Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 01:35
Behavioral task
behavioral1
Sample
19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25.exe
Resource
win7-20240508-en
General
-
Target
19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25.exe
-
Size
17.2MB
-
MD5
4fb2e04c13d6e6f444639b0ecc9a69c3
-
SHA1
9884b3332ee0c0d3eb739c8c77f46f6385005198
-
SHA256
19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25
-
SHA512
cf8969c5c69b5210a092f74d55c728d2ad067a6302bb793491f218918dfa6fb21cb7ac3b3f8e81e05ebbded9a3c44cf780069e21d85e69481080f0e84130b670
-
SSDEEP
393216:K9F87Bt4t6JCvP7ZfKBbd78rjI6ogQINazTsvzfUuEQ9L+z37:GUBtK82P7ZfKBh8rjI1IyTsvQu/9L+f
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2236-0-0x0000000000400000-0x00000000029A1000-memory.dmp upx behavioral1/memory/2236-81-0x0000000000400000-0x00000000029A1000-memory.dmp upx -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rfusclient.exerutserv.exerfusclient.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\International\Geo\Nation rfusclient.exe Key value queried \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\International\Geo\Nation rutserv.exe Key value queried \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\International\Geo\Nation rfusclient.exe -
Executes dropped EXE 4 IoCs
Processes:
rfusclient.exerutserv.exerutserv.exerfusclient.exepid process 2612 rfusclient.exe 1128 rutserv.exe 1504 rutserv.exe 1628 rfusclient.exe -
Loads dropped DLL 9 IoCs
Processes:
19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25.exerfusclient.exerutserv.exerutserv.exepid process 2236 19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25.exe 2612 rfusclient.exe 2612 rfusclient.exe 2612 rfusclient.exe 2612 rfusclient.exe 1128 rutserv.exe 1128 rutserv.exe 1504 rutserv.exe 1504 rutserv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 4 IoCs
Processes:
rutserv.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\SysWOW64\ieframe.dll,-5723 = "The Internet" rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\prnfldr.dll,-8036 = "Printers" rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\NetworkExplorer.dll,-1 = "Network" rutserv.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
rfusclient.exerutserv.exerutserv.exerfusclient.exepid process 2612 rfusclient.exe 2612 rfusclient.exe 1128 rutserv.exe 1128 rutserv.exe 1128 rutserv.exe 1128 rutserv.exe 1128 rutserv.exe 1128 rutserv.exe 1504 rutserv.exe 1504 rutserv.exe 1504 rutserv.exe 1504 rutserv.exe 1504 rutserv.exe 1504 rutserv.exe 1628 rfusclient.exe 1628 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
rutserv.exerutserv.exedescription pid process Token: SeDebugPrivilege 1128 rutserv.exe Token: SeTakeOwnershipPrivilege 1504 rutserv.exe Token: SeTcbPrivilege 1504 rutserv.exe Token: SeTcbPrivilege 1504 rutserv.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
rfusclient.exepid process 1628 rfusclient.exe 1628 rfusclient.exe 1628 rfusclient.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
rfusclient.exepid process 1628 rfusclient.exe 1628 rfusclient.exe 1628 rfusclient.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
rutserv.exerutserv.exepid process 1128 rutserv.exe 1128 rutserv.exe 1128 rutserv.exe 1128 rutserv.exe 1504 rutserv.exe 1504 rutserv.exe 1504 rutserv.exe 1504 rutserv.exe 1504 rutserv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25.exerfusclient.exerutserv.exedescription pid process target process PID 2236 wrote to memory of 2612 2236 19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25.exe rfusclient.exe PID 2236 wrote to memory of 2612 2236 19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25.exe rfusclient.exe PID 2236 wrote to memory of 2612 2236 19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25.exe rfusclient.exe PID 2236 wrote to memory of 2612 2236 19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25.exe rfusclient.exe PID 2612 wrote to memory of 1128 2612 rfusclient.exe rutserv.exe PID 2612 wrote to memory of 1128 2612 rfusclient.exe rutserv.exe PID 2612 wrote to memory of 1128 2612 rfusclient.exe rutserv.exe PID 2612 wrote to memory of 1128 2612 rfusclient.exe rutserv.exe PID 1504 wrote to memory of 1628 1504 rutserv.exe rfusclient.exe PID 1504 wrote to memory of 1628 1504 rutserv.exe rfusclient.exe PID 1504 wrote to memory of 1628 1504 rutserv.exe rfusclient.exe PID 1504 wrote to memory of 1628 1504 rutserv.exe rfusclient.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25.exe"C:\Users\Admin\AppData\Local\Temp\19f95db09b659ec363b560cc4e7161bd51e18fe5b3c4ed5199708de544c11f25.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Roaming\RMS Agent\70220\B19343CD17\rfusclient.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\70220\B19343CD17\rfusclient.exe" -run_agent2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Roaming\RMS Agent\70220\B19343CD17\rutserv.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\70220\B19343CD17\rutserv.exe" -run_agent3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1128 -
C:\Users\Admin\AppData\Roaming\RMS Agent\70220\B19343CD17\rutserv.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\70220\B19343CD17\rutserv.exe" -run_agent -second4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Roaming\RMS Agent\70220\B19343CD17\rfusclient.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\70220\B19343CD17\rfusclient.exe" /tray /user5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1628
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD57fd09e69fa62629a04d1e23bb8ca5ff6
SHA13952c5f339c8bbdf17aff113bcb0149ac8ce4fa6
SHA256f9c56736029b7d278bf8fabc6e0f5bdac67e24b088f2172ea07df2baa3072c19
SHA512e66d523eb5bdfc517749b608ffcd66b883be9c4b8c5c42dbf7e48fe412a5c0ca0876d0dbc8a68355e7bb532ce8749c5e444a25f996b4c27e382e79579ab2b59a
-
Filesize
314B
MD5a8bebf98e8c74d6a9f0a8d5ad93d0acf
SHA1a2ba3cf43d7afb8d76c5dfd804ec627503b6ce65
SHA256754700b1c6bcfdac1ed9f4e936a55a102fae9d174b8058a15bdccc6c43e0aa07
SHA512b02bc2327ab50af74b9b8e4d289c92bd90156a1ca7697a2fbd7609125fd2f82e19d9ff0cd99da12ea9e237de78547c88a723547d586f14a5b82ab2590fbb2ea4
-
Filesize
51KB
MD54e84df6558c385bc781cddea34c9fba3
SHA16d63d87c19c11bdbfa484a5835ffffd7647296c8
SHA2560526073f28a3b5999528bfa0e680d668922499124f783f02c52a3b25c367ef6d
SHA512c35da0744568bfffeff09e6590d059e91e5d380c5feb3a0fbc5b19477ceca007a882884a7033345ce408fce1deac5248ad9b046656478d734fe494b787f8a9f2
-
Filesize
1.3MB
MD55222eaf78313758b0520be16e3f8392e
SHA19c7cc8fb340618fef38422cf0c75c4c9bfb216e2
SHA2564771b71a48190504094d104087dd431c1c40bde6fad0338a86aa42f7f2a457a5
SHA512459503146f963c64777c56176e480e3334c5bcff2bfef14fc2925b38f1f32117c387dc957789e1691a68798c004c9e672460bda51edcc7b45fb0e1553bf66812
-
Filesize
110KB
MD57cd22de82ee1ba7ceda6fae9532805a8
SHA12eb959a8e390e91924f8873c9ff953b7f42ab54f
SHA256d48a751c34e679cbafa29b2ae1ff178d2a4b19b260fe8a9f6f3dc18da81bd36d
SHA51215dc9f6dc77ea72299882c20c3238d713fb6acbb1c7beba8e6bb6e158ffbeea4046e83d78daa22b7f71e7c58d6c8ee8989d51d3859c9961a0b621b164c74beea
-
Filesize
10.3MB
MD52edafb34eb63daee875fecc5b19246a2
SHA12a43141312241ba7f3830242f6934a0e1203350d
SHA256cf49b75a2d687a2699a32f34bbebca1e5b65421ce0828c22e226dda1e26dd28b
SHA512cf732dfc0151ece0fcd637ee1cd9d59a1728a587f6922646465c03b347a235211fe38459e96c7304cf88418a886a5441c93ee31e16b7917c94347013fdc606b3
-
Filesize
20.2MB
MD54bd8516dc7c798b63b69b7b668d4fc20
SHA157f3a92681aa9e4a57ddf9b0ac5091c0e393053e
SHA256399f620d9b547d9f9e5d41067e6cbe2d58714d4991901180fbac5661b149d077
SHA51271469af6064d3e1d279a7b249d4cd18e8cf4abbf8375f35ca1f7287ae7b29848bb23dbfe0cc2962283a9fae6886aa64d328e165de9eb2198b82a6803ff348d81
-
Filesize
7KB
MD5394bbd5e34be1365a969a64a0acceb38
SHA1041da706cd0bce4b787dca9cccc4da14ddd0aac2
SHA256f2d6b96469b7b0ac033cca1db9b8ede063ba74dc7168cb06f0b11f534c58ce33
SHA512ac0d6f7aa1a0844fb2956946a616507c0b6e2ec71549aa97d656c0a8e77f555cf99725819995fcb1ab38206f442ea84e55e9bf2500ef6734908e7be8da15a16c
-
Filesize
337KB
MD590a4b7fc6807693e68dd32b68614d989
SHA1785484ef531ca90f323d5b017fefcff05e68093a
SHA2564f475bd6235d2f761f6c6dbdf3f4b2f35fc6a3787e6b1b28a1912e85cb9be2f6
SHA51297b970cb24774f141042149ac53e45b3fc42f9ce911c0ca774aa3812f48d7744434bf31d217b2a8522439d0e3f71048cc916556c18a71be61b203c942373a81c
-
Filesize
379KB
MD5e247666cdea63da5a95aebc135908207
SHA14642f6c3973c41b7d1c9a73111a26c2d7ac9c392
SHA256b419ed0374e3789b4f83d4af601f796d958e366562a0aaea5d2f81e82abdcf33
SHA51206da11e694d5229783cfb058dcd04d855a1d0758beeaa97bcd886702a1502d0bf542e7890aa8f2e401be36ccf70376b5c091a5d328bb1abe738bc0798ab98a54
-
Filesize
1.6MB
MD5d5c2a6ac30e76b7c9b55adf1fe5c1e4a
SHA13d841eb48d1a32b511611d4b9e6eed71e2c373ee
SHA25611c7004851e6e6624158990dc8abe3aa517bcab708364d469589ad0ca3dba428
SHA5123c1c7fb535e779ac6c0d5aef2d4e9239f1c27136468738a0bd8587f91b99365a38808be31380be98fd74063d266654a6ac2c2e88861a3fe314a95f1296699e1d
-
Filesize
259KB
MD549c51ace274d7db13caa533880869a4a
SHA1b539ed2f1a15e2d4e5c933611d736e0c317b8313
SHA2561d6407d7c7ffd2642ea7f97c86100514e8e44f58ff522475cb42bcc43a1b172b
SHA51213440009e2f63078dce466bf2fe54c60feb6cedeed6e9e6fc592189c50b0780543c936786b7051311089f39e9e3ccb67f705c54781c4cae6d3a8007998befbf6
-
Filesize
364KB
MD5eda07083af5b6608cb5b7c305d787842
SHA1d1703c23522d285a3ccdaf7ba2eb837d40608867
SHA256c4683eb09d65d692ca347c0c21f72b086bd2faf733b13234f3a6b28444457d7d
SHA512be5879621d544c4e2c4b0a5db3d93720623e89e841b2982c7f6c99ba58d30167e0dd591a12048ed045f19ec45877aa2ef631b301b903517effa17579c4b7c401
-
Filesize
859KB
MD5642dc7e57f0c962b9db4c8fb346bc5a7
SHA1acee24383b846f7d12521228d69135e5704546f6
SHA25663b4b5db4a96a8abec82b64034f482b433cd4168c960307ac5cc66d2fbf67ede
SHA512fb163a0ce4e3ad0b0a337f5617a7bf59070df05cc433b6463384e8687af3edc197e447609a0d86fe25ba3ee2717fd470f2620a8fc3a2998a7c3b3a40530d0bae