rms | 15628033cbdd1de5669f28d1e4e0d664d32da400c4294b75297da528487a8139

Analysis

max time kernel
147s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba9b71a9a905a76781fed3a08e796953.exe
Size

2.3MB
MD5

ba9b71a9a905a76781fed3a08e796953
SHA1

b83caebc4927a727efc19e0704fdf636c8ec814a
SHA256

15628033cbdd1de5669f28d1e4e0d664d32da400c4294b75297da528487a8139
SHA512

b3e6410031f7b5e2e653a7c1203e3b06206d74f6133cfdb485bbe5d04daecaab2918670067d051e95cd99f0c5c47bcee7b0b85155f72b76ad3278ad101e34922
SSDEEP

49152:QAJYumA56Qy6sq82PQyN8XEPkNVGsbYGDEPwRk33O8RQRhBrTG0yXeF1F/8gfaoK:7JY7A56Qyn4OVeMswRkfqFTG0UI/xfab

Score

10^/10

rms evasion rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Modifies Windows Firewall 2 TTPs 8 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3236	netsh.exe
1660	netsh.exe
3864	netsh.exe
2024	netsh.exe
4972	netsh.exe
4656	netsh.exe
3476	netsh.exe
2196	netsh.exe

Sets file to hidden 1 TTPs 12 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3452	attrib.exe
4504	attrib.exe
1852	attrib.exe
1332	attrib.exe
3840	attrib.exe
4864	attrib.exe
5108	attrib.exe
3048	attrib.exe
1336	attrib.exe
4948	attrib.exe
2580	attrib.exe
2936	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	ba9b71a9a905a76781fed3a08e796953.exe

Executes dropped EXE 6 IoCs

pid	Process
2176	svchoct.exe
2356	svchoct.exe
3324	svchoct.exe
3924	svchoct.exe
4128	Explorernt.exe
712	Explorernt.exe

Loads dropped DLL 12 IoCs

pid	Process
2176	svchoct.exe
2176	svchoct.exe
2356	svchoct.exe
2356	svchoct.exe
3324	svchoct.exe
3324	svchoct.exe
3924	svchoct.exe
3924	svchoct.exe
4128	Explorernt.exe
4128	Explorernt.exe
712	Explorernt.exe
712	Explorernt.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\catroot3\Explorernt.exe	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\PushSource.ax	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rversionlib.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\exe\svchoct.pdb	svchoct.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfOggMux.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\Explorernt.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\set.reg	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3	attrib.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\Microsoft.VC80.CRT.manifest	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\msvcr80.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\PushSource.ax	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\svchoct.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\HookDrv.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\msvcp80.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\msvcr80.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\RIPCServer.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\rversionlib.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\symbols\exe\svchoct.pdb	svchoct.exe
File created	C:\Windows\SysWOW64\catroot3\dsfOggMux.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\HookDrv.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\msvcp80.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\svchoct.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\svchoct.pdb	svchoct.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\Microsoft.VC80.CRT.manifest	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\RIPCServer.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\set.reg	cmd.exe
File opened for modification	C:\Windows\SysWOW64\svchoct.pdb	svchoct.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2352	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 5 IoCs

evasion

pid	Process
1724	taskkill.exe
2164	taskkill.exe
868	taskkill.exe
2220	taskkill.exe
3500	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	ba9b71a9a905a76781fed3a08e796953.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4368	reg.exe
2620	reg.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2796	regedit.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3924	svchoct.exe
3924	svchoct.exe
3924	svchoct.exe
3924	svchoct.exe
4128	Explorernt.exe
4128	Explorernt.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	868	taskkill.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	3500	taskkill.exe
Token: SeDebugPrivilege	1724	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeDebugPrivilege	2176	svchoct.exe
Token: SeDebugPrivilege	3324	svchoct.exe
Token: SeTakeOwnershipPrivilege	3924	svchoct.exe
Token: SeTcbPrivilege	3924	svchoct.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1664	1964	ba9b71a9a905a76781fed3a08e796953.exe	92
PID 1964 wrote to memory of 1664	1964	ba9b71a9a905a76781fed3a08e796953.exe	92
PID 1964 wrote to memory of 1664	1964	ba9b71a9a905a76781fed3a08e796953.exe	92
PID 1664 wrote to memory of 2148	1664	WScript.exe	94
PID 1664 wrote to memory of 2148	1664	WScript.exe	94
PID 1664 wrote to memory of 2148	1664	WScript.exe	94
PID 1964 wrote to memory of 60	1964	ba9b71a9a905a76781fed3a08e796953.exe	96
PID 1964 wrote to memory of 60	1964	ba9b71a9a905a76781fed3a08e796953.exe	96
PID 1964 wrote to memory of 60	1964	ba9b71a9a905a76781fed3a08e796953.exe	96
PID 2148 wrote to memory of 868	2148	cmd.exe	98
PID 2148 wrote to memory of 868	2148	cmd.exe	98
PID 2148 wrote to memory of 868	2148	cmd.exe	98
PID 2148 wrote to memory of 2220	2148	cmd.exe	100
PID 2148 wrote to memory of 2220	2148	cmd.exe	100
PID 2148 wrote to memory of 2220	2148	cmd.exe	100
PID 2148 wrote to memory of 4928	2148	cmd.exe	101
PID 2148 wrote to memory of 4928	2148	cmd.exe	101
PID 2148 wrote to memory of 4928	2148	cmd.exe	101
PID 2148 wrote to memory of 1336	2148	cmd.exe	102
PID 2148 wrote to memory of 1336	2148	cmd.exe	102
PID 2148 wrote to memory of 1336	2148	cmd.exe	102
PID 2148 wrote to memory of 4864	2148	cmd.exe	103
PID 2148 wrote to memory of 4864	2148	cmd.exe	103
PID 2148 wrote to memory of 4864	2148	cmd.exe	103
PID 2148 wrote to memory of 3840	2148	cmd.exe	104
PID 2148 wrote to memory of 3840	2148	cmd.exe	104
PID 2148 wrote to memory of 3840	2148	cmd.exe	104
PID 2148 wrote to memory of 1332	2148	cmd.exe	105
PID 2148 wrote to memory of 1332	2148	cmd.exe	105
PID 2148 wrote to memory of 1332	2148	cmd.exe	105
PID 2148 wrote to memory of 4948	2148	cmd.exe	106
PID 2148 wrote to memory of 4948	2148	cmd.exe	106
PID 2148 wrote to memory of 4948	2148	cmd.exe	106
PID 2148 wrote to memory of 1852	2148	cmd.exe	107
PID 2148 wrote to memory of 1852	2148	cmd.exe	107
PID 2148 wrote to memory of 1852	2148	cmd.exe	107
PID 2148 wrote to memory of 4504	2148	cmd.exe	108
PID 2148 wrote to memory of 4504	2148	cmd.exe	108
PID 2148 wrote to memory of 4504	2148	cmd.exe	108
PID 2148 wrote to memory of 2580	2148	cmd.exe	109
PID 2148 wrote to memory of 2580	2148	cmd.exe	109
PID 2148 wrote to memory of 2580	2148	cmd.exe	109
PID 2148 wrote to memory of 3048	2148	cmd.exe	110
PID 2148 wrote to memory of 3048	2148	cmd.exe	110
PID 2148 wrote to memory of 3048	2148	cmd.exe	110
PID 2148 wrote to memory of 5108	2148	cmd.exe	111
PID 2148 wrote to memory of 5108	2148	cmd.exe	111
PID 2148 wrote to memory of 5108	2148	cmd.exe	111
PID 2148 wrote to memory of 2936	2148	cmd.exe	112
PID 2148 wrote to memory of 2936	2148	cmd.exe	112
PID 2148 wrote to memory of 2936	2148	cmd.exe	112
PID 2148 wrote to memory of 3452	2148	cmd.exe	113
PID 2148 wrote to memory of 3452	2148	cmd.exe	113
PID 2148 wrote to memory of 3452	2148	cmd.exe	113
PID 2148 wrote to memory of 3912	2148	cmd.exe	114
PID 2148 wrote to memory of 3912	2148	cmd.exe	114
PID 2148 wrote to memory of 3912	2148	cmd.exe	114
PID 3912 wrote to memory of 4112	3912	net.exe	115
PID 3912 wrote to memory of 4112	3912	net.exe	115
PID 3912 wrote to memory of 4112	3912	net.exe	115
PID 2148 wrote to memory of 3500	2148	cmd.exe	116
PID 2148 wrote to memory of 3500	2148	cmd.exe	116
PID 2148 wrote to memory of 3500	2148	cmd.exe	116
PID 2148 wrote to memory of 1724	2148	cmd.exe	117

Views/modifies file attributes 1 TTPs 28 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4216	attrib.exe
4332	attrib.exe
1772	attrib.exe
4604	attrib.exe
2936	attrib.exe
2520	attrib.exe
1224	attrib.exe
2172	attrib.exe
2492	attrib.exe
4532	attrib.exe
3840	attrib.exe
2580	attrib.exe
3048	attrib.exe
3452	attrib.exe
1332	attrib.exe
1916	attrib.exe
3540	attrib.exe
4308	attrib.exe
4864	attrib.exe
5108	attrib.exe
4956	attrib.exe
3340	attrib.exe
4948	attrib.exe
4504	attrib.exe
1852	attrib.exe
2792	attrib.exe
1336	attrib.exe
5080	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ba9b71a9a905a76781fed3a08e796953.exe
"C:\Users\Admin\AppData\Local\Temp\ba9b71a9a905a76781fed3a08e796953.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\stop.js"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
    3⤵
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im RManServer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:868
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im svchoct.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2220
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
      4⤵
      PID:4928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h "C:\Windows\System32\catroot3"
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:1336
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/blat.dll"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4864
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/blat.lib"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3840
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/block_reader.sys"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/HookLib.dll"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/blat.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1852
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/mpr.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/realip.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2580
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/mpr.ini"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3048
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\stop.js"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:5108
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\install.bat"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Windows\System32\de.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3452
  - - C:\Windows\SysWOW64\net.exe
      net stop rserver3
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop rserver3
        5⤵
        
        PID:4112
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rserver3.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3500
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im r_server.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cam_server.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2164
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\system32\cam_server.exe"
      4⤵
      Views/modifies file attributes
      PID:4956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\SysWOW64\cam_server.exe"
      4⤵
      Views/modifies file attributes
      PID:2792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Windows\system32\rserver30"
      4⤵
      Views/modifies file attributes
      PID:1916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Windows\SysWOW64\rserver30"
      4⤵
      Views/modifies file attributes
      PID:2520
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\system32\r_server.exe"
      4⤵
      Views/modifies file attributes
      PID:1224
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\SysWOW64\r_server.exe"
      4⤵
      Views/modifies file attributes
      PID:2172
  - - C:\Windows\SysWOW64\net.exe
      net stop Telnet
      4⤵
      PID:2732
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Telnet
        5⤵
        
        PID:4532
  - - C:\Windows\SysWOW64\sc.exe
      sc config tlntsvr start= disabled
      4⤵
      Launches sc.exe
      PID:2352
  - - C:\Windows\SysWOW64\net.exe
      net stop "Service Host Controller"
      4⤵
      PID:544
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Service Host Controller"
        5⤵
        
        PID:212
  - - C:\Windows\SysWOW64\net.exe
      net user HelpAssistant /delete
      4⤵
      PID:1076
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user HelpAssistant /delete
        5⤵
        
        PID:1580
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /tn security /f
      4⤵
      PID:4356
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="RealIP"
      4⤵
      Modifies Windows Firewall
      PID:3864
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="Microsoft Outlook Express"
      4⤵
      Modifies Windows Firewall
      PID:2024
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="Service Host Controller"
      4⤵
      Modifies Windows Firewall
      PID:4972
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ß½πªí Windows"
      4⤵
      Modifies Windows Firewall
      PID:4656
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ºáñáτ Windows"
      4⤵
      Modifies Windows Firewall
      PID:3476
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall delete portopening tcp 57009
      4⤵
      Modifies Windows Firewall
      PID:2196
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="cam_server"
      4⤵
      Modifies Windows Firewall
      PID:3236
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete portopening tcp 57011 all
      4⤵
      Modifies Windows Firewall
      PID:1660
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Ä»Ñαáµ¿«¡¡á∩ ß¿ßΓÑ¼á Microsoft Windows" /f
      4⤵
      Modifies registry key
      PID:4368
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Service Host Controller" /f
      4⤵
      Modifies registry key
      PID:2620
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v HelpAssistant /f
      4⤵
      PID:4596
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "cam_server.exe" /f
      4⤵
      PID:1556
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\System\CurrentControlSet\Services\RServer3" /f
      4⤵
      PID:3984
  - - C:\Windows\SysWOW64\catroot3\svchoct.exe
      "svchoct.exe" /silentinstall
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:2176
  - - C:\Windows\SysWOW64\catroot3\svchoct.exe
      "svchoct.exe" /firewall
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2356
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s set.reg
      4⤵
      Runs .reg file with regedit
      PID:2796
  - - C:\Windows\SysWOW64\catroot3\svchoct.exe
      "svchoct.exe" /start
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:3324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/blat.dll"
      4⤵
      Views/modifies file attributes
      PID:4216
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/blat.lib"
      4⤵
      Views/modifies file attributes
      PID:3540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/block_reader.sys"
      4⤵
      Views/modifies file attributes
      PID:4604
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/HookLib.dll"
      4⤵
      Views/modifies file attributes
      PID:5080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/blat.exe"
      4⤵
      Views/modifies file attributes
      PID:1772
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/mpr.exe"
      4⤵
      Views/modifies file attributes
      PID:4532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/realip.exe"
      4⤵
      Views/modifies file attributes
      PID:3340
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/mpr.ini"
      4⤵
      Views/modifies file attributes
      PID:2492
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\stop.js"
      4⤵
      Views/modifies file attributes
      PID:4308
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\install.bat"
      4⤵
      Views/modifies file attributes
      PID:4332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  PID:60

C:\Windows\SysWOW64\catroot3\svchoct.exe
C:\Windows\SysWOW64\catroot3\svchoct.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924
- C:\Windows\SysWOW64\catroot3\Explorernt.exe
  C:\Windows\SysWOW64\catroot3\Explorernt.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- C:\Windows\SysWOW64\catroot3\Explorernt.exe
  C:\Windows\SysWOW64\catroot3\Explorernt.exe /tray
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
236B

MD5
450a76c0b6d549f8d7e66c69850445a8

SHA1
8e7fe52eddabd04395877ebd4177efbb74a0bdc7

SHA256
763cffe76d7b9b8101e3423716946a8c8651805e413785787a87f1665357c30f

SHA512
28c092378c365d47d7ad229d3e67f1ba82e875b21c01b34f83e232e3329d28f73b8484a65e3fca85406cb8d6c9716ee433b681c10f08afb4dd8d619e3b12b23d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Explorernt.exe

Filesize
2.8MB

MD5
a0924820769909ca25e9eea948b7d8ad

SHA1
e70e1a1662a4fe966e38218beb777516c3db4e37

SHA256
74fe2a1e6116c5a199dcc6aa738d546bfc55b41edc1b7c5459019e7d18ae5e36

SHA512
e3d5b963b0358b08301eaed387d1d206da408096ca895b6262b2eb79a026314821885477a07fce78b9107b8c8169cc6c4d52e404c4b01b3a8bb33569929b8073

Download Submit
C:\Users\Admin\AppData\Local\Temp\HookDrv.dll

Filesize
144KB

MD5
513066a38057079e232f5f99baef2b94

SHA1
a6da9e87415b8918447ec361ba98703d12b4ee76

SHA256
02dbea75e8dbcdfc12c6b92a6c08efad83d4ca742ed7aee393ab26cab0c58f9e

SHA512
83a074bef57f78ede2488dd586b963b92837e17eea77ebd1464f3da06954ae8ca07f040089af0c257e2836611ae39424574bd365aea4a6318a2707e031cd31a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft.VC80.CRT.manifest

Filesize
1KB

MD5
d34b3da03c59f38a510eaa8ccc151ec7

SHA1
41b978588a9902f5e14b2b693973cb210ed900b2

SHA256
a50941352cb9d8f7ba6fbf7db5c8af95fb5ab76fc5d60cfd0984e558678908cc

SHA512
231a97761d652a0fc133b930abba07d456ba6cd70703a632fd7292f6ee00e50ef28562159e54acc3fc6cc118f766ea3f2f8392579ae31cc9c0c1c0dd761d36f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\PushSource.ax

Filesize
448KB

MD5
d7eb741be9c97a6d1063102f0e4ca44d

SHA1
bf8bdca7f56ed39fb96141ae9593dec497f4e2c8

SHA256
0914ab04bfd258008fec4605c3fa0e23c0d5111b9cfc374cfa4eaa1b4208dff7

SHA512
cbcaedf5aca641313ba2708e4be3ea0d18dd63e4543f2c2fdcbd31964a2c01ff42724ec666da24bf7bf7b8faaa5eceae761edf82c71919753d42695c9588e65e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RIPCServer.dll

Filesize
96KB

MD5
329354f10504d225384e19c8c1c575db

SHA1
9ef0b6256f3c5bbeb444cb00ee4b278847e8aa66

SHA256
24735b40df2cdac4da4e3201fc597eed5566c5c662aa312fa491b7a24e244844

SHA512
876585dd23f799f1b7cef365d3030213338b3c88bc2b20174e7c109248319bb5a3feaef43c0b962f459b2f4d90ff252c4704d6f1a0908b087e24b4f03eba9c0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsfOggMux.dll

Filesize
84KB

MD5
65889701199e41ae2abee652a232af6e

SHA1
3f76c39fde130b550013a4f13bfea2862b5628cf

SHA256
ef12a65d861a14aed28480946bc56fce479a21e9beac2983239eac6551d4f32e

SHA512
edbb1a1541a546d69e3fd64047a20613b47b3c08f2b639a53160b825c4a1462c4cc08a7bf417aa2db814f412fb16619c6c0d9364e21cc1c6d753ecf81f1d30f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsfTheoraEncoder.dll

Filesize
240KB

MD5
5f2fc8a0d96a1e796a4daae9465f5dd6

SHA1
224f13f3cbaa441c0cb6d6300715fda7136408ea

SHA256
f8686d8752801bb21c3d94ebe743758d79b9b59f33589ec8620e75a949d1871f

SHA512
da866275159b434205f259176c3937b7c77b14ed95d052152b05b984909e094bbd3b2702d3e874a4a1e1bc02fc5a8476ea43df8aee43542d56e832eacc8f54ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsfVorbisEncoder.dll

Filesize
1.6MB

MD5
086a9fd9179aad7911561eeff08cf7e2

SHA1
d390c28376e08769a06a4a8b46609b3a668f728b

SHA256
2cede6701b73a4ddd6422fde157ea54644a3a9598b3ba217cf2b30b595cf6282

SHA512
a98f593a306208da49e57e265daf37d6b1bd9f190fba45d65dd6cfa08801b760f540ea5cc443f9a1512eb5ddc01b1e4e28fc8ddecb9c0f1d42c884c4efaa7193

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.bat

Filesize
5KB

MD5
0bc7d3a303e0c6d7d84f1db5d5efef43

SHA1
93bc6ca6f770ec2c6f99a5bb3d482fd029bc2c63

SHA256
e61b80f090c29a367f6ab31602da917a9d67a1be5ef0d758f258b792e219913c

SHA512
b5e801510b8464fc387521853fb09174ce16d54e70bd0d145d717f965e6df04fcfea4a6687c2ae8ac3f95d59ed6027fb7a337b50d962f0aaeed71d85219b8d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\msvcp80.dll

Filesize
541KB

MD5
8c53ccd787c381cd535d8dcca12584d8

SHA1
bc7ce60270a58450596aa3e3e5d0a99f731333d9

SHA256
384aaee2a103f7ed5c3ba59d4fb2ba22313aaa1fbc5d232c29dbc14d38e0b528

SHA512
e86c1426f1ad62d8f9bb1196dee647477f71b9aacafabb181f35e639c105779f95f1576b72c0a9216e876430383b8d44f27748b13c25e0548c254a0f641e4755

Download Submit
C:\Users\Admin\AppData\Local\Temp\msvcr80.dll

Filesize
617KB

MD5
1169436ee42f860c7db37a4692b38f0e

SHA1
4ccd15bf2c1b1d541ac883b0f42497e8ced6a5a3

SHA256
9382aaed2db19cd75a70e38964f06c63f19f63c9dfb5a33b0c2d445bb41b6e46

SHA512
e06064eb95a2ab9c3343672072f5b3f5983fc8ea9e5c92f79e50ba2e259d6d5fa8ed97170dea6d0d032ea6c01e074eefaab850d28965c7522fb7e03d9c65eae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\rversionlib.dll

Filesize
310KB

MD5
3f95a06f40eaf51b86cef2bf036ebd7a

SHA1
64009c5f79661eb2f82c9a76a843c0d3a856695d

SHA256
1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d

SHA512
6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897

Download Submit
C:\Users\Admin\AppData\Local\Temp\set.reg

Filesize
12KB

MD5
05fc6abd61e51d085c0d8a4865214849

SHA1
a48f10e8835f4db8d7a276227921f2339b8729cf

SHA256
084ff031d15562bb8e56fea45eb5c52a7e333ccaf21df76bdc7e3c41b1638544

SHA512
97cad9f7197ebc0a173cbd9419c1cd3097718bd94fd6e1c138830944a81e13f9d04ebe491e29310312e977e5b20e0f3782fe37936ceaa7b536bf1fd65154aef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\stop.js

Filesize
215B

MD5
804b35ef108ec9839eb6a9335add8ca1

SHA1
bf91e6645c4a1c8cab2d20388469da9ed0a82d56

SHA256
fe111b7ea4e14ab7ba5004aea52b10030e0282bb5c40d4ba55761a2c5be59406

SHA512
822a3ec5e0e353058d4355bc01a44440dafe8d16c57744a3dcbc962eb110ed3f6843556568616bfc5dc7fad5f5832cd27d6591dc50105f2c79fc16c33919936d

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchoct.exe

Filesize
3.2MB

MD5
8ae3deecb2b1f16a7adcf3aeaffb487d

SHA1
0370c0e6b81dea9df7737923cfe36aebdd1623b6

SHA256
502092b56790f889fe210b67da27dfe32c434c7e5e8d3e9625dc13381853fbac

SHA512
59534db91aecdd9ee65fad026fdd719a22f9d6dad2682cfa97776fe75b4bd9807acb41a2589229c418b77caabcb7f538d168207e2f6f5adaf64a7b13930db1f5

Download Submit
C:\Windows\SysWOW64\catroot3\Explorernt.exe

Filesize
522KB

MD5
4b73a9f1ba1319959e90005ed1cb9ee5

SHA1
c45bf7c46ea480e6a9d1aa6cf27fccec8f54f145

SHA256
4a5ea0fdecb969488accfe8d2bc57c17a42e2440d8fef8930bc9bebef06a288b

SHA512
72c20e67b707c01271813eb5b06648d09569be86f5b4e5279e685ef86482214cb50636c1ba9901ba64569af7f415346a157c514a2ba62ec4cc77474f160b8907

Download Submit
C:\Windows\SysWOW64\catroot3\Explorernt.exe

Filesize
552KB

MD5
d24cdf42960f4c110ba4e27a4660e4da

SHA1
f611641cbdb088b5693e322afd6030e5f204aee5

SHA256
f3203cb6ab6c476eddf094502b09f69e8c0caffe9e049f703265fe6d69aa73ec

SHA512
a112a9dd80362fef899575557a0cccb97669dc7646178eedb7f4192890d993b025b02662d77dc4d110df072e9e1bebdcb169e9e95923d3823af305738d9f0261

Download Submit
C:\Windows\SysWOW64\catroot3\Explorernt.exe

Filesize
456KB

MD5
426bedd29cf57b64ee04e9a7ec3cbb70

SHA1
1755f9614501cab249a4c968d4c1f590221df88d

SHA256
9467a458b9ad74f2475e52c262ea055bb7687ae3ace7f9ced910dc8e82b4c0f8

SHA512
d6656d91a88784fffc5103d679525c5a587da1023fd1eadfabbe2f27e16994e6614b3f71d934c402bd570f0866f62967db3fb3c16d097547a997888795b6d0c1

Download Submit
C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll

Filesize
561KB

MD5
4db1ab2413d175cdd03ca984aa1f97ac

SHA1
764bce006389633dffda36a3f33bdbe3334f4463

SHA256
a9034b0179c9c4d7df5259d178d9b8b9e4e6db0ddd3012df285826f751ad8ebf

SHA512
9c55afc5fe8c49ac55c6390fc678e6ef8f30b350c41348d21703022840a46d9d1b60baef2ce73d93264b2c92e4a5a825d72d0e869b27a3c659ec121e828a1ad1

Download Submit
C:\Windows\SysWOW64\catroot3\msvcr80.dll

Filesize
581KB

MD5
9b917ad1c5350fc8d8f007cf69ba298e

SHA1
de9fadbe7740c88d3f7924591ba4f49d8d8dd8e1

SHA256
54c877c5e40fe47741c18572a6c770dee0970e19d00736cebe6fa2ef1618a02f

SHA512
257cd5c999cc591939cfbb23148fc0334fc66ec5887fc90d63f41db7e716eb300949f5fa3ce187c01f0f8fba2a74d0bde3a742fb4c58e4e4c77a9e8dde123fef

Download Submit
C:\Windows\SysWOW64\catroot3\svchoct.exe

Filesize
660KB

MD5
6fe19ddaf9520ad1fbcc211160912ec7

SHA1
736b2f928f009c0b081aaf8424434be485e4f9e3

SHA256
f78b83664381d4a1429040caa7d934b839cdc8479ac3a83aeab743ed2cae6e47

SHA512
f6989e935b39550bcc9fa0664ec45d14239085a9d23471c8af3f9dce01caf78ab86353c0266d5278b9ca8267fdefa5ac8940dbe2179e89cf31bfeb55761a9d32

Download Submit
C:\Windows\SysWOW64\catroot3\svchoct.exe

Filesize
1.6MB

MD5
08e3a7a0f7da55991f21df0fd2052f48

SHA1
8a020d917d7f71078078b44ab7a9c6ea31966130

SHA256
a0d4f3b51b4f606ab5f0dea016d8cfc4f14c5518c4b51d95640cdb9780e4ebfa

SHA512
32af965e4e0ebc6d736f9f2d6188015524e25503766eca2c11afae69bd083b6ca881920b9afd3e7056e4313968f180f1d99941b3ba1732d97e8701379e2811d4

Download Submit
C:\Windows\SysWOW64\catroot3\svchoct.exe

Filesize
1.7MB

MD5
4d6152badd07ef1852bd2c3fb288b9f0

SHA1
468fab39b519d16b00140ce2f5aade48b72bf764

SHA256
579b96d0bcd0f2a67854d83f54871e59583e713591382a7500bfd27edb54c13a

SHA512
cc7831f6d1906f575e1bb9f5d9e9fce3bc239e75b6f31c6628604df6bdcbf22fb4fe9da811ee1c87bae108f000bdba2d3dff0510dde31658ed9bec2df686e3c7

Download Submit
C:\Windows\SysWOW64\catroot3\svchoct.exe

Filesize
882KB

MD5
720d4ed3daa85d6aace73c023540aa09

SHA1
f5e97dbed6127e12bc88117d7fb67dfa7759022d

SHA256
6f84413c20c08b2a451ae3e3e03f527bf32b2c9bffaffcd984337934ca7bc459

SHA512
50a7cd7f6a700589e111419dcea1162fe0b39d96cc1f92c4733776249f95a5a516b84a4c432994bf06ba17c88c6d5a4c6921bd45e479544c1f91bc0d45e0b991

Download Submit
C:\Windows\SysWOW64\catroot3\svchoct.exe

Filesize
686KB

MD5
f0c9db5be2f1053bc21b8a858fa2914e

SHA1
b9381a6e607fc660404e33d8a33e74c6497f508d

SHA256
58cec51c0674e53160151733d244f2217d8b5c3461feff7ab924ea48cd6d4c1a

SHA512
10779ee785e1db691d82ce967d8df21b7e48914272b4bf88d9151df928830ce425033aaea6ee586bca7f55469e0a96353ea4b9d1be4c69f3a3d9868e35b371fb

Download Submit
C:\Windows\SysWOW64\catroot3\svchoct.exe

Filesize
610KB

MD5
a3088f6944b9f49a0dd0da4e4674a91a

SHA1
1b138bcc04ad91451ab2fc211ecf390bba04d26b

SHA256
a982a5515e253a7317bdf3bbade08ced646990c93b1646093fe556f9e6970b1f

SHA512
474f66d48a784bb548013e2c6680475d0a6c8e9f7659c8db3f29c507fc882660033febdb2591d5d21af222cdb2799221e44381b7949da4814074382d5c5c18b6

Download Submit
memory/712-139-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/712-124-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/712-132-0x0000000000AA0000-0x0000000000AF8000-memory.dmp

Filesize
352KB

Download
memory/712-131-0x0000000000400000-0x0000000000757000-memory.dmp

Filesize
3.3MB

Download
memory/712-170-0x0000000000400000-0x0000000000757000-memory.dmp

Filesize
3.3MB

Download
memory/712-120-0x0000000000AA0000-0x0000000000AF8000-memory.dmp

Filesize
352KB

Download
memory/2176-133-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/2176-85-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/2176-86-0x0000000000D90000-0x0000000000DE8000-memory.dmp

Filesize
352KB

Download
memory/2176-84-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/2176-83-0x0000000000D90000-0x0000000000DE8000-memory.dmp

Filesize
352KB

Download
memory/2356-92-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/2356-90-0x0000000000810000-0x0000000000868000-memory.dmp

Filesize
352KB

Download
memory/2356-91-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/2356-93-0x0000000000810000-0x0000000000868000-memory.dmp

Filesize
352KB

Download
memory/3324-99-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/3324-121-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/3324-123-0x0000000000C50000-0x0000000000CA8000-memory.dmp

Filesize
352KB

Download
memory/3324-98-0x0000000000C50000-0x0000000000CA8000-memory.dmp

Filesize
352KB

Download
memory/3924-129-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/3924-130-0x0000000000C40000-0x0000000000C98000-memory.dmp

Filesize
352KB

Download
memory/3924-103-0x0000000000C40000-0x0000000000C98000-memory.dmp

Filesize
352KB

Download
memory/3924-104-0x00000000012B0000-0x00000000012B1000-memory.dmp

Filesize
4KB

Download
memory/3924-134-0x00000000012B0000-0x00000000012B1000-memory.dmp

Filesize
4KB

Download
memory/3924-135-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/3924-136-0x0000000000C40000-0x0000000000C98000-memory.dmp

Filesize
352KB

Download
memory/3924-172-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/4128-122-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/4128-117-0x0000000000C00000-0x0000000000C58000-memory.dmp

Filesize
352KB

Download
memory/4128-125-0x0000000000400000-0x0000000000757000-memory.dmp

Filesize
3.3MB

Download
memory/4128-126-0x0000000000C00000-0x0000000000C58000-memory.dmp

Filesize
352KB

Download