Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
01-12-2023 15:19
General
-
Target
42747eef2ec5138ff1c51ecaf86e0cc8e43e651c3de264aa73eb43d6f547d098.exe
-
Size
16.2MB
-
MD5
5b1242f60d18e7bfc2f5f5a0b6737396
-
SHA1
46b6946732de7232ea3d2db96cb7e2a4d7538334
-
SHA256
42747eef2ec5138ff1c51ecaf86e0cc8e43e651c3de264aa73eb43d6f547d098
-
SHA512
65e2d1e75d12143eb89b8466da57d0d5ba1c26fabc96f15c42689c708efa44576b8a4f0cdc8fccc69c207b12d4b68cd9fc1a82c2e2ce1b3a2d6b753b721ce81f
-
SSDEEP
393216:Jk4KGkr17htS1jqRnsQQ0suas3DLO4s99H36CyLTVtRxLgU:Jk1Gy/tS1wnsQQvsTi4e9XAjxLn
Malware Config
Signatures
-
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 9 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\42747eef2ec5138ff1c51ecaf86e0cc8e43e651c3de264aa73eb43d6f547d098.exe"C:\Users\Admin\AppData\Local\Temp\42747eef2ec5138ff1c51ecaf86e0cc8e43e651c3de264aa73eb43d6f547d098.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RMS Agent\70020\4F1E026B04\rfusclient.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\70020\4F1E026B04\rfusclient.exe" -run_agent2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RMS Agent\70020\4F1E026B04\rutserv.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\70020\4F1E026B04\rutserv.exe" -run_agent3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\RMS Agent\70020\4F1E026B04\rutserv.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\70020\4F1E026B04\rutserv.exe" -run_agent -second4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RMS Agent\70020\4F1E026B04\rfusclient.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\70020\4F1E026B04\rfusclient.exe" /tray /user5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD57fd09e69fa62629a04d1e23bb8ca5ff6
SHA13952c5f339c8bbdf17aff113bcb0149ac8ce4fa6
SHA256f9c56736029b7d278bf8fabc6e0f5bdac67e24b088f2172ea07df2baa3072c19
SHA512e66d523eb5bdfc517749b608ffcd66b883be9c4b8c5c42dbf7e48fe412a5c0ca0876d0dbc8a68355e7bb532ce8749c5e444a25f996b4c27e382e79579ab2b59a
-
Filesize
51KB
MD54e84df6558c385bc781cddea34c9fba3
SHA16d63d87c19c11bdbfa484a5835ffffd7647296c8
SHA2560526073f28a3b5999528bfa0e680d668922499124f783f02c52a3b25c367ef6d
SHA512c35da0744568bfffeff09e6590d059e91e5d380c5feb3a0fbc5b19477ceca007a882884a7033345ce408fce1deac5248ad9b046656478d734fe494b787f8a9f2
-
Filesize
51KB
MD54e84df6558c385bc781cddea34c9fba3
SHA16d63d87c19c11bdbfa484a5835ffffd7647296c8
SHA2560526073f28a3b5999528bfa0e680d668922499124f783f02c52a3b25c367ef6d
SHA512c35da0744568bfffeff09e6590d059e91e5d380c5feb3a0fbc5b19477ceca007a882884a7033345ce408fce1deac5248ad9b046656478d734fe494b787f8a9f2
-
Filesize
1.3MB
MD5f8fbc228c3139532971f66881262b940
SHA1f1655c3b836c764fdc0bb07661c3ef70a9f51318
SHA256e2fad24a7cdbf526d25be68a83a213c05efba1a499bffed5d5a4ade50513c604
SHA512cc036991f454255010fd1618feba34e3a1e23a941fa2aa6f76046faaddf6531918cb3e982bfac3db2ea1c1a1182994d4acfc8c15d6b4d58fdd4f7ea989bbb673
-
Filesize
1.3MB
MD5f8fbc228c3139532971f66881262b940
SHA1f1655c3b836c764fdc0bb07661c3ef70a9f51318
SHA256e2fad24a7cdbf526d25be68a83a213c05efba1a499bffed5d5a4ade50513c604
SHA512cc036991f454255010fd1618feba34e3a1e23a941fa2aa6f76046faaddf6531918cb3e982bfac3db2ea1c1a1182994d4acfc8c15d6b4d58fdd4f7ea989bbb673
-
Filesize
11.1MB
MD50bde36e64c97bc8c2cb02aa05249fe28
SHA17939e68abddb44f1d91acb2694e3c56ef85371eb
SHA2566db6819580c157fcc718bbb969163a6b5fdf69225f64a99ac89e269146de9f8d
SHA5122d298be21519cc07ea4051a4aac07546d82194cd459643c83d2e60258f24859e635be2820cad3c59398521c1fd561a958ce3920b77b93d9ebe7b01f382b9ff7d
-
Filesize
11.1MB
MD50bde36e64c97bc8c2cb02aa05249fe28
SHA17939e68abddb44f1d91acb2694e3c56ef85371eb
SHA2566db6819580c157fcc718bbb969163a6b5fdf69225f64a99ac89e269146de9f8d
SHA5122d298be21519cc07ea4051a4aac07546d82194cd459643c83d2e60258f24859e635be2820cad3c59398521c1fd561a958ce3920b77b93d9ebe7b01f382b9ff7d
-
Filesize
11.1MB
MD50bde36e64c97bc8c2cb02aa05249fe28
SHA17939e68abddb44f1d91acb2694e3c56ef85371eb
SHA2566db6819580c157fcc718bbb969163a6b5fdf69225f64a99ac89e269146de9f8d
SHA5122d298be21519cc07ea4051a4aac07546d82194cd459643c83d2e60258f24859e635be2820cad3c59398521c1fd561a958ce3920b77b93d9ebe7b01f382b9ff7d
-
Filesize
11.1MB
MD50bde36e64c97bc8c2cb02aa05249fe28
SHA17939e68abddb44f1d91acb2694e3c56ef85371eb
SHA2566db6819580c157fcc718bbb969163a6b5fdf69225f64a99ac89e269146de9f8d
SHA5122d298be21519cc07ea4051a4aac07546d82194cd459643c83d2e60258f24859e635be2820cad3c59398521c1fd561a958ce3920b77b93d9ebe7b01f382b9ff7d
-
Filesize
18.0MB
MD5a4ebaae03c33f847be0938570445aeaa
SHA18665c2c26924e3fe70c39a2b8513d7f076dba10b
SHA256423c1eea0ed0ae5500ddee763b020478e6abc215361277564af52fed2f0562a8
SHA512e701bf3dabd53e4219c043503eba93f7e3b67cfa4efbd3dcce3a7e8b8b5340e18fc3877341545d7beff879374dbc9a1aeec9039e8331b9f93665db963c88f711
-
Filesize
18.0MB
MD5a4ebaae03c33f847be0938570445aeaa
SHA18665c2c26924e3fe70c39a2b8513d7f076dba10b
SHA256423c1eea0ed0ae5500ddee763b020478e6abc215361277564af52fed2f0562a8
SHA512e701bf3dabd53e4219c043503eba93f7e3b67cfa4efbd3dcce3a7e8b8b5340e18fc3877341545d7beff879374dbc9a1aeec9039e8331b9f93665db963c88f711
-
Filesize
18.0MB
MD5a4ebaae03c33f847be0938570445aeaa
SHA18665c2c26924e3fe70c39a2b8513d7f076dba10b
SHA256423c1eea0ed0ae5500ddee763b020478e6abc215361277564af52fed2f0562a8
SHA512e701bf3dabd53e4219c043503eba93f7e3b67cfa4efbd3dcce3a7e8b8b5340e18fc3877341545d7beff879374dbc9a1aeec9039e8331b9f93665db963c88f711
-
Filesize
18.0MB
MD5a4ebaae03c33f847be0938570445aeaa
SHA18665c2c26924e3fe70c39a2b8513d7f076dba10b
SHA256423c1eea0ed0ae5500ddee763b020478e6abc215361277564af52fed2f0562a8
SHA512e701bf3dabd53e4219c043503eba93f7e3b67cfa4efbd3dcce3a7e8b8b5340e18fc3877341545d7beff879374dbc9a1aeec9039e8331b9f93665db963c88f711
-
Filesize
336KB
MD5fe8cda03e1df3c3a6dc8375263e790c3
SHA167955da301ef89cd0429074e403769721e7594be
SHA2561295a0fd2b2605dee4dada91335a4010a29504be7ab014ea14fe0092fd2160fd
SHA5120353e5314d553ed617ed286d01e981d3a9790d9f5c5fc391f84cb2be06922fe1d68a5d353dee0daabb6408c72ee65aec0d855c7c3a6fc6ca80567babf769bd1f
-
Filesize
336KB
MD5fe8cda03e1df3c3a6dc8375263e790c3
SHA167955da301ef89cd0429074e403769721e7594be
SHA2561295a0fd2b2605dee4dada91335a4010a29504be7ab014ea14fe0092fd2160fd
SHA5120353e5314d553ed617ed286d01e981d3a9790d9f5c5fc391f84cb2be06922fe1d68a5d353dee0daabb6408c72ee65aec0d855c7c3a6fc6ca80567babf769bd1f
-
Filesize
379KB
MD5e247666cdea63da5a95aebc135908207
SHA14642f6c3973c41b7d1c9a73111a26c2d7ac9c392
SHA256b419ed0374e3789b4f83d4af601f796d958e366562a0aaea5d2f81e82abdcf33
SHA51206da11e694d5229783cfb058dcd04d855a1d0758beeaa97bcd886702a1502d0bf542e7890aa8f2e401be36ccf70376b5c091a5d328bb1abe738bc0798ab98a54
-
Filesize
379KB
MD5e247666cdea63da5a95aebc135908207
SHA14642f6c3973c41b7d1c9a73111a26c2d7ac9c392
SHA256b419ed0374e3789b4f83d4af601f796d958e366562a0aaea5d2f81e82abdcf33
SHA51206da11e694d5229783cfb058dcd04d855a1d0758beeaa97bcd886702a1502d0bf542e7890aa8f2e401be36ccf70376b5c091a5d328bb1abe738bc0798ab98a54
-
Filesize
1.6MB
MD5d5c2a6ac30e76b7c9b55adf1fe5c1e4a
SHA13d841eb48d1a32b511611d4b9e6eed71e2c373ee
SHA25611c7004851e6e6624158990dc8abe3aa517bcab708364d469589ad0ca3dba428
SHA5123c1c7fb535e779ac6c0d5aef2d4e9239f1c27136468738a0bd8587f91b99365a38808be31380be98fd74063d266654a6ac2c2e88861a3fe314a95f1296699e1d
-
Filesize
1.6MB
MD5d5c2a6ac30e76b7c9b55adf1fe5c1e4a
SHA13d841eb48d1a32b511611d4b9e6eed71e2c373ee
SHA25611c7004851e6e6624158990dc8abe3aa517bcab708364d469589ad0ca3dba428
SHA5123c1c7fb535e779ac6c0d5aef2d4e9239f1c27136468738a0bd8587f91b99365a38808be31380be98fd74063d266654a6ac2c2e88861a3fe314a95f1296699e1d
-
Filesize
259KB
MD549c51ace274d7db13caa533880869a4a
SHA1b539ed2f1a15e2d4e5c933611d736e0c317b8313
SHA2561d6407d7c7ffd2642ea7f97c86100514e8e44f58ff522475cb42bcc43a1b172b
SHA51213440009e2f63078dce466bf2fe54c60feb6cedeed6e9e6fc592189c50b0780543c936786b7051311089f39e9e3ccb67f705c54781c4cae6d3a8007998befbf6
-
Filesize
259KB
MD549c51ace274d7db13caa533880869a4a
SHA1b539ed2f1a15e2d4e5c933611d736e0c317b8313
SHA2561d6407d7c7ffd2642ea7f97c86100514e8e44f58ff522475cb42bcc43a1b172b
SHA51213440009e2f63078dce466bf2fe54c60feb6cedeed6e9e6fc592189c50b0780543c936786b7051311089f39e9e3ccb67f705c54781c4cae6d3a8007998befbf6
-
Filesize
364KB
MD5eda07083af5b6608cb5b7c305d787842
SHA1d1703c23522d285a3ccdaf7ba2eb837d40608867
SHA256c4683eb09d65d692ca347c0c21f72b086bd2faf733b13234f3a6b28444457d7d
SHA512be5879621d544c4e2c4b0a5db3d93720623e89e841b2982c7f6c99ba58d30167e0dd591a12048ed045f19ec45877aa2ef631b301b903517effa17579c4b7c401
-
Filesize
364KB
MD5eda07083af5b6608cb5b7c305d787842
SHA1d1703c23522d285a3ccdaf7ba2eb837d40608867
SHA256c4683eb09d65d692ca347c0c21f72b086bd2faf733b13234f3a6b28444457d7d
SHA512be5879621d544c4e2c4b0a5db3d93720623e89e841b2982c7f6c99ba58d30167e0dd591a12048ed045f19ec45877aa2ef631b301b903517effa17579c4b7c401
-
Filesize
859KB
MD5642dc7e57f0c962b9db4c8fb346bc5a7
SHA1acee24383b846f7d12521228d69135e5704546f6
SHA25663b4b5db4a96a8abec82b64034f482b433cd4168c960307ac5cc66d2fbf67ede
SHA512fb163a0ce4e3ad0b0a337f5617a7bf59070df05cc433b6463384e8687af3edc197e447609a0d86fe25ba3ee2717fd470f2620a8fc3a2998a7c3b3a40530d0bae
-
Filesize
859KB
MD5642dc7e57f0c962b9db4c8fb346bc5a7
SHA1acee24383b846f7d12521228d69135e5704546f6
SHA25663b4b5db4a96a8abec82b64034f482b433cd4168c960307ac5cc66d2fbf67ede
SHA512fb163a0ce4e3ad0b0a337f5617a7bf59070df05cc433b6463384e8687af3edc197e447609a0d86fe25ba3ee2717fd470f2620a8fc3a2998a7c3b3a40530d0bae
-
Filesize
1.3MB
MD5f8fbc228c3139532971f66881262b940
SHA1f1655c3b836c764fdc0bb07661c3ef70a9f51318
SHA256e2fad24a7cdbf526d25be68a83a213c05efba1a499bffed5d5a4ade50513c604
SHA512cc036991f454255010fd1618feba34e3a1e23a941fa2aa6f76046faaddf6531918cb3e982bfac3db2ea1c1a1182994d4acfc8c15d6b4d58fdd4f7ea989bbb673
-
Filesize
1.3MB
MD5f8fbc228c3139532971f66881262b940
SHA1f1655c3b836c764fdc0bb07661c3ef70a9f51318
SHA256e2fad24a7cdbf526d25be68a83a213c05efba1a499bffed5d5a4ade50513c604
SHA512cc036991f454255010fd1618feba34e3a1e23a941fa2aa6f76046faaddf6531918cb3e982bfac3db2ea1c1a1182994d4acfc8c15d6b4d58fdd4f7ea989bbb673
-
Filesize
11.1MB
MD50bde36e64c97bc8c2cb02aa05249fe28
SHA17939e68abddb44f1d91acb2694e3c56ef85371eb
SHA2566db6819580c157fcc718bbb969163a6b5fdf69225f64a99ac89e269146de9f8d
SHA5122d298be21519cc07ea4051a4aac07546d82194cd459643c83d2e60258f24859e635be2820cad3c59398521c1fd561a958ce3920b77b93d9ebe7b01f382b9ff7d
-
Filesize
18.0MB
MD5a4ebaae03c33f847be0938570445aeaa
SHA18665c2c26924e3fe70c39a2b8513d7f076dba10b
SHA256423c1eea0ed0ae5500ddee763b020478e6abc215361277564af52fed2f0562a8
SHA512e701bf3dabd53e4219c043503eba93f7e3b67cfa4efbd3dcce3a7e8b8b5340e18fc3877341545d7beff879374dbc9a1aeec9039e8331b9f93665db963c88f711
-
Filesize
18.0MB
MD5a4ebaae03c33f847be0938570445aeaa
SHA18665c2c26924e3fe70c39a2b8513d7f076dba10b
SHA256423c1eea0ed0ae5500ddee763b020478e6abc215361277564af52fed2f0562a8
SHA512e701bf3dabd53e4219c043503eba93f7e3b67cfa4efbd3dcce3a7e8b8b5340e18fc3877341545d7beff879374dbc9a1aeec9039e8331b9f93665db963c88f711
-
Filesize
18.0MB
MD5a4ebaae03c33f847be0938570445aeaa
SHA18665c2c26924e3fe70c39a2b8513d7f076dba10b
SHA256423c1eea0ed0ae5500ddee763b020478e6abc215361277564af52fed2f0562a8
SHA512e701bf3dabd53e4219c043503eba93f7e3b67cfa4efbd3dcce3a7e8b8b5340e18fc3877341545d7beff879374dbc9a1aeec9039e8331b9f93665db963c88f711
-
Filesize
18.0MB
MD5a4ebaae03c33f847be0938570445aeaa
SHA18665c2c26924e3fe70c39a2b8513d7f076dba10b
SHA256423c1eea0ed0ae5500ddee763b020478e6abc215361277564af52fed2f0562a8
SHA512e701bf3dabd53e4219c043503eba93f7e3b67cfa4efbd3dcce3a7e8b8b5340e18fc3877341545d7beff879374dbc9a1aeec9039e8331b9f93665db963c88f711
-
Filesize
336KB
MD5fe8cda03e1df3c3a6dc8375263e790c3
SHA167955da301ef89cd0429074e403769721e7594be
SHA2561295a0fd2b2605dee4dada91335a4010a29504be7ab014ea14fe0092fd2160fd
SHA5120353e5314d553ed617ed286d01e981d3a9790d9f5c5fc391f84cb2be06922fe1d68a5d353dee0daabb6408c72ee65aec0d855c7c3a6fc6ca80567babf769bd1f
-
Filesize
336KB
MD5fe8cda03e1df3c3a6dc8375263e790c3
SHA167955da301ef89cd0429074e403769721e7594be
SHA2561295a0fd2b2605dee4dada91335a4010a29504be7ab014ea14fe0092fd2160fd
SHA5120353e5314d553ed617ed286d01e981d3a9790d9f5c5fc391f84cb2be06922fe1d68a5d353dee0daabb6408c72ee65aec0d855c7c3a6fc6ca80567babf769bd1f
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
11.6MB
-
Filesize
4KB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
4KB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
11.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
35.8MB
-
Filesize
35.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
18.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
18.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
18.7MB
-
Filesize
4KB
-
Filesize
18.7MB
-
Filesize
4KB
-
Filesize
18.7MB
-
Filesize
4KB
-
Filesize
18.7MB
-
Filesize
4KB
-
Filesize
18.7MB
-
Filesize
4KB
-
Filesize
18.7MB
-
Filesize
4KB
-
Filesize
18.7MB
-
Filesize
4KB
-
Filesize
18.7MB
-
Filesize
4KB
-
Filesize
18.7MB
-
Filesize
4KB
-
Filesize
18.7MB
-
Filesize
4KB
-
Filesize
18.7MB
-
Filesize
18.7MB
-
Filesize
4KB
-
Filesize
11.6MB