Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
01-03-2024 07:27
General
-
Target
tmp.exe
-
Size
8.3MB
-
MD5
cb2ffac2a251378cda3f91cd613f453d
-
SHA1
3a028761638f5aa93b0719c5650c83a138e8abc9
-
SHA256
10165e27e0db0a6708f346ddea657ab0409499f93eb8426a80864a966f0f401e
-
SHA512
1d203540fde5074f0d57e1ecbd9af2ee862b940f8fb58c3e55ad9db5ba029aff82a4468eee24c760b5e55cc96e61244af0fd6f3c46db857824e13e45ec1e802f
-
SSDEEP
196608:P4Z1cDw8TWMpWRGAk7R85du3dWbpkPbVAp2FG0c+imht+:PE1CE3k7R5NWqu0cU+
Malware Config
Signatures
-
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 8 IoCs
-
Loads dropped DLL 1 IoCs
-
Blocklisted process makes network request 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 53 IoCs
-
Drops file in Windows directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 24 IoCs
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
-
Suspicious behavior: SetClipboardViewer 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3.4ru_mod_mod.msi" /qn3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\killself.bat3⤵
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 55DB5F0AD32CF11C8928597932C5A6092⤵
- Loads dropped DLL
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
-
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD52ab97472914a5488a4aa2ab8a1b64f3e
SHA1e1ff3e781a77207f17628de3b09018d4b1265c4e
SHA2561ca2bc57561c58454ede8d224062470fd220cb21a6cc717497b43b66cc3a100a
SHA5124d271ce8dceba08cb8f562e30dff103b5b90feed4875f85d89154e95282468fe44489af01e22dd79d14e8aa0aff40b49668e9b252632c71a9866bab18d0e59d4
-
Filesize
43KB
MD5bc25377ade68750b834c81fa71c233b8
SHA184dbb465dd2125f47668e2508e18af9bd6db2fd8
SHA2569a48a7ea7ba2c2f33280d1e1722ebbc59bf81bc6c5a1f97edca53ea641ffd8e3
SHA512205ab195339d7108adbe6dfabd48e4e21c5956ded587d7213a44618f0d34a43f7b8abaa7765b9d31695efacfc44beeb69fbaa3cb27c141b6a653713fdf5ebce5
-
Filesize
144KB
MD52ddfa39f5c2fd3f00681ef2970617e4b
SHA18152aa18afbacf398b92168995ec8696d3fe3659
SHA256f938bdc741ef1d2738b532aef001a160e3a3627ed8a27158b7017ee49fc65791
SHA512f89f0f02cda650c138e4ebaef198f0762dfd571ef7d46a6b3710cd93d76bc52a79055c55afca46128a9a84a795a5cb946ca93c492e07cfb503c9b27d96211e20
-
Filesize
975KB
MD53d0b27b3f8aa22575aa0faf0b2d67216
SHA139fc787538849692ed7352418616f467b7a86a1d
SHA256d7782488ef29bf0fd7e8faf0bd24414a6540bf7366434692a5a485d5ae2d7d44
SHA51219f0785d3cecce0dbbb7da1be640bffebe4daedc65a513d1db0b5e533eb96aaa0588831de74c88e5013c00405e03ca4188c4b633e39e6c49ab5c1d1b42191ca8
-
Filesize
48KB
MD5e44e34bc285b709f08f967325d9c8be1
SHA1e73f05c6a980ec9d006930c5343955f89579b409
SHA2561d99a7b5f7b3daa61fa773972b1e335aa09b92411484f6ddc99d2b2894455a5b
SHA512576b292b6e9cf022822443e050994462a6cbd9a3c60063bae9f54c78a84e75e17bb5eddf7e259a22a9d93f757cb6536c503762e2a30e75091e40c2756cde8727
-
Filesize
1.1MB
MD58de38f8a45139bd89868e6c1e82c7641
SHA116885be0f7e66bfa627822749a10a229d48f232f
SHA2568df5d517a19ef5c6750f273fba6703928c3ec6a9c17056cdba70dcfb33b5dec4
SHA512864000d5288bbd7a9a2a1ec4294eeaddbc7e14f5bde877f4446e817bf1b847aeb15f659cbb829a933365480a98d8d7d0b583aab0163d4dc068b87cf07f848790
-
Filesize
645KB
MD5a551e8bb87123e93ac1dc05ade00bd84
SHA15b7ff070bbb36ca57a0efb0d38378eeef997371d
SHA256870aa851b2ef7ccfedd849058693e51b3859c8d7fb62d835e445b07e52d0b2e7
SHA512d918473dfe2fe63ac0ae932bfc1a8ae0204df1779a834e25a2c7b8c618aad8803246fa5d370ca8c4b8097f7544cd2837cc1939f5198288bae88e72b81221cc77
-
Filesize
832KB
MD54014f52499a1cc7862bdb6a8ceb2e343
SHA1643dfa0099ea3ae7dd6c4c2274974a2684de1ae2
SHA256f9895f611e984c30f55e23d0a5a0ea2571f1ec221d6b55a7c28cc28254262830
SHA512591c7a247e9fae5b7308c2ef887321e3a2cba7d7a132e2918fd4b656f453ca9f072502393abd1ccd51d2da7a34ade5d1f778d6225665eb7107af79489ebfa3df
-
Filesize
2.3MB
MD58e095a5e7502731732a9daa47d6d4dfd
SHA1e8ae9b37b24836ff127e570c8caf5f07b6e283e1
SHA256c44daf0e52d2b97801c2f7d70fc395ebe89d4b185f3c8613f415fde8cc011b0b
SHA51228cdca06df22a694804a2c773a75391e56e8009cbf45212cdd26399e1ff27d1d51c0963293ad1f5a2ccc247ab63afdf672310b35f44935737ec5a4653d445335
-
Filesize
116KB
MD5b84f8f4db2bfccd78858f3c935bee270
SHA1bf9e623f7f749200e38c5c60034afd31681cfc6e
SHA256766ce973526d9c0543f1c2ff233f5de85a82cb2cd6ab73f87a0624d37ab59f54
SHA512fe7e61856d6d054138aca9f9afb43465cae9cfc592c7d17fe862fbc31d9db38dfe9024b42b14e7fcd5b30cc046122d7467ac5d0f9a2c0c49826f552a21169d01
-
Filesize
96KB
MD57620849e1afafb33081c626b72e70c37
SHA188c63c52aada23688686246c727ef6a696263067
SHA256d9adbe64c04a861824974054c23992f750adbefb97f20e20803ca434f2498743
SHA512eac76b1b2cf64bbcab4917e7b77e6ca91e359d5235934a1eacb8ece49c4204da293eee0529164257feb1690d5b75ff4bc75d5ffd831802bc2c293357460d7f2d
-
Filesize
2.1MB
MD592081986a6e37389b975b71433333ab6
SHA1f7a826e0ea6a60dfe2dee1d24cac4617d197e45e
SHA256c589d7363d913aadef1f534a522c428d2a30a3ad641ec30bfb4c3095a5a0b37c
SHA5128a059c890fa88aa584e9295a025d78f74d29f5ce93dd1d4bbe36d17e7d68642b3ef204c106eb40b476617a8f2307421d43fdf86cecbffef662f98168ce24ea8b
-
Filesize
113KB
MD5695192cdb19b857dbdb4559257e001c3
SHA1260164851070b4f95072b8735fdfba786d184718
SHA256c985945234f198981d6e02d9ddc72e24f36b9c9feb5276f209c1422d85f03a42
SHA5121e4342eef4172da212b763c876391f1825cde87e7097a50cf96c44e3048f4df587b04275c8daf188fd2991aa937d81a69fedc21888cb9c0f1df1536396514286
-
Filesize
1.6MB
MD5e06f180d4f3221ac23bf6bea8db5b4de
SHA11d45a7f5ae3ba23de817226e24d07ea54ff27fa7
SHA256bb3b1c8311387b574f9e8d72dc166a652c34e047113633964c901a66aa3c6fe5
SHA512272063a6be91103bd8b231c1292ff610b28c4b87a1a26899e6dcfefb54d9200bb38697127d531dd4ba6a149faed392f47595cc71ec627fea8929f2dec261d1da
-
Filesize
378KB
MD5292a1748850d1fdc91d4ec23b02d6902
SHA18f15f1c24e11c0b45b19c82a78f7b79b1e7f932d
SHA256acf354ad6ed94e876b29a60c5870dd91e7b3f76cc82c1a862c92024a12404a9f
SHA512cf7579f1169ec21d9bf3c666d416d3fe2a4f9953d4d328b182452e40043f91055d301fd4b4a21454b847dbdb0af6a61c52657caded7d6fd7e88812aceeacf704
-
Filesize
994KB
MD58b9a0b65ee11feb417756e8947cdc73d
SHA122b153992c2754205264c2e88e73c51b84299c30
SHA256c1f321be60dcecdb0f1fd7aefdf6c1fa340f8d6095de9cf39265e7a8c28926b6
SHA5124dd91bda6cc97d6b580fffddebb39b1422ad1bb8bda23c7e9a828311f56cec36c2d9df919f7a5fb7754e28f772ceeaa60cea2033f1b7d1d5922421815d7ff1f5
-
Filesize
258KB
MD5038bf9f3a58560ad1130eeb85cdc1a87
SHA13571eb7293a2a3a5bf6eb21e1569cd151d995d1a
SHA256d247afa3bd1ccc18e11eb099280802a61d3792a2018c476d95debf2091e9707d
SHA5128ffa52b358841600b9122974079d22d4e11bc4214316cd85ac4d4af0e369112b6827029f74a9a9d3918db00c7fed3a9a1985e0b43da39783a748d78752ae2385
-
Filesize
363KB
MD5eeb2c52abbc7eb1c029b7fec45a7f22e
SHA18bfeb412614e3db0a2bf0122f4d68cc27b8c3a61
SHA256c0f0b84d587066af8f80f41a7be63b4c01547af3f1e011602ac1b6ee0ac54a2c
SHA5120b5b83335c6f602b8397a3c2ae6d1e661d744eb27114463d53e344bf18774ccb38853d314ebe05536d4c28c29fe3fdaba041a6a46983789f064ca70881cfcb85
-
Filesize
858KB
MD5e38372f576d927f525ef8e1a34b54664
SHA126af9d1db0a3f91d7fe13147e55f06c302d59389
SHA2564046bd0b93909a41d0fd96f0405a864c79a47f493165546569251c1f73db6b0b
SHA51278b7477b000407990304ec37624b873514d4ed9daa1b42fd988707b7374ffab442ba28fe19884724867f3f0f7a5f12f7fc8c228c050115c902d1569e4a3b13c7
-
Filesize
6.0MB
MD5c9704931d887685d96ce92d637d84045
SHA10875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA2560448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA5123b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260
-
Filesize
3.2MB
MD51eef002c5fdbac6516045dd9be57e36b
SHA155b2c5358c92cfc6bf14616139b1d89c50fe3b09
SHA256b241f8002e7cc4d947601f58e74b0d8e49705a6a880472b31235940723ce90e4
SHA51261dbea2aa773908513b002fb07e6386816a16f0575d2a74860300395ebeeae07b234b8bf7b7959cc970dfb48a19ae826a30846f73cfcccfcfa1388062b56b077
-
Filesize
7.3MB
MD5998f9b9eefeddbfc898356139220bab3
SHA1324bb9170598a73ce7f1359da7a35a6065f22f8e
SHA2560230d36dc995c5fa25b6dd3f33c670fdf5f06c014a0b2d1012c064d733e9d81c
SHA512efea0f628fca55733a29cd6c05aab11b8b4e49153d9ae94340daa00e5cb47f1ce4c2c2a3d9fea6108205fcb3a13ca13a4d533f47c561e8785f529d58c95f08e7
-
Filesize
417B
MD52fe7ba7d9103012d8593f220508eaf6a
SHA1fce4c84da7d0d97b46d494b15acbcd992b04f06a
SHA256874044e21f5b7c8a7a2286f1a5c61693515153e73c019451f32a0df1bb910708
SHA5129fb05799d464f26097c84d4b6dbb18de6de360f62a4373849fc6c7bc7348dc0738f702bcd3dbfa3bde4e1cb9275898ee33eb03706d419d2029a4a8fd3f983678
-
Filesize
125KB
MD5b0bcc622f1fff0eec99e487fa1a4ddd9
SHA149aa392454bd5869fa23794196aedc38e8eea6f5
SHA256b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
SHA5121572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7
-
Filesize
2.9MB
MD5e64042c5ab639a36d3e1dd6d4d7ada5f
SHA17403755354e47cc9fd4804327c153f7edda419d3
SHA256ea836510c132d5dd31bcd98ea401774f2b1a87a2011e963af273a5a1817cb935
SHA5120937611f21a9394ac9241693e6e1ff86f6734b4c373dc3094aee6fed70525fc83e8b113015ab9100fffcc71866b3fbc5daa0ac060ea65f9438e9f435973d950b
-
Filesize
96KB
MD59e2c097647125ee25068784acb01d7d3
SHA11a90c40c7f89eec18f47f0dae3f1d5cd3a3d49b5
SHA256b4614281771ed482970fd0d091604b3a65c7e048f7d7fa8794abd0a0c638f5d2
SHA512e2f334f31361ea1ffc206184808cb51002486fe583dc23b4f617bead0e3940fdc97b72cda2a971e2cf00462940b31e065228f643835d156e7166e8803e3181f1
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
6.6MB