rms | d7841d55e43d7bc435dadaae9997d975ed0001ab18fa4f7e4f2fce6a36105093 | Triage

Sharing

General

Target

00542b9d21af209948ad923d035e53fe_JaffaCakes118
Size

2.3MB
Sample

240622-abbjqsxakb
MD5

00542b9d21af209948ad923d035e53fe
SHA1

eeb88fcc92a58309dd26019052a7ae5bcfc02110
SHA256

d7841d55e43d7bc435dadaae9997d975ed0001ab18fa4f7e4f2fce6a36105093
SHA512

8a01d01f7bd7df1a7371cda7158c1e69dcc98d078af626eb47ac4f1cc7e78aa67008210ad850f4a1bfbcd4e1f2b39e3c669eb4425e8acb85ef97585d6169b69e
SSDEEP

49152:tglKw04wX6NOzrqYFxZoZ3H0sm9NnlKGDMeXOIpaQqGcKX:tOK7lzOYF4JH03JKvuOqn

Score

10^/10

rms evasion execution persistence privilege_escalation rat trojan upx

Malware Config

Targets

- Target
  
  00542b9d21af209948ad923d035e53fe_JaffaCakes118
- Size
  
  2.3MB
- MD5
  
  00542b9d21af209948ad923d035e53fe
- SHA1
  
  eeb88fcc92a58309dd26019052a7ae5bcfc02110
- SHA256
  
  d7841d55e43d7bc435dadaae9997d975ed0001ab18fa4f7e4f2fce6a36105093
- SHA512
  
  8a01d01f7bd7df1a7371cda7158c1e69dcc98d078af626eb47ac4f1cc7e78aa67008210ad850f4a1bfbcd4e1f2b39e3c669eb4425e8acb85ef97585d6169b69e
- SSDEEP
  
  49152:tglKw04wX6NOzrqYFxZoZ3H0sm9NnlKGDMeXOIpaQqGcKX:tOK7lzOYF4JH03JKvuOqn
Score

10^/10

rms evasion execution persistence privilege_escalation rat trojan upx
- Disables service(s)
  evasion execution
- RMS
  Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
  trojan rat rms
- Modifies Windows Firewall
  evasion
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

rmsevasionexecutionpersistenceprivilege_escalationrattrojanupx

behavioral2

rmsevasionexecutionpersistenceprivilege_escalationrattrojanupx