Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
01-03-2024 07:34
General
-
Target
tmp.exe
-
Size
8.3MB
-
MD5
73f351beae5c881fafe36f42cde9a47c
-
SHA1
dc1425cfd5569bd59f5d56432df875b59da9300b
-
SHA256
a028816d9741540c6184091b4ae3c4e42b104f90fe3b17a55d0e4aa4c4c43824
-
SHA512
f484b1260e73b3717603cfcfd62e820502480d8be57a7570e6c38612c9ea86b9335c6a42742fbdb369a37fcd5ec4c2b06f426a075582c39639128ad7be92da66
-
SSDEEP
196608:PdQ5Lq4eAGPJgBDpKLtW0tzHlYd3cvF8m9k/RRZpAp2FG0c+imhtO:P2VqyC8mQ0vxN79kpR40cUO
Malware Config
Signatures
-
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 8 IoCs
-
Loads dropped DLL 1 IoCs
-
Blocklisted process makes network request 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 53 IoCs
-
Drops file in Windows directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 24 IoCs
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
-
Suspicious behavior: SetClipboardViewer 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe" /rsetup2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rms.host6.3ru_mod.msi" /qn3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\killself.bat3⤵
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8B8EC87EEF6777C47AF54CAF48DD34272⤵
- Loads dropped DLL
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: SetClipboardViewer
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
-
-
-
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray2⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1792 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5ae5aa0d809975c085dee3d8e996f6092
SHA11b026aeb336626376c7aed6e2deb68e460bb6310
SHA256b0c9e847f237ed90a01f027f65561d0d540c73366dda39807305fb17825df820
SHA5124ab65f223751cacac100c5b1375334422b0ee8a85a4927d7d5602e6d6395ba418591698f5f15dbdcc64fe845283508d7d476a6ade365daba0f27750bf0a72d20
-
Filesize
43KB
MD5bc25377ade68750b834c81fa71c233b8
SHA184dbb465dd2125f47668e2508e18af9bd6db2fd8
SHA2569a48a7ea7ba2c2f33280d1e1722ebbc59bf81bc6c5a1f97edca53ea641ffd8e3
SHA512205ab195339d7108adbe6dfabd48e4e21c5956ded587d7213a44618f0d34a43f7b8abaa7765b9d31695efacfc44beeb69fbaa3cb27c141b6a653713fdf5ebce5
-
Filesize
144KB
MD52ddfa39f5c2fd3f00681ef2970617e4b
SHA18152aa18afbacf398b92168995ec8696d3fe3659
SHA256f938bdc741ef1d2738b532aef001a160e3a3627ed8a27158b7017ee49fc65791
SHA512f89f0f02cda650c138e4ebaef198f0762dfd571ef7d46a6b3710cd93d76bc52a79055c55afca46128a9a84a795a5cb946ca93c492e07cfb503c9b27d96211e20
-
Filesize
592KB
MD5b39dff16387f9f646c0f75b9b5e8f179
SHA19da1bffc4a09b8361634571471dbd649b68375f5
SHA256835f5209242d9ca1c091d169aba841a84a9659c0ab45af8b93d922c9b1bf060c
SHA512c5e083206df2c39234fe75baf7f4a1348955b5aa2465c9d937d68d41ea74e9a092c71c84557cbe908d33ea7420d0f30051be489f1acec3445da9a90a3fc6fcbc
-
Filesize
48KB
MD5e44e34bc285b709f08f967325d9c8be1
SHA1e73f05c6a980ec9d006930c5343955f89579b409
SHA2561d99a7b5f7b3daa61fa773972b1e335aa09b92411484f6ddc99d2b2894455a5b
SHA512576b292b6e9cf022822443e050994462a6cbd9a3c60063bae9f54c78a84e75e17bb5eddf7e259a22a9d93f757cb6536c503762e2a30e75091e40c2756cde8727
-
Filesize
711KB
MD50a5e10ff14ba33f1eee9e8ac3d59531b
SHA19c25f9ccbe8067704c3f34f81802da105223aeff
SHA256c19c924bc78d5e50e1599e44dd38d48ec4dc4f6a4ebbb1cd0ea5189c04c58997
SHA512637c550c61121e15cc7ff00287bb79e754d61fa224405030642181bead4e7df987169462cc209ff409ca778fad31307f4e770ec4cbe65c6690fc6b0837334147
-
Filesize
200KB
MD53bb7250610663a252ffc1b55afbcbb3d
SHA1ac29b885bd65c2d7cfde85c322732777f798c3bd
SHA25677fdd063a9ca36f40d42c4e807aebc4f0c0099ed441a7d50d0aa6e1e59bb6d6d
SHA5121fe0ffd178394f82f866f295d82f076e1ce0b536e2d6208d05a249df587a070fdb3dbaa46bb0efd5404f62fff83845c5ea65751ad1425236e6fc4ce4debb4987
-
Filesize
125KB
MD54afa1d77fd7b306187214d643ed5fe5b
SHA13740b4049910875ed72eb949994d897bcfa6efe2
SHA25637e005b923dbe556fa89affa38fd1c71d0ac96d18dc7c9f03767ef10645760b8
SHA5125cfdc0ddc0d825c174e1c78bf342ab55cd0bc291d132a3c5cff5179fb9ed30e23936789d2db943a7f35f6856000ca8ab8440a71ba934251066a7a62276435be1
-
Filesize
5.1MB
MD576ebe5fd077a62161d0ab560208b9f94
SHA1614c218d35ba531f0bad791d52e5dcf57df5c742
SHA256f0a653463850ce111457513e9ad3ec4443ed88c69fdf33d76e05c33ce8e1722b
SHA512baba7b03042c4bfbf6efa9c2219ed72e393e193ee743a32501e1a5df56293b3bdf2270b92843c9333049dcfcfe52007d6e9a7bfaa0548ef268d2511cf590efde
-
Filesize
2.2MB
MD59f0222125fece61f176a9908b0e679a7
SHA11ffb2c781316d51bbbfb0cc5786b1f066d8cfe7c
SHA256c1631f5f8ff899efd11830ef9b75f99eb4e3904b8d57abc6f3ecb8e666530900
SHA51278aa40c83b82cb4899c4b2bedb9680f1e51159b8ed1ce257f0467e798f1592bb06c280cc2210356f834e8364482875cc954512825991f445631a8b3939f226bd
-
Filesize
1.8MB
MD5d06856506509a54217d84bc77344f8d6
SHA1977aa7dceaf4d5681dcce407ad5a7750d1b594dd
SHA256c5a427fff5f7d62f603a37c5e058f045762f5eef71c40722a8d96fb94eee1d24
SHA5123474c7dcaec58d6be299849415774addab4238c07ef23f54ef89b039a9b968c078d066341b6f91a9aaf0abd7802b2dc790a28de911bc88c35bf46c13d279cf59
-
Filesize
190KB
MD59574053ff0825026d9e36fbaac636a9a
SHA19c2ed128c2aa4b37e805a9dcdb03d201149103a4
SHA256bab50a48080b6fcd6dc0e8baad3d7f8c7b6e6d73b12aa86d71f29acf086d681a
SHA51270d2525f95ff007c6ef9b9222b6ca9c2f470768e0f609e9196055cbf6c8bffc4e02dd17c1205594f1d558369f527ce4b6393f5e7c2a3625f41a48c49d1e326df
-
Filesize
1.9MB
MD59b2ab5e1dade320ad991181c19937aea
SHA1ba19901a4a78f89daab4c3558e2f1670613caba8
SHA256b3aea6ec723f6178108e6f51e6480f251a9ff830b41882a281520c79ab1953a8
SHA512b6a26c2723ffb46a6474d3e94bf83679044391a19dc9ddcd21f025d72bf7a630ad4ca2a95c5b9d6051d2d9a4ab4fabda24790d1e3434a6fa1e1c14cc31234026
-
Filesize
1.5MB
MD547ff80fc5e0ca521d1f0e44b8a6a014e
SHA1ab73c7ace30eb448e2726852fbb82ea602605248
SHA2562e446af05fcb2018f1893e9693bb285ec1980d8753d6858d669439a839163ebb
SHA5124b4d6c59f222bde9d75be5f52133bd4047a1804570b4d9322f2188cd75f981d9c8cc938b268861b8438b1059902f38e9f2b7ef41784c0e3a6d0de7b7dc2c7e0c
-
Filesize
378KB
MD5292a1748850d1fdc91d4ec23b02d6902
SHA18f15f1c24e11c0b45b19c82a78f7b79b1e7f932d
SHA256acf354ad6ed94e876b29a60c5870dd91e7b3f76cc82c1a862c92024a12404a9f
SHA512cf7579f1169ec21d9bf3c666d416d3fe2a4f9953d4d328b182452e40043f91055d301fd4b4a21454b847dbdb0af6a61c52657caded7d6fd7e88812aceeacf704
-
Filesize
652KB
MD53970668e0f35a72e5320f0d7e3beb69f
SHA1bae971b14861c5dd0c3bdcb02bfa64234f9b0e5a
SHA256aa941101d81a470c81cd3689b02f6fbf84426e46ba71922340a85a2a50188655
SHA512f747fe7e43687d971736299e8900cedac73307ef3a030b8f1846347483b49a2f72ff4ff13fc8d9a3c40165272160019ebd8cae56119c12c3183ce2d7dabc3e94
-
Filesize
258KB
MD5038bf9f3a58560ad1130eeb85cdc1a87
SHA13571eb7293a2a3a5bf6eb21e1569cd151d995d1a
SHA256d247afa3bd1ccc18e11eb099280802a61d3792a2018c476d95debf2091e9707d
SHA5128ffa52b358841600b9122974079d22d4e11bc4214316cd85ac4d4af0e369112b6827029f74a9a9d3918db00c7fed3a9a1985e0b43da39783a748d78752ae2385
-
Filesize
363KB
MD5eeb2c52abbc7eb1c029b7fec45a7f22e
SHA18bfeb412614e3db0a2bf0122f4d68cc27b8c3a61
SHA256c0f0b84d587066af8f80f41a7be63b4c01547af3f1e011602ac1b6ee0ac54a2c
SHA5120b5b83335c6f602b8397a3c2ae6d1e661d744eb27114463d53e344bf18774ccb38853d314ebe05536d4c28c29fe3fdaba041a6a46983789f064ca70881cfcb85
-
Filesize
599KB
MD5a9a87bb4a73122926760c1c98644cdbf
SHA13e638394b80e1190438e20b0d89e6959544fe241
SHA25601a477deeb196096b7eea35ebd0befed5d8d1da9e47f5413ba835f5386216766
SHA51243d60a08796a39da6f9f4589ea742128d713afd74af288917bd3c129e465144e9544864a2f39bff6499def115dc831b9c79b2d49088ccbfa4e39bd197150aed0
-
Filesize
4.6MB
MD55c2e9b897d5181f341d83b57ba94a260
SHA10b4db75e2f00aca9e39661902bfc9256e82a3f10
SHA25614bf48a5661698551bdf6e48278566bf8f445fcd835f2b3f4b69b2fcb3a139ff
SHA512d082a21d33f690c283bfb1333ea894f0078a57bee3a34b0678a5360c5188a636e3ac849e395ce6cd1e44c8a56f92eaf6b496bc6c3497c6f44890caeb6d1269bc
-
Filesize
4.2MB
MD5ea4be5af2baf39e6c38f799f30a30cf7
SHA152d03ed797f6ad324d2e4ab509405ed7e40e561b
SHA2566a55677b25cc4bee0b708a04abe66d78ca82617075de01afe4853ab9d6d524bd
SHA512e2cb8f1a6f632a0e5cba9b86214368afa7b15bbc22725d0cba67fb3b7183b1095f07f94cbd06ea0dc6af7c82d20e57c88e8458ec1b7b835f06a29a10e4a35f98
-
Filesize
6.0MB
MD5c9704931d887685d96ce92d637d84045
SHA10875a71e9118ded121d92f3f46a3af1ec8380f8b
SHA2560448c45cb43585409002e01ef53442cb9f6ad58f211f5deb3ad2ca8b8d535826
SHA5123b739394f69ec9f26ef607a0d481f1ad3d107462220c2281cbc300f16886ab3d857bee9af59b8857c7e7ae5b04e6a849eaa5e304d6935957a0a15e462375c260
-
Filesize
7.4MB
MD573e578a44265558d3ace212869d43cbb
SHA1d2c15578def8996ed0ae4a44754055b774b095a7
SHA2568a6945ead42d78d963d6f2e126eebb89c0e82b02c389d4badcaa837ff49bf7f4
SHA512fe661e19899a6f749a180e5b312fcebb2963acc92720d1c6cabba22b0ffd250f1930c9dac62f789cd4b99aff86ef0f3944ae52a583e2c1be57c9fca391be9bf4
-
Filesize
411B
MD5c2ac85b000427a4a00f19da237aaaf86
SHA1459ecb5e64576348e6c654724e87825772c06ea8
SHA256b5157eceaf9b5f6448d15dcfe7011af0b44a4288f7667c5d717f042c2fba1352
SHA512e62f711445398b0654e698c4f7d4c75bb8693e901ae99f1cf543f45ccd9532daf27bba1ceb9d180d0379a41c9a62d6ee2df30cd25b9abb05532c551a0fad814b
-
Filesize
125KB
MD5b0bcc622f1fff0eec99e487fa1a4ddd9
SHA149aa392454bd5869fa23794196aedc38e8eea6f5
SHA256b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
SHA5121572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7
-
Filesize
6.4MB
MD54505634f3e5588c85940427f4a3276d0
SHA1bbc0ed98b7e548030653df7c7f28a4eee9e0076b
SHA2569d00b8723e5427aefed1cdb68c14014cd46c0a11a8f63143926a3235cd937bf3
SHA512c08c475db90765342417581690e8ee1e7356854663997aa386ccb924f722474c465d8d321be23d3fafbe495a8f3fdaf48b1ed9720e60a2b494be8bc5b630e12c
-
Filesize
96KB
MD59e2c097647125ee25068784acb01d7d3
SHA11a90c40c7f89eec18f47f0dae3f1d5cd3a3d49b5
SHA256b4614281771ed482970fd0d091604b3a65c7e048f7d7fa8794abd0a0c638f5d2
SHA512e2f334f31361ea1ffc206184808cb51002486fe583dc23b4f617bead0e3940fdc97b72cda2a971e2cf00462940b31e065228f643835d156e7166e8803e3181f1
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
4KB