ef94aaf7256c342a56c1b39627332a559d900c3ea4879fd0cbd
SHA51290c883907cddb077bfa07119bdfcdd5bf40298bcdadf787d85e3ed7edd9473b5da7c256c403d79d9b4ec3396fba4183cd9270cabf74e1d94bb9759b8d48144a3
-
Filesize
12.5MB
MD5c13556a6c7ea9539becff13e11c22586
SHA1c4780408f3ea282d66ed1cfec12e3b4326e94664
SHA256d811dd3978dc7ef94aaf7256c342a56c1b39627332a559d900c3ea4879fd0cbd
SHA51290c883907cddb077bfa07119bdfcdd5bf40298bcdadf787d85e3ed7edd9473b5da7c256c403d79d9b4ec3396fba4183cd9270cabf74e1d94bb9759b8d48144a3
-
Filesize
12.5MB
MD5c13556a6c7ea9539becff13e11c22586
SHA1c4780408f3ea282d66ed1cfec12e3b4326e94664
SHA256d811dd3978dc7ef94aaf7256c342a56c1b39627332a559d900c3ea4879fd0cbd
SHA51290c883907cddb077bfa07119bdfcdd5bf40298bcdadf787d85e3ed7edd9473b5da7c256c403d79d9b4ec3396fba4183cd9270cabf74e1d94bb9759b8d48144a3
-
Filesize
12.5MB
MD5c13556a6c7ea9539becff13e11c22586
SHA1c4780408f3ea282d66ed1cfec12e3b4326e94664
SHA256d811dd3978dc7ef94aaf7256c342a56c1b39627332a559d900c3ea4879fd0cbd
SHA51290c883907cddb077bfa07119bdfcdd5bf40298bcdadf787d85e3ed7edd9473b5da7c256c403d79d9b4ec3396fba4183cd9270cabf74e1d94bb9759b8d48144a3
-
Filesize
1KB
MD521c00d0d153fe3926feb34a37b46cd2e
SHA1b3e51cd8a5aa456ee92d095cec48ebd58bbd1ae9
SHA25642b819c121cebec6160ac5b13ffb8cddd63d1d1f43a8abaa3878062fd2b130ab
SHA5123e1732dedc97385babd1de5b950f59a8ce91f1cd83a568c6171e510dd271f6546fa7d84128c96bccbade40c9c8f0d2870a1aa0df6837a4432accff3f731ad66a
-
Filesize
1KB
MD521c00d0d153fe3926feb34a37b46cd2e
SHA1b3e51cd8a5aa456ee92d095cec48ebd58bbd1ae9
SHA25642b819c121cebec6160ac5b13ffb8cddd63d1d1f43a8abaa3878062fd2b130ab
SHA5123e1732dedc97385babd1de5b950f59a8ce91f1cd83a568c6171e510dd271f6546fa7d84128c96bccbade40c9c8f0d2870a1aa0df6837a4432accff3f731ad66a
-
Filesize
337KB
MD55c268ca919854fc22d85f916d102ee7f
SHA10957cf86e0334673eb45945985b5c033b412be0e
SHA2561f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA51276d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310
-
Filesize
337KB
MD55c268ca919854fc22d85f916d102ee7f
SHA10957cf86e0334673eb45945985b5c033b412be0e
SHA2561f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA51276d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310
-
Filesize
337KB
MD55c268ca919854fc22d85f916d102ee7f
SHA10957cf86e0334673eb45945985b5c033b412be0e
SHA2561f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA51276d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310
-
Filesize
337KB
MD55c268ca919854fc22d85f916d102ee7f
SHA10957cf86e0334673eb45945985b5c033b412be0e
SHA2561f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA51276d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310
-
Filesize
380KB
MD51ea62293ac757a0c2b64e632f30db636
SHA18c8ac6f8f28f432a514c3a43ea50c90daf66bfba
SHA256970cb3e00fa68daec266cd0aa6149d3604cb696853772f20ad67555a2114d5df
SHA512857872a260cd590bd533b5d72e6e830bb0e4e037cb6749bb7d6e1239297f21606cdbe4a0fb1492cdead6f46c88dd9eb6fab5c6e17029f7df5231cefc21fa35ab
-
Filesize
380KB
MD51ea62293ac757a0c2b64e632f30db636
SHA18c8ac6f8f28f432a514c3a43ea50c90daf66bfba
SHA256970cb3e00fa68daec266cd0aa6149d3604cb696853772f20ad67555a2114d5df
SHA512857872a260cd590bd533b5d72e6e830bb0e4e037cb6749bb7d6e1239297f21606cdbe4a0fb1492cdead6f46c88dd9eb6fab5c6e17029f7df5231cefc21fa35ab
-
Filesize
1.6MB
MD589770647609ac26c1bbd9cf6ed50954e
SHA1349eed120070bab7e96272697b39e786423ac1d3
SHA2567b4fc8e104914cdd6a7bf3f05c0d7197cfcd30a741cc0856155f2c74e62005a4
SHA512a98688f1c80ca79ee8d15d680a61420ffb49f55607fa25711925735d0e8dbc21f3b13d470f22e0829c72a66a798eee163411b2f078113ad8153eed98ef37a2cc
-
Filesize
1.6MB
MD589770647609ac26c1bbd9cf6ed50954e
SHA1349eed120070bab7e96272697b39e786423ac1d3
SHA2567b4fc8e104914cdd6a7bf3f05c0d7197cfcd30a741cc0856155f2c74e62005a4
SHA512a98688f1c80ca79ee8d15d680a61420ffb49f55607fa25711925735d0e8dbc21f3b13d470f22e0829c72a66a798eee163411b2f078113ad8153eed98ef37a2cc
-
Filesize
260KB
MD5d29f7070ee379544aeb19913621c88e6
SHA1499dcdb39862fd8ff5cbc4b13da9c465bfd5f4be
SHA256654f43108fbd56bd2a3c5a3a74a2ff3f19ea9e670613b92a624e86747a496caf
SHA5124ead1c8e0d33f2a6c35163c42e8f0630954de67e63bcadca003691635ccf8bfe709363ec88edb387b956535fdb476bc0b5773ede5b19cacf4858fb50072bbef5
-
Filesize
260KB
MD5d29f7070ee379544aeb19913621c88e6
SHA1499dcdb39862fd8ff5cbc4b13da9c465bfd5f4be
SHA256654f43108fbd56bd2a3c5a3a74a2ff3f19ea9e670613b92a624e86747a496caf
SHA5124ead1c8e0d33f2a6c35163c42e8f0630954de67e63bcadca003691635ccf8bfe709363ec88edb387b956535fdb476bc0b5773ede5b19cacf4858fb50072bbef5
-
Filesize
365KB
MD57a9eeac3ceaf7f95f44eb5c57b4db2e3
SHA1be1048c254aa3114358f76d08c55667c4bf2d382
SHA256b497d07ed995b16d1146209158d3b90d85c47a643fbf25a5158b26d75c478c88
SHA512b68fa132c3588637d62a1c2bce8f8acc78e6e2f904a53644d732dc0f4e4fbc61a2829a1ac8f6b97fe4be4f3613ef92c43e6f2ab29c6abd968acc5acd635c990d
-
Filesize
365KB
MD57a9eeac3ceaf7f95f44eb5c57b4db2e3
SHA1be1048c254aa3114358f76d08c55667c4bf2d382
SHA256b497d07ed995b16d1146209158d3b90d85c47a643fbf25a5158b26d75c478c88
SHA512b68fa132c3588637d62a1c2bce8f8acc78e6e2f904a53644d732dc0f4e4fbc61a2829a1ac8f6b97fe4be4f3613ef92c43e6f2ab29c6abd968acc5acd635c990d
-
Filesize
860KB
MD55308b9945e348fbe3a480be06885434c
SHA15c3cb39686cca3e9586e4b405fc8e1853caaf8ff
SHA2569dc30fb2118aad48f6a5e0a82504f365fe40abb3134f6cceeb65859f61ad939a
SHA5124d7f08dc738a944bcee9b013b13d595e9c913b248c42a6c095cbdfc6059da7f04cca935841ff8a43687b75bdc5af05e888241e52ef594aa752ba9425cf966412
-
Filesize
860KB
MD55308b9945e348fbe3a480be06885434c
SHA15c3cb39686cca3e9586e4b405fc8e1853caaf8ff
SHA2569dc30fb2118aad48f6a5e0a82504f365fe40abb3134f6cceeb65859f61ad939a
SHA5124d7f08dc738a944bcee9b013b13d595e9c913b248c42a6c095cbdfc6059da7f04cca935841ff8a43687b75bdc5af05e888241e52ef594aa752ba9425cf966412
-
Filesize
13.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
24.3MB
-
Filesize
24.3MB
-
Filesize
4KB
-
Filesize
6.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
13.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
13.1MB
-
Filesize
4KB
-
Filesize
13.1MB
-
Filesize
13.1MB
-
Filesize
4KB
-
Filesize
13.1MB
-
Filesize
13.1MB
-
Filesize
13.1MB
-
Filesize
13.1MB
-
Filesize
13.1MB
-
Filesize
13.1MB
-
Filesize
13.1MB
-
Filesize
13.1MB
-
Filesize
13.1MB
-
Filesize
13.1MB
-
Filesize
6.8MB
-
Filesize
6.8MB
-
Filesize
6.8MB
-
Filesize
6.8MB
-
Filesize
6.8MB
-
Filesize
6.8MB
-
Filesize
4KB
-
Filesize
4KB
