Analysis
-
max time kernel
131s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
06-05-2024 08:36
General
-
Target
Lucasrt.exe
-
Size
11.2MB
-
MD5
51ffec7d16d89f59784e7cfad795df3c
-
SHA1
1c0a5ad4fd9c74f829b63e7b8bfe897120d24f00
-
SHA256
dae52d89f6b61329c806fd90b0e13fc3c3cf2cb5761b50321039b838ac0bc343
-
SHA512
5936e9d854c070e5d3ff8b31937729574a3d6cf69967558d8e6dc0096c720e44df0d59bf5ab419b73c44909d3e04f9b8da47f64c960ac338ff5e73f8749bba5d
-
SSDEEP
98304:G6OwlI2RKvm132+y6gu70DNGyTuM+62wkYePy45CZGXPI+3ZYOx5+to:66fRKvm13Tyw0DNw7CZGg+Jvx5Wo
Score
10/10
Malware Config
Signatures
-
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lucasrt.exe"C:\Users\Admin\AppData\Local\Temp\Lucasrt.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Lucasrt.exeC:\Users\Admin\AppData\Local\Temp\Lucasrt.exe -second2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
11.9MB
-
Filesize
4KB
-
Filesize
11.9MB
-
Filesize
4KB
-
Filesize
11.9MB
-
Filesize
11.9MB
-
Filesize
11.9MB
-
Filesize
11.9MB
-
Filesize
11.9MB
-
Filesize
11.9MB