Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
18-12-2023 09:27
General
-
Target
rms.host6.3ru.msi
-
Size
7.6MB
-
MD5
4dc446d219e73f5218ad16b0f2c633d4
-
SHA1
0a4e6de0272180db99a6ad04a74da2ba129ea873
-
SHA256
fb48076d93e8705240d11e770cb928e79c4514cc4336e17bc845af33fedeb810
-
SHA512
8768ba91e9ff5f0b8dbab1977876d1058824d2f07b58184fcab8a76c60db210b459bd32a04e038a6fec8946c5021eef214c90289ca1af94a27069365311cc9b4
-
SSDEEP
196608:vw5w5SwnqgSGGmDW7dgf/668YsAtDyL4:4GwwnqLiDU+fS2
Malware Config
Signatures
-
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 9 IoCs
-
Loads dropped DLL 1 IoCs
-
Blocklisted process makes network request 4 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 3 IoCs
-
Drops file in Program Files directory 56 IoCs
-
Drops file in Windows directory 18 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 24 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious behavior: SetClipboardViewer 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 10 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 29 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\rms.host6.3ru.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 080C360BE8F37067FAB3F93DDC0E337E C2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /CONFIG /SETSECURITY2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /config3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5b02329fa9baeb330049027302528dd1f
SHA1691cf84b2b5e3c85c88a41a2d9d1eb210bae951f
SHA25603cd3e6485cbdba4b2aa59dcceb67250d91da5f0bad2005a9b6cd413de3a4ad3
SHA5122ca39a852cf7c78a86f40704b48eedc2bede038f0adaf67ce484037989c52ab891e9206db17143f102a7bb034efcc80fb91b1a37839f604d0b371586f20628d5
-
Filesize
43KB
MD5bc25377ade68750b834c81fa71c233b8
SHA184dbb465dd2125f47668e2508e18af9bd6db2fd8
SHA2569a48a7ea7ba2c2f33280d1e1722ebbc59bf81bc6c5a1f97edca53ea641ffd8e3
SHA512205ab195339d7108adbe6dfabd48e4e21c5956ded587d7213a44618f0d34a43f7b8abaa7765b9d31695efacfc44beeb69fbaa3cb27c141b6a653713fdf5ebce5
-
Filesize
144KB
MD5500b5d9c3c0ff50c9bafdccb8ee049bc
SHA1fce3d53df1dff631e69af83420b4bf8b1c632972
SHA256c0a5b0f80e85c2e2078feca245bfc78518988b059ea711f65b5060d4f3471838
SHA512a624bfd524d44365a583a1ea860fcbde4188a3731e026ba23a3118857461bf8298e90ef51a23f438f9241cc5a2c5c472f47c75c8e312eb68664680c9feefbfb9
-
Filesize
976KB
MD5eba6316a7d073079954d638b335d9165
SHA14b75e9ae790f51077850b1da60136a182fc06425
SHA25600e0bffd66abca71e488aa52d2672fd90d17eb25a162e3f7af46856faed2e742
SHA51265159606e8f771edf6fb56efa6c660a173456662e8d0e92bbefde765666be685766dd9e7aa8cf8f4c0a0de741392be6a711bee9f215042d715af85bcbe4f2f6a
-
Filesize
48KB
MD5e44e34bc285b709f08f967325d9c8be1
SHA1e73f05c6a980ec9d006930c5343955f89579b409
SHA2561d99a7b5f7b3daa61fa773972b1e335aa09b92411484f6ddc99d2b2894455a5b
SHA512576b292b6e9cf022822443e050994462a6cbd9a3c60063bae9f54c78a84e75e17bb5eddf7e259a22a9d93f757cb6536c503762e2a30e75091e40c2756cde8727
-
Filesize
2.5MB
MD56a5588bc2aa3707d9aceeaf414d3dc27
SHA17441b755d33f1c6e38770b73aa650d7c350a30c5
SHA256d52e3c98865d1854d4fa652dd41ca52709926beb6401657b55d846b7c9783d24
SHA512ff46dccf1ee83c1b53ee2d8da76c678e360057f00f23797862ba8ccdbf4fcb5b12f8fb1caafa8fe827d23b9dfad9d22d0105ddfd288b95b9ac0a9adcdd6a7cdf
-
Filesize
4.0MB
MD5b6a9e3735f52a4ae2fe06cfc5df2f5fb
SHA1c82283b84bfc368f061e959d343e59ae77896e4f
SHA2562d0d25bbddbaf95d44f09d7263733286f7794d734f35e3e3d8f693180b95ec44
SHA5125282b55ef5852c66e3919164eb6af171a41c62fffdb4af878b8b16ad754f319fdcdf37aec0209e3ddd24164e173d08cc375db32c87e5d4071a18da33f8a49e30
-
Filesize
5.1MB
MD5e3c15e4d44c2b546d640b5808a9a2818
SHA1090f6f75558614f19b970df39ebe1a87185f5a0c
SHA256b6daf91fc45307fff001a61b9402ad19bd59dd72541427d39207991be6679219
SHA512c5864116e95533d599ab8ee9a36b71ea38275fcc5e076489116cc1caea31fdd0c81cf2b5ea43e244ee38a92099e0388a042c7604f1deb2e4c6caf29a3314a494
-
Filesize
6.0MB
MD58f6e38cc55206473121c8bf63fcbcf2d
SHA135504ce4bc1cea9e737a3be108cd428ab2251e1d
SHA256fa1d176073d43c82ffe25b20401efddb018317cdd468d160d90c950641cdad57
SHA512083e795d1668277428d5fa89fcc136a13f411483457403fdbba0df557b45360ea24d5ac7b45ae74b10f01adde22ad8ac2563d9c088f42c14b61e85a664815ab9
-
Filesize
768KB
MD53fb278f38e79542984eeba237fb2ba87
SHA1aabfca7387228a6a792240c374eb2e39bdb51277
SHA256e08c6a84d5f00ef09d52adab320f7df9f678a8f3822f597cbec6c09619825b61
SHA51216389c48a2a188292540e525f727a4aecb66cf3a74bdc20cb8138deab4914b39b411bfe008882088e27828f7bed5bcb3c145d8d98bd93cdc7e168732ffc1ad97
-
Filesize
2.7MB
MD51d34696f2d2c33cd11a8622f1456a792
SHA1570bc33b50e7726c1153ef9f8fcc3a28f18c2349
SHA256e9ab3cc0526a347035a93e99251ccaaa542b30fc8dd3fb1806417501489e5c12
SHA512d90bdc19c85b99f97ffbdfb76e30292878b70bd9e0ce30936c10667610e8f752cdd78b090ad9ce7f8133486fe2ede5e2f915f58b734f555610543ae9245cbb92
-
Filesize
320KB
MD531ceae32b3c71dbd1361103347285424
SHA12c6846a2f208d3c4a6eae11baa61f94a17cec7b7
SHA256dd7870429393258b0d37565d9f1a55bc7de5cb18dd92b39166d89a65c3723571
SHA51231c1cb5d11451b58dcb040228444de0f4bd3a20aafd42da321768e96372204dd24602ab3fb07b8d8ce9462d1a13fce6acf69d4a62692d55ff053daaa24468d99
-
Filesize
5.3MB
MD566de2866bfbfb6490196d3c7e92cc234
SHA1c15cf341ff2e58b6f8409fc753c8beba192ed8a0
SHA2566cc34f8aaeba871fc6bbfafd2b99d1c60f8f5e37c3ff8076ffd43145682e45fd
SHA5122794833ff3a0eb707ae8b156fafd9149e75a65699960820b3add877293fe3573f2d27695f09e6cc09ed47fe9c92159f934ff696a999a7d548445582831935336
-
Filesize
378KB
MD5d43fa82fab5337ce20ad14650085c5d9
SHA1678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d
-
Filesize
1.6MB
MD5dab4646806dfca6d0e0b4d80fa9209d6
SHA18244dfe22ec2090eee89dad103e6b2002059d16a
SHA256cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7
-
Filesize
258KB
MD59581f7064028a782182e8a4411e9afa5
SHA19356d9f62fc38a1150c3cad556b2a531cd7d430b
SHA256320a23db8d34bd2628078903d4496d4b9320d50c13d11283f77a8c3b9ec36698
SHA51201c5a711bd0d7cea5cae906c163b7a98c3b09b8ce5a5b52f096d806e20d7f28fe3e174eb6ba8ff630b870b1cea3d9d72905227a989d70e312d79b55644e6442c
-
Filesize
363KB
MD5ec59d88c3ebda7c2ce36dcdbe4c67e5b
SHA18b01a5730ebda5729a57d97abec1de00c7cf0218
SHA25654b661f2d55f5cafccd7aca334efb89e908b3f19e3e35c9aa661221b31ec60e3
SHA51246963b390affcb1f6e5d42ae4f4a67a453d9048e8f8b825bb543a1c2031f1ece07d2f295d30eff51a6624bf096e0d10f8ba8d6516b28e63926f214eb7d7e5b84
-
Filesize
858KB
MD512eba58e4c0450ccb2d9fdce22255d09
SHA11f88ce0834e0bcf0f61ed0557204ef05dd577b1e
SHA256c80464f71b46411b01962b6095acd6eb2ed09ad8d6eb0a67840826a6297823b2
SHA51208f999aeb55968de3dacb560a25174e5a1c29eb2ea95a6fc8f770c10369263e2f8cea525f93c89a0e03954ff1221b4486641fc9a892d53a8857e9cf441ec05d4
-
Filesize
5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
Filesize
604B
MD5a8c8eb8bf71ea727e35148b09b26fec7
SHA1f4ab4a15766b9d1e7253ecbb20973af8affbdb7c
SHA25621c9949032173647ca9cd7fd03822577e2eaeefa0954974f9dd8a9d7ed4c0e13
SHA512dc04414bf8dd78dafef8d5582ced4c8ab9e466354c03ddaa3014c1400934692a4dbabbf6200616e5364b4a69ce4192f283852a126c1e938a1705cd005d0c6d55
-
Filesize
1KB
MD56d693ab6367aa9972f1b610f303b5583
SHA1a35b0d21048534e781ff2636134b668ec05fa9ff
SHA256939fa9d9098d2399260dc1c90bcd7092f6359383a7e3a39a11abcdd3cac81b72
SHA512eb0d6ffa0e6471c7a515ad78e220926b9f05ee73f54ba85e959c1e5fb1e933df6ac574ae553b6cf97ad916677845b8b26eaab6bf9acdb33ce5a998af187164eb
-
Filesize
394B
MD58e8765e9439f6802a026542af91e9fac
SHA13a7b6b767d64dd3aee390ac2d38b09fad0c9bf2d
SHA25665553d1aa540cc7ea808ed044bc8f0ccf06ee8acc9534dbeaa24d604cd3eef59
SHA5129ef4a04d287999cb39022a185197d5955fb4d83fe879a39286b4f45d082f784f8d11e45489a95266aa7a6e1c2c33441d794549b0979aabff1121b8ce0f55d965
-
Filesize
184B
MD5ba6c986832b9da28bfdf3cfd60801234
SHA13d4a53618660f4fc4d0dec626e70ac30a708842f
SHA256f1a8926e398e4990a0a48f20c4f1c7efe79653c6fbf2f853f676b13af0b13cf5
SHA5120ba16679117053eb90528a95a6292935f473f495cf5efca60870496a5e55a9d8e28253d9088f012c4456eb4715885297e7b9b6c7831689151a37696c2865326d
-
Filesize
402B
MD50c423c47275df5e03fb0554c34962ff3
SHA1e683e9e9178113a1f15c4a0eafd342189a5f15c3
SHA2564e9795ae290c52c6352ce443a0c4c1a17e23d2dd835d48deb2015b05831ed708
SHA51238caa8fd45fbf9883224419708ab961a456bef14d03ad8ab29ccfcbcc0f4934f5dbfacd0be12335d9054d85a0c0fe205cd9375414bd70bd51bc702a9d86105a6
-
Filesize
125KB
MD5b0bcc622f1fff0eec99e487fa1a4ddd9
SHA149aa392454bd5869fa23794196aedc38e8eea6f5
SHA256b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
SHA5121572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7
-
Filesize
3.9MB
MD5753f540612e86c3690ac7395d7701b15
SHA1031b017906fe52ccc17e8dae07bfe5ad7c3c4d87
SHA25663a6fede6a328ca95e56c0fb87c531fc18e2972cc215a15572e2a591ba6f9e3d
SHA51201010da7ec90bfaafa8b00c059bf1c967f8f7ecaf518a93f211ebb5ae3920ba9ae44d8f19b9545c76448df50185983df1d91c07ec6d708e1ad3f421ecba36db0
-
Filesize
96KB
MD59e2c097647125ee25068784acb01d7d3
SHA11a90c40c7f89eec18f47f0dae3f1d5cd3a3d49b5
SHA256b4614281771ed482970fd0d091604b3a65c7e048f7d7fa8794abd0a0c638f5d2
SHA512e2f334f31361ea1ffc206184808cb51002486fe583dc23b4f617bead0e3940fdc97b72cda2a971e2cf00462940b31e065228f643835d156e7166e8803e3181f1
-
Filesize
19.5MB
MD595951ba77b7d232f99b3be52f0baca4e
SHA1e3a3628147bb073b3ee4b41dcfb308d1e05251bc
SHA25667b27a29fb23b0f012a819496e9215f8dd786a80310e98994abbe501453f012e
SHA512a59328dbea8b6451d2345b3cb9cdef01bc79186091d3636ecdf641864ec0f43a2e3438fcc444c4bfca703db97bb31f2800da4ba58afd45dde13fe201e04460fb
-
Filesize
6KB
MD5f30ca9960663761608b3950d3f1575ae
SHA14c56d81ee3f3810775c37001a9165cbb0924a6a9
SHA2564587b62ac42a224c0ce3eb1755e4d76932611d8f8779ee633136059c491cf945
SHA512e96d05e5d3443d74fad55bccc8f894941c610173dfc7782a2fb12c68ca79cf64a1f01ca02dff7ce1be3f5798c8a8560f215869fa95d392c152f9d3d8ab41793a
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
6.6MB
-
Filesize
4KB