Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
05-07-2024 23:21
General
-
Target
$_1_/emperor.exe
-
Size
11.2MB
-
MD5
4912f4062c8f32f2bc19a9866b11b4b6
-
SHA1
7162ef0c1286f358a755d481cc08ffe720ae0b5e
-
SHA256
38c164ea976d3e5da89243559a1b28aed2afc6e4a29a60e8bd6e4c1cfbbf3511
-
SHA512
98301542f398f99fd6ab6539d42cb41aca0b5c3f00357ce7dcdfce67a2a1dbf664886bdf97503201391e23ac127e1541654f4bb4ed6b833edfdc42a3038887ed
-
SSDEEP
98304:16OwlI2RKvm132+y6g270DNGyTuE+62IkYePy456ZGXrX+3ZYOx5nPtc:T6fRKvm13Tyo0DNwb6ZGL+Jvx5nlc
Score
10/10
Malware Config
Signatures
-
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$_1_\emperor.exe"C:\Users\Admin\AppData\Local\Temp\$_1_\emperor.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\$_1_\emperor.exeC:\Users\Admin\AppData\Local\Temp\$_1_\emperor.exe -second2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
11.9MB
-
Filesize
11.9MB
-
Filesize
4KB
-
Filesize
11.9MB
-
Filesize
11.9MB
-
Filesize
11.9MB
-
Filesize
11.9MB
-
Filesize
11.9MB
-
Filesize
11.9MB
-
Filesize
4KB
-
Filesize
11.9MB