Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    05-07-2024 23:21

General

  • Target

    $_1_/emperor.exe

  • Size

    11.2MB

  • MD5

    4912f4062c8f32f2bc19a9866b11b4b6

  • SHA1

    7162ef0c1286f358a755d481cc08ffe720ae0b5e

  • SHA256

    38c164ea976d3e5da89243559a1b28aed2afc6e4a29a60e8bd6e4c1cfbbf3511

  • SHA512

    98301542f398f99fd6ab6539d42cb41aca0b5c3f00357ce7dcdfce67a2a1dbf664886bdf97503201391e23ac127e1541654f4bb4ed6b833edfdc42a3038887ed

  • SSDEEP

    98304:16OwlI2RKvm132+y6g270DNGyTuE+62IkYePy456ZGXrX+3ZYOx5nPtc:T6fRKvm13Tyo0DNwb6ZGL+Jvx5nlc

Score
10/10

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$_1_\emperor.exe
    "C:\Users\Admin\AppData\Local\Temp\$_1_\emperor.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:484
    • C:\Users\Admin\AppData\Local\Temp\$_1_\emperor.exe
      C:\Users\Admin\AppData\Local\Temp\$_1_\emperor.exe -second
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/484-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/484-1-0x0000000000400000-0x0000000000FE0000-memory.dmp

    Filesize

    11.9MB

  • memory/2272-2-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2272-8-0x0000000000400000-0x0000000000FE0000-memory.dmp

    Filesize

    11.9MB

  • memory/2272-9-0x0000000000400000-0x0000000000FE0000-memory.dmp

    Filesize

    11.9MB

  • memory/2272-10-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2272-12-0x0000000000400000-0x0000000000FE0000-memory.dmp

    Filesize

    11.9MB

  • memory/2272-17-0x0000000000400000-0x0000000000FE0000-memory.dmp

    Filesize

    11.9MB

  • memory/2272-19-0x0000000000400000-0x0000000000FE0000-memory.dmp

    Filesize

    11.9MB

  • memory/2272-22-0x0000000000400000-0x0000000000FE0000-memory.dmp

    Filesize

    11.9MB

  • memory/2272-23-0x0000000000400000-0x0000000000FE0000-memory.dmp

    Filesize

    11.9MB