rms | b644b71318ac3f1a5c01249c65bcc490ef7cffe13925c1e8e200eecd91df6c9c

Analysis

max time kernel
147s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78db881af6d41d8ce120db6dfe104f24.exe
Size

2.4MB
MD5

78db881af6d41d8ce120db6dfe104f24
SHA1

1519b9fcc1f17b90a88acbfc089b5d2f76f21bad
SHA256

b644b71318ac3f1a5c01249c65bcc490ef7cffe13925c1e8e200eecd91df6c9c
SHA512

ea19d704961651c5fdac730f47b1470a9816dad13d9a3b67c6116eb6a778d8823a479d930676105172cea9fe235dd45f9993e12a228b984a43b5299a18866f58
SSDEEP

49152:d7K+TDiZtK4JnUTTbd7xnXTPTntYmzZfv+3nmRVHdA0IyDmAHA5Z4/:deLtKzRpX/tzVc0bIyawA5Z4/

Score

10^/10

rms evasion rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Modifies Windows Firewall 1 TTPs 8 IoCs

evasion

Windows Service

T1543.003

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid	Process
736	netsh.exe
1748	netsh.exe
2212	netsh.exe
2524	netsh.exe
1672	netsh.exe
1656	netsh.exe
932	netsh.exe
1040	netsh.exe

Sets file to hidden 1 TTPs 5 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	Process
1332	attrib.exe
988	attrib.exe
1252	attrib.exe
1508	attrib.exe
1524	attrib.exe

Executes dropped EXE 8 IoCs

Processes:

setup.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid	Process
2720	setup.exe
880	rutserv.exe
1596	rutserv.exe
2136	rutserv.exe
2848	rutserv.exe
2612	rfusclient.exe
2692	rfusclient.exe
3032	rfusclient.exe

Loads dropped DLL 13 IoCs

Processes:

78db881af6d41d8ce120db6dfe104f24.execmd.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid	Process
2392	78db881af6d41d8ce120db6dfe104f24.exe
2900	cmd.exe
880	rutserv.exe
2900	cmd.exe
1596	rutserv.exe
2900	cmd.exe
2136	rutserv.exe
2848	rutserv.exe
2848	rutserv.exe
2848	rutserv.exe
2612	rfusclient.exe
2692	rfusclient.exe
3032	rfusclient.exe

Drops file in System32 directory 31 IoCs

Processes:

cmd.exerutserv.exeattrib.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfOggMux.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\HookDrv.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\rfusclient.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\set.reg	cmd.exe
File created	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File created	C:\Windows\SysWOW64\catroot3\dsfOggMux.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\rutserv.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rutserv.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\Microsoft.VC80.CRT.manifest	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\msvcp80.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\rversionlib.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rversionlib.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\msvcp80.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\msvcr80.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\Microsoft.VC80.CRT.manifest	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\PushSource.ax	cmd.exe
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\catroot3	attrib.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\HookDrv.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\msvcr80.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\PushSource.ax	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\RIPCServer.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\RWLN.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rfusclient.exe	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\RIPCServer.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\RWLN.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\set.reg	cmd.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe78db881af6d41d8ce120db6dfe104f24.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\setup.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\setup.exe	78db881af6d41d8ce120db6dfe104f24.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid	Process
2336	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 5 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	Process
1224	taskkill.exe
1088	taskkill.exe
1912	taskkill.exe
1636	taskkill.exe
1496	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exe

pid	Process
3008	reg.exe
1996	reg.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid	Process
2140	regedit.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

rutserv.exerfusclient.exe

pid	Process
2848	rutserv.exe
2848	rutserv.exe
2612	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exerutserv.exerutserv.exerutserv.exe

description	pid	Process
Token: SeDebugPrivilege	1912	taskkill.exe
Token: SeDebugPrivilege	1636	taskkill.exe
Token: SeDebugPrivilege	1496	taskkill.exe
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeDebugPrivilege	1088	taskkill.exe
Token: SeDebugPrivilege	880	rutserv.exe
Token: SeDebugPrivilege	2136	rutserv.exe
Token: SeTakeOwnershipPrivilege	2848	rutserv.exe
Token: SeTcbPrivilege	2848	rutserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

78db881af6d41d8ce120db6dfe104f24.exesetup.exeWScript.execmd.exenet.exe

description	pid	Process	procid_target
PID 2392 wrote to memory of 2720	2392	78db881af6d41d8ce120db6dfe104f24.exe	22
PID 2392 wrote to memory of 2720	2392	78db881af6d41d8ce120db6dfe104f24.exe	22
PID 2392 wrote to memory of 2720	2392	78db881af6d41d8ce120db6dfe104f24.exe	22
PID 2392 wrote to memory of 2720	2392	78db881af6d41d8ce120db6dfe104f24.exe	22
PID 2392 wrote to memory of 2720	2392	78db881af6d41d8ce120db6dfe104f24.exe	22
PID 2392 wrote to memory of 2720	2392	78db881af6d41d8ce120db6dfe104f24.exe	22
PID 2392 wrote to memory of 2720	2392	78db881af6d41d8ce120db6dfe104f24.exe	22
PID 2720 wrote to memory of 2360	2720	setup.exe	30
PID 2720 wrote to memory of 2360	2720	setup.exe	30
PID 2720 wrote to memory of 2360	2720	setup.exe	30
PID 2720 wrote to memory of 2360	2720	setup.exe	30
PID 2360 wrote to memory of 2900	2360	WScript.exe	87
PID 2360 wrote to memory of 2900	2360	WScript.exe	87
PID 2360 wrote to memory of 2900	2360	WScript.exe	87
PID 2360 wrote to memory of 2900	2360	WScript.exe	87
PID 2360 wrote to memory of 2900	2360	WScript.exe	87
PID 2360 wrote to memory of 2900	2360	WScript.exe	87
PID 2360 wrote to memory of 2900	2360	WScript.exe	87
PID 2720 wrote to memory of 2884	2720	setup.exe	85
PID 2720 wrote to memory of 2884	2720	setup.exe	85
PID 2720 wrote to memory of 2884	2720	setup.exe	85
PID 2720 wrote to memory of 2884	2720	setup.exe	85
PID 2900 wrote to memory of 1912	2900	cmd.exe	31
PID 2900 wrote to memory of 1912	2900	cmd.exe	31
PID 2900 wrote to memory of 1912	2900	cmd.exe	31
PID 2900 wrote to memory of 1912	2900	cmd.exe	31
PID 2900 wrote to memory of 1636	2900	cmd.exe	34
PID 2900 wrote to memory of 1636	2900	cmd.exe	34
PID 2900 wrote to memory of 1636	2900	cmd.exe	34
PID 2900 wrote to memory of 1636	2900	cmd.exe	34
PID 2900 wrote to memory of 1984	2900	cmd.exe	35
PID 2900 wrote to memory of 1984	2900	cmd.exe	35
PID 2900 wrote to memory of 1984	2900	cmd.exe	35
PID 2900 wrote to memory of 1984	2900	cmd.exe	35
PID 2900 wrote to memory of 1252	2900	cmd.exe	36
PID 2900 wrote to memory of 1252	2900	cmd.exe	36
PID 2900 wrote to memory of 1252	2900	cmd.exe	36
PID 2900 wrote to memory of 1252	2900	cmd.exe	36
PID 2900 wrote to memory of 988	2900	cmd.exe	84
PID 2900 wrote to memory of 988	2900	cmd.exe	84
PID 2900 wrote to memory of 988	2900	cmd.exe	84
PID 2900 wrote to memory of 988	2900	cmd.exe	84
PID 2900 wrote to memory of 1508	2900	cmd.exe	37
PID 2900 wrote to memory of 1508	2900	cmd.exe	37
PID 2900 wrote to memory of 1508	2900	cmd.exe	37
PID 2900 wrote to memory of 1508	2900	cmd.exe	37
PID 2900 wrote to memory of 1332	2900	cmd.exe	83
PID 2900 wrote to memory of 1332	2900	cmd.exe	83
PID 2900 wrote to memory of 1332	2900	cmd.exe	83
PID 2900 wrote to memory of 1332	2900	cmd.exe	83
PID 2900 wrote to memory of 1524	2900	cmd.exe	38
PID 2900 wrote to memory of 1524	2900	cmd.exe	38
PID 2900 wrote to memory of 1524	2900	cmd.exe	38
PID 2900 wrote to memory of 1524	2900	cmd.exe	38
PID 2900 wrote to memory of 1520	2900	cmd.exe	39
PID 2900 wrote to memory of 1520	2900	cmd.exe	39
PID 2900 wrote to memory of 1520	2900	cmd.exe	39
PID 2900 wrote to memory of 1520	2900	cmd.exe	39
PID 1520 wrote to memory of 1544	1520	net.exe	82
PID 1520 wrote to memory of 1544	1520	net.exe	82
PID 1520 wrote to memory of 1544	1520	net.exe	82
PID 1520 wrote to memory of 1544	1520	net.exe	82
PID 2900 wrote to memory of 1496	2900	cmd.exe	40
PID 2900 wrote to memory of 1496	2900	cmd.exe	40

Views/modifies file attributes 1 TTPs 16 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	Process
2400	attrib.exe
988	attrib.exe
1524	attrib.exe
2236	attrib.exe
2888	attrib.exe
2556	attrib.exe
2972	attrib.exe
2988	attrib.exe
1332	attrib.exe
1252	attrib.exe
1508	attrib.exe
2368	attrib.exe
2544	attrib.exe
1412	attrib.exe
2984	attrib.exe
2912	attrib.exe

C:\Users\Admin\AppData\Local\Temp\78db881af6d41d8ce120db6dfe104f24.exe
"C:\Users\Admin\AppData\Local\Temp\78db881af6d41d8ce120db6dfe104f24.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files (x86)\Company\NewProduct\setup.exe
  "C:\Program Files (x86)\Company\NewProduct\setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\stop.js"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
      4⤵
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
    3⤵
    PID:2884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im RManServer.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rutserv.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
1⤵
PID:1984

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "C:\Windows\System32\catroot3"
1⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1252

C:\Windows\SysWOW64\attrib.exe
attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/realip.exe"
1⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1508

C:\Windows\SysWOW64\attrib.exe
attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\install.bat"
1⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1524

C:\Windows\SysWOW64\net.exe
net stop rserver3
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\net1.exe
  C:\Windows\system32\net1 stop rserver3
  2⤵
  PID:1544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rserver3.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im r_server.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im cam_server.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\SysWOW64\attrib.exe
attrib -s -h "C:\Windows\system32\rserver30"
1⤵
- Views/modifies file attributes
PID:2984

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r "C:\Windows\system32\r_server.exe"
1⤵
- Views/modifies file attributes
PID:2988

C:\Windows\SysWOW64\net.exe
net stop Telnet
1⤵
PID:1388
- C:\Windows\SysWOW64\net1.exe
  C:\Windows\system32\net1 stop Telnet
  2⤵
  PID:2244

C:\Windows\SysWOW64\sc.exe
sc config tlntsvr start= disabled
1⤵
- Launches sc.exe
PID:2336

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Service Host Controller"
1⤵
PID:2184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user HelpAssistant /delete
1⤵
PID:1340

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn security /f
1⤵
PID:1920

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="RealIP"
1⤵
- Modifies Windows Firewall
PID:1672

C:\Windows\SysWOW64\net.exe
net user HelpAssistant /delete
1⤵
PID:2472

C:\Windows\SysWOW64\net.exe
net stop "Service Host Controller"
1⤵
PID:432

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="Microsoft Outlook Express"
1⤵
- Modifies Windows Firewall
PID:1656

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="Service Host Controller"
1⤵
- Modifies Windows Firewall
PID:932

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ß½πªí Windows"
1⤵
- Modifies Windows Firewall
PID:1040

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ºáñáτ Windows"
1⤵
- Modifies Windows Firewall
PID:736

C:\Windows\SysWOW64\netsh.exe
netsh firewall delete portopening tcp 57009
1⤵
- Modifies Windows Firewall
PID:1748

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="cam_server"
1⤵
- Modifies Windows Firewall
PID:2212

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete portopening tcp 57011 all
1⤵
- Modifies Windows Firewall
PID:2524

C:\Windows\SysWOW64\reg.exe
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Ä»Ñαáµ¿«¡¡á∩ ß¿ßΓÑ¼á Microsoft Windows" /f
1⤵
- Modifies registry key
PID:3008

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v HelpAssistant /f
1⤵
PID:2180

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\System\CurrentControlSet\Services\RServer3" /f
1⤵
PID:2260

C:\Windows\SysWOW64\catroot3\rutserv.exe
"rutserv.exe" /silentinstall
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\SysWOW64\regedit.exe
regedit /s set.reg
1⤵
- Runs .reg file with regedit
PID:2140

C:\Windows\SysWOW64\catroot3\rutserv.exe
"rutserv.exe" /firewall
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596

C:\Windows\SysWOW64\catroot3\rutserv.exe
C:\Windows\SysWOW64\catroot3\rutserv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2848
- C:\Windows\SysWOW64\catroot3\rfusclient.exe
  C:\Windows\SysWOW64\catroot3\rfusclient.exe /tray
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2692
- C:\Windows\SysWOW64\catroot3\rfusclient.exe
  C:\Windows\SysWOW64\catroot3\rfusclient.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2612
- - C:\Windows\SysWOW64\catroot3\rfusclient.exe
    C:\Windows\SysWOW64\catroot3\rfusclient.exe /tray
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3032

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/realip.exe"
1⤵
- Views/modifies file attributes
PID:2912

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\install.bat"
1⤵
- Views/modifies file attributes
PID:2236

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\stop.js"
1⤵
- Views/modifies file attributes
PID:2888

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/HookLib.dll"
1⤵
- Views/modifies file attributes
PID:2556

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/block_reader.sys"
1⤵
- Views/modifies file attributes
PID:2368

C:\Windows\SysWOW64\catroot3\rutserv.exe
"rutserv.exe" /start
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "cam_server.exe" /f
1⤵
PID:2024

C:\Windows\SysWOW64\reg.exe
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Service Host Controller" /f
1⤵
- Modifies registry key
PID:1996

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r "C:\Windows\SysWOW64\r_server.exe"
1⤵
- Views/modifies file attributes
PID:2544

C:\Windows\SysWOW64\attrib.exe
attrib -s -h "C:\Windows\SysWOW64\rserver30"
1⤵
- Views/modifies file attributes
PID:1412

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r "C:\Windows\SysWOW64\cam_server.exe"
1⤵
- Views/modifies file attributes
PID:2972

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r "C:\Windows\system32\cam_server.exe"
1⤵
- Views/modifies file attributes
PID:2400

C:\Windows\SysWOW64\attrib.exe
attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\stop.js"
1⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1332

C:\Windows\SysWOW64\attrib.exe
attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/block_reader.sys"
1⤵
- Sets file to hidden
- Views/modifies file attributes
PID:988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\setup.exe

Filesize
93KB

MD5
5f2abc82a5c1eca8878544725661fa8c

SHA1
565d6f27a9b6853f07fdcbaf4766bb5f54545200

SHA256
73a8168dd84405f6230636fdf2543454d7b3df885579678c0ccdf3ce125fa5fc

SHA512
11ddfa43a4d615c73eb42dc947b166b3d283d6a0440d6378265baf0118ac697588bc4dba904f3558a513768ab442d280a3a583abbd266b6a5e43689aa4fb713a

Download Submit
C:\Program Files (x86)\Company\NewProduct\setup.exe

Filesize
92KB

MD5
242386985792a80f532b9fc5f93f820e

SHA1
a0d32daa079d69e4fb6502db9d29c08a9298169b

SHA256
4c203211a3399655d3faa872a17e050e683f9b49ed7275fdb75a9d6d12164871

SHA512
42666a949cbbc5621123578ecf47fcd2c9ac2ee1404aeaae6ddad5d5134e6e284ddbe90cfbbc097f26f3f707af3b05fe6e8157b4ddc70a7a6e62758b5f2c8295

Download Submit
C:\Users\Admin\AppData\Local\Temp\HookDrv.dll

Filesize
144KB

MD5
513066a38057079e232f5f99baef2b94

SHA1
a6da9e87415b8918447ec361ba98703d12b4ee76

SHA256
02dbea75e8dbcdfc12c6b92a6c08efad83d4ca742ed7aee393ab26cab0c58f9e

SHA512
83a074bef57f78ede2488dd586b963b92837e17eea77ebd1464f3da06954ae8ca07f040089af0c257e2836611ae39424574bd365aea4a6318a2707e031cd31a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsfOggMux.dll

Filesize
84KB

MD5
65889701199e41ae2abee652a232af6e

SHA1
3f76c39fde130b550013a4f13bfea2862b5628cf

SHA256
ef12a65d861a14aed28480946bc56fce479a21e9beac2983239eac6551d4f32e

SHA512
edbb1a1541a546d69e3fd64047a20613b47b3c08f2b639a53160b825c4a1462c4cc08a7bf417aa2db814f412fb16619c6c0d9364e21cc1c6d753ecf81f1d30f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsfTheoraEncoder.dll

Filesize
240KB

MD5
5f2fc8a0d96a1e796a4daae9465f5dd6

SHA1
224f13f3cbaa441c0cb6d6300715fda7136408ea

SHA256
f8686d8752801bb21c3d94ebe743758d79b9b59f33589ec8620e75a949d1871f

SHA512
da866275159b434205f259176c3937b7c77b14ed95d052152b05b984909e094bbd3b2702d3e874a4a1e1bc02fc5a8476ea43df8aee43542d56e832eacc8f54ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsfVorbisEncoder.dll

Filesize
1.4MB

MD5
3c9dd83b3cd8b8a38d75963467860342

SHA1
8d63e23caa3d093bb02858154301cbe0cb198b5d

SHA256
ccd5ab456e20db5891f0ff23bbcf63f1003a02126203e320a80c83512a24bbda

SHA512
b2b11cf1eabf4d3a862fb8950bc8e32ebbb2b6341c384dcb5c6dc26794b02375f99fa9280bf168070d478a7d1ce1ba3071907760f04b705730aefda7c82dca90

Download Submit
C:\Users\Admin\AppData\Local\Temp\msvcp80.dll

Filesize
193KB

MD5
60c0adcd87bfac0b09f72267c6a9c8fe

SHA1
58e49d62429df8e51e31a412e8ece4c745b87721

SHA256
6c3224f619a8ab86c51d045e3f0276c4af57bcf373f675db7aaaed58b7571428

SHA512
dacdda5bfb8d089df498f7d59887451af7b1f1b63527b76d6d5c5579492c73655ba2b2db33aa69b5822536e9ba931848cdb22005cbfa8ee47104bd040864f5d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\msvcr80.dll

Filesize
40KB

MD5
2abb9b5840a118fd3845495082cc1033

SHA1
bbf3bac0d6849b15b68da0ed5ef1e25e74fbab7f

SHA256
52700888d426c79fdd3cefb1401ccfce06dca1e2fd025f40ec431b038d3da257

SHA512
351e09b02947342a7239d399232684a0f6af15f468982b5f9d6a78c2ff61157dee90e9adea0b81eb0f6ef4de0a8d471c78f3e14c56cb296444f595ab360a09a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\rfusclient.exe

Filesize
35KB

MD5
d20fffa97653fd8a9f3b0272ede57258

SHA1
0db2b2f5bbce3231d04a031fe491c8d13f5e4f97

SHA256
d3de83732cca3d1e7a776cda78cf4721f6abf3d3d8fb81b424abdc3e59507093

SHA512
5d54d6a6c76f8a09ac66300fcfff25b5b4b1a1fa957be3873a182277d765ba1b52e9cc23ba8f9b7beebe274871dbb41f744c88f3c1950c9a6d08cb3670c76fa1

Download Submit
C:\Windows\SysWOW64\catroot3\rutserv.exe

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/880-111-0x00000000002D0000-0x0000000000328000-memory.dmp

Filesize
352KB

Download
memory/880-116-0x00000000002D0000-0x0000000000328000-memory.dmp

Filesize
352KB

Download
memory/880-115-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/880-112-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1596-122-0x0000000000230000-0x0000000000288000-memory.dmp

Filesize
352KB

Download
memory/1596-124-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/1596-125-0x0000000000230000-0x0000000000288000-memory.dmp

Filesize
352KB

Download
memory/1596-123-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2136-157-0x0000000000840000-0x0000000000898000-memory.dmp

Filesize
352KB

Download
memory/2136-133-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2136-132-0x0000000000840000-0x0000000000898000-memory.dmp

Filesize
352KB

Download
memory/2136-156-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/2392-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2612-180-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2612-191-0x0000000000230000-0x0000000000288000-memory.dmp

Filesize
352KB

Download
memory/2612-154-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2612-170-0x0000000000230000-0x0000000000288000-memory.dmp

Filesize
352KB

Download
memory/2612-169-0x0000000000400000-0x000000000075E000-memory.dmp

Filesize
3.4MB

Download
memory/2692-177-0x0000000000400000-0x000000000075E000-memory.dmp

Filesize
3.4MB

Download
memory/2692-155-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2692-204-0x0000000000400000-0x000000000075E000-memory.dmp

Filesize
3.4MB

Download
memory/2692-172-0x0000000000230000-0x0000000000288000-memory.dmp

Filesize
352KB

Download
memory/2692-171-0x0000000000400000-0x000000000075E000-memory.dmp

Filesize
3.4MB

Download
memory/2692-181-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2848-137-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2848-173-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/2848-179-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2848-167-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/2848-168-0x00000000007D0000-0x0000000000828000-memory.dmp

Filesize
352KB

Download
memory/2848-182-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/2848-207-0x00000000007D0000-0x0000000000828000-memory.dmp

Filesize
352KB

Download
memory/2848-206-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/2848-136-0x00000000007D0000-0x0000000000828000-memory.dmp

Filesize
352KB

Download
memory/3032-165-0x0000000000400000-0x000000000075E000-memory.dmp

Filesize
3.4MB

Download
memory/3032-166-0x0000000000230000-0x0000000000288000-memory.dmp

Filesize
352KB

Download
memory/3032-164-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download