Overview

overview

10

Static

static

7

90f414ca8e...b4.exe

windows7-x64

10

90f414ca8e...b4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-08-2024 17:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    90f414ca8e7fe410a19ea1be7895f8b7df55b35d4289f1bd7c8900b2c886f4b4.exe

  • Size

    9.4MB

  • MD5

    6fde344165a369c3586a68317279247c

  • SHA1

    e39b5038f44757a7049c4ebabbd6f62deb280796

  • SHA256

    90f414ca8e7fe410a19ea1be7895f8b7df55b35d4289f1bd7c8900b2c886f4b4

  • SHA512

    880650d5db061a4aab3df0c99ed1871de4347fb6ed7305c596fa4b75ec57e9c7acecebeeef675ba864d727a898963fe397af08a5d71e7993289299764931349a

  • SSDEEP

    196608:uQmw1JCIvqD9gd1lqFxsPE41SfWj+gzjt5s9di7aH6CcvG:uQr9qFxOE41+Wj5zjLs9U7aaRvG

Score
10/10
rmsdiscoveryevasionlateral_movementpersistenceprivilege_escalationratthemidatrojan

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Remote Service Session Hijacking: RDP Hijacking 1 TTPs 3 IoCs

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Themida packer 13 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies registry class 3 IoCs
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\90f414ca8e7fe410a19ea1be7895f8b7df55b35d4289f1bd7c8900b2c886f4b4.exe
    "C:\Users\Admin\AppData\Local\Temp\90f414ca8e7fe410a19ea1be7895f8b7df55b35d4289f1bd7c8900b2c886f4b4.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winsers" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC MINUTE /MO 1 /RL HIGHEST
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3136
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winser" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC ONLOGON /RL HIGHEST
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3312
    • C:\ProgramData\Windows Tasks Service\winserv.exe
      "C:\ProgramData\Windows Tasks Service\winserv.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3372
      • C:\ProgramData\Windows Tasks Service\winserv.exe
        "C:\ProgramData\Windows Tasks Service\winserv.exe" -second
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:444
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c net user John 12345 /add
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2200
      • C:\Windows\system32\net.exe
        net user John 12345 /add
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2488
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 user John 12345 /add
          4⤵
            PID:4504
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c net localgroup "Администраторы" John /add
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3280
        • C:\Windows\system32\net.exe
          net localgroup "Администраторы" John /add
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5112
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 localgroup "Администраторы" John /add
            4⤵
              PID:1616
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного рабочего стола" John /add
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3520
          • C:\Windows\system32\net.exe
            net localgroup "Пользователи удаленного рабочего стола" John /add
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4032
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
              4⤵
                PID:2512
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного управления" john /add" John /add
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3292
            • C:\Windows\system32\net.exe
              net localgroup "Пользователи удаленного управления" john /add" John /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2748
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" john /add" John /add
                4⤵
                  PID:3556
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c net localgroup "Administrators" John /add
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4484
              • C:\Windows\system32\net.exe
                net localgroup "Administrators" John /add
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2768
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 localgroup "Administrators" John /add
                  4⤵
                    PID:4488
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c net localgroup "Administradores" John /add
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3936
                • C:\Windows\system32\net.exe
                  net localgroup "Administradores" John /add
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4624
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 localgroup "Administradores" John /add
                    4⤵
                      PID:2124
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" john /add
                  2⤵
                  • Remote Service Session Hijacking: RDP Hijacking
                  • Suspicious use of WriteProcessMemory
                  PID:224
                  • C:\Windows\system32\net.exe
                    net localgroup "Remote Desktop Users" john /add
                    3⤵
                    • Remote Service Session Hijacking: RDP Hijacking
                    • Suspicious use of WriteProcessMemory
                    PID:4920
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 localgroup "Remote Desktop Users" john /add
                      4⤵
                      • Remote Service Session Hijacking: RDP Hijacking
                      PID:1084
                • C:\ProgramData\RDPWinst.exe
                  C:\ProgramData\RDPWinst.exe -i
                  2⤵
                  • Server Software Component: Terminal Services DLL
                  • Executes dropped EXE
                  • Modifies WinLogon
                  • Drops file in System32 directory
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4640
                  • C:\Windows\SYSTEM32\netsh.exe
                    netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
                    3⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:1552
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Programdata\Install\del.bat
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4652
                  • C:\Windows\system32\timeout.exe
                    timeout 5
                    3⤵
                    • Delays execution with timeout.exe
                    PID:3260
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                1⤵
                  PID:4276
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                  1⤵
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3748
                • C:\ProgramData\Windows Tasks Service\winserv.exe
                  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
                  1⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4488
                • C:\ProgramData\Windows Tasks Service\winserv.exe
                  "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
                  1⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:5100

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Account Manipulation

                1
                T1098

                Boot or Logon Autostart Execution

                1
                T1547

                Winlogon Helper DLL

                1
                T1547.004

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Server Software Component

                1
                T1505

                Terminal Services DLL

                1
                T1505.005

                Privilege Escalation

                Account Manipulation

                1
                T1098

                Boot or Logon Autostart Execution

                1
                T1547

                Winlogon Helper DLL

                1
                T1547.004

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Impair Defenses

                1
                T1562

                Disable or Modify System Firewall

                1
                T1562.004

                Modify Registry

                1
                T1112

                Virtualization/Sandbox Evasion

                1
                T1497

                Credential Access

                Discovery

                Permission Groups Discovery

                1
                T1069

                Local Groups

                1
                T1069.001

                Query Registry

                5
                T1012

                System Information Discovery

                5
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Virtualization/Sandbox Evasion

                1
                T1497

                Lateral Movement

                Remote Service Session Hijacking

                1
                T1563

                RDP Hijacking

                1
                T1563.002

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\ProgramData\RDPWinst.exe
                  Filesize

                  1.4MB

                  MD5

                  3288c284561055044c489567fd630ac2

                  SHA1

                  11ffeabbe42159e1365aa82463d8690c845ce7b7

                  SHA256

                  ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753

                  SHA512

                  c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02

                  Download Submit

                • C:\ProgramData\Windows Tasks Service\settings.dat
                  Filesize

                  2KB

                  MD5

                  bc909d39981af556d07dc67178f61472

                  SHA1

                  a4e5b1c5bc746435a5baf11b728e83fb8e654da0

                  SHA256

                  10cf28ab39bf7ba76b91b043a007006d13d4a661fbcaad3d7820c19407b1e6a8

                  SHA512

                  acf34884a865cdabfbb9a49b948ccc74fe1e158636b23e2f728c2df6fd2fb7bda0929eeddf4bf58d90b034215dafa5e2c697050c51c2f2259ff77fa02d80f51a

                  Download Submit

                • C:\ProgramData\Windows Tasks Service\winserv.exe
                  Filesize

                  10.2MB

                  MD5

                  3f4f5a6cb95047fea6102bd7d2226aa9

                  SHA1

                  fc09dd898b6e7ff546e4a7517a715928fbafc297

                  SHA256

                  99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98

                  SHA512

                  de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688

                  Download Submit

                • C:\Programdata\Install\del.bat
                  Filesize

                  315B

                  MD5

                  155557517f00f2afc5400ba9dc25308e

                  SHA1

                  77a53a8ae146cf1ade1c9d55bbd862cbeb6db940

                  SHA256

                  f00d027b0ed99814846378065b3da90d72d76307d37b7be46f5a480f425a764e

                  SHA512

                  40baee6e6b22c386886d89172ad7c17605166f992f2d364c68d90b9874ab6f7b85e0accc91e83b4fbd2ae702def365f23542f22f6be7ff2f7949496cc0ba8a32

                  Download Submit

                • \??\c:\program files\rdp wrapper\rdpwrap.dll
                  Filesize

                  114KB

                  MD5

                  461ade40b800ae80a40985594e1ac236

                  SHA1

                  b3892eef846c044a2b0785d54a432b3e93a968c8

                  SHA256

                  798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

                  SHA512

                  421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

                  Download Submit

                • memory/444-50-0x0000000000400000-0x0000000000E31000-memory.dmp

                  Filesize

                  10.2MB

                  Download

                • memory/444-24-0x0000000000400000-0x0000000000E31000-memory.dmp

                  Filesize

                  10.2MB

                  Download

                • memory/444-65-0x0000000000400000-0x0000000000E31000-memory.dmp

                  Filesize

                  10.2MB

                  Download

                • memory/444-62-0x0000000000400000-0x0000000000E31000-memory.dmp

                  Filesize

                  10.2MB

                  Download

                • memory/444-61-0x0000000000400000-0x0000000000E31000-memory.dmp

                  Filesize

                  10.2MB

                  Download

                • memory/2588-51-0x00007FF74F110000-0x00007FF750143000-memory.dmp

                  Filesize

                  16.2MB

                  Download

                • memory/2588-1-0x00007FFA2E7F0000-0x00007FFA2E7F2000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/2588-8-0x00007FF74F110000-0x00007FF750143000-memory.dmp

                  Filesize

                  16.2MB

                  Download

                • memory/2588-5-0x00007FF74F110000-0x00007FF750143000-memory.dmp

                  Filesize

                  16.2MB

                  Download

                • memory/2588-4-0x00007FF74F110000-0x00007FF750143000-memory.dmp

                  Filesize

                  16.2MB

                  Download

                • memory/2588-30-0x00007FF74F110000-0x00007FF750143000-memory.dmp

                  Filesize

                  16.2MB

                  Download

                • memory/2588-3-0x00007FF74F110000-0x00007FF750143000-memory.dmp

                  Filesize

                  16.2MB

                  Download

                • memory/2588-2-0x00007FF74F110000-0x00007FF750143000-memory.dmp

                  Filesize

                  16.2MB

                  Download

                • memory/2588-47-0x00007FF74F110000-0x00007FF750143000-memory.dmp

                  Filesize

                  16.2MB

                  Download

                • memory/2588-9-0x00007FF74F110000-0x00007FF750143000-memory.dmp

                  Filesize

                  16.2MB

                  Download

                • memory/2588-0-0x00007FF74F110000-0x00007FF750143000-memory.dmp

                  Filesize

                  16.2MB

                  Download

                • memory/2588-7-0x00007FF74F110000-0x00007FF750143000-memory.dmp

                  Filesize

                  16.2MB

                  Download

                • memory/2588-59-0x00007FF74F110000-0x00007FF750143000-memory.dmp

                  Filesize

                  16.2MB

                  Download

                • memory/2588-6-0x00007FF74F110000-0x00007FF750143000-memory.dmp

                  Filesize

                  16.2MB

                  Download

                • memory/3372-23-0x0000000000400000-0x0000000000E31000-memory.dmp

                  Filesize

                  10.2MB

                  Download

                • memory/3372-21-0x0000000000400000-0x0000000000E31000-memory.dmp

                  Filesize

                  10.2MB

                  Download

                • memory/4488-64-0x0000000000400000-0x0000000000E31000-memory.dmp

                  Filesize

                  10.2MB

                  Download

                • memory/4640-48-0x0000000000400000-0x000000000056F000-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/5100-74-0x0000000000400000-0x0000000000E31000-memory.dmp

                  Filesize

                  10.2MB

                  Download