rms | 0c41e02ef1c8837307ffbfe5e3c97116808ced2214d34a5517ac732bc2c3baa7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
60ec502046b8c0d787ad3b5e431c9126.exe
Size 16.4MB
Sample240909-bxdrnavfqr
SHA256 0c41e02ef1c8837307ffbfe5e3c97116808ced2214d34a5517ac732bc2c3baa7
MD5 60ec502046b8c0d787ad3b5e431c9126
SHA1 125ca02f6f2e66c3ed1eeb10d78239af3e1c6fbd
SHA512 b2073538d267b31f9fabfa84160cccc2a308e83ee0d4d92881738fc5fd1765c53363ae32cf9c078daf95582328be33f7a8ce45f4e5af8685ea5919b721ed8fe5
SSDEEP 393216:afdWj7p4qc0/Elt1VBqqZGi/h3AxlcVtXzo:aFWfp4qc0w7VBqqRNVtXzo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rms discovery rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5056-0-0x0000000000400000-0x0000000002843000-memory.dmp	upx
behavioral2/memory/5056-81-0x0000000000400000-0x0000000002843000-memory.dmp	upx

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	60ec502046b8c0d787ad3b5e431c9126.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	rutserv.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_09E960F015FF4A8F16C13B5E9BAAA43F	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_09E960F015FF4A8F16C13B5E9BAAA43F	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	rutserv.exe

Executes dropped EXE 4 IoCs

pid	Process
1516	rfusclient.exe
2816	rutserv.exe
3048	rutserv.exe
640	rfusclient.exe

Loads dropped DLL 4 IoCs

pid	Process
2816	rutserv.exe
2816	rutserv.exe
3048	rutserv.exe
3048	rutserv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60ec502046b8c0d787ad3b5e431c9126.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	rutserv.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1516	rfusclient.exe
1516	rfusclient.exe
2816	rutserv.exe
2816	rutserv.exe
2816	rutserv.exe
2816	rutserv.exe
2816	rutserv.exe
2816	rutserv.exe
2816	rutserv.exe
2816	rutserv.exe
3048	rutserv.exe
3048	rutserv.exe
3048	rutserv.exe
3048	rutserv.exe
3048	rutserv.exe
3048	rutserv.exe
3048	rutserv.exe
3048	rutserv.exe
640	rfusclient.exe
640	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	rutserv.exe
Token: SeTakeOwnershipPrivilege	3048	rutserv.exe
Token: SeTcbPrivilege	3048	rutserv.exe
Token: SeTcbPrivilege	3048	rutserv.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
640	rfusclient.exe
640	rfusclient.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
640	rfusclient.exe
640	rfusclient.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2816	rutserv.exe
2816	rutserv.exe
2816	rutserv.exe
2816	rutserv.exe
3048	rutserv.exe
3048	rutserv.exe
3048	rutserv.exe
3048	rutserv.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 1516	5056	60ec502046b8c0d787ad3b5e431c9126.exe	86
PID 5056 wrote to memory of 1516	5056	60ec502046b8c0d787ad3b5e431c9126.exe	86
PID 5056 wrote to memory of 1516	5056	60ec502046b8c0d787ad3b5e431c9126.exe	86
PID 1516 wrote to memory of 2816	1516	rfusclient.exe	87
PID 1516 wrote to memory of 2816	1516	rfusclient.exe	87
PID 1516 wrote to memory of 2816	1516	rfusclient.exe	87
PID 3048 wrote to memory of 640	3048	rutserv.exe	91
PID 3048 wrote to memory of 640	3048	rutserv.exe	91
PID 3048 wrote to memory of 640	3048	rutserv.exe	91

C:\Users\Admin\AppData\Local\Temp\60ec502046b8c0d787ad3b5e431c9126.exe
"C:\Users\Admin\AppData\Local\Temp\60ec502046b8c0d787ad3b5e431c9126.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\rfusclient.exe
  "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\rfusclient.exe" -run_agent
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\rutserv.exe
    "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\rutserv.exe" -run_agent
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2816
  - - C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\rutserv.exe
      "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\rutserv.exe" -run_agent -second
      4⤵
      Drops file in System32 directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3048
    - - C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\rfusclient.exe
        
        "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\rfusclient.exe" /tray /user
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EULA.rtf

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\EULA.rtf
Size 69KB
SHA256 b137e38facdd1cdfc9730856675f4b531366d7af54b605209cb2158a58deb1ef
MD5 e6b99144ea133a583f2964fdaa0c514a
SHA1 a9ab6b4ad60bd60c798e9909be801dad725497de
SHA512 a4f6e9663163e7a85251e129983251698b2c98070d2044f6402804d92779d77e477cb63c703b72a6ea20e19fc0d443a2a4f7fcf9d181a1e0ef0c0276297bf072
SSDEEP 768:D//N2WF2Fn+MZXfpCjFwMVVKJeW/j6yfjdRZxDBJYinhFnDnlnSnAn9zSkqf/Bsn:D3N2AQFFYirDlSA9zSl/Bs19
MD5 SHA1 SHA512 SSDEEP

Submit Download

branding.ini

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\branding.ini
Size 216B
SHA256 cbb3e1eb3714776ccfbfdc8f8fe66a6db2880f39cdd9ab53fb6ca6d86b98fb07
MD5 e1024ec1abcc039d7120d0f6f1c07e66
SHA1 5edc44c49ae18eb062e68bd77d7f92ae9422279a
SHA512 bb8ee31eb620f62ca3b41cf5039b5f96149e5a208f675ec0cfc4efa23fe39980d03ca40eade896262bec4285019995a8fe08f8bd85042d217865bcfd82ac1866
MD5 SHA1 SHA512

Submit Download

eventmsg.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\eventmsg.dll
Size 51KB
SHA256 ccd5b9e5947f956e880bd2285a6091dc9f1ee9b0eb8df627ec4e72b451a1c745
MD5 ca8a4346b37cdd0220792885c5937b30
SHA1 eef05f4b7fb5f8aabfb93d10a6451cc77b489864
SHA512 c286b0fa9d24a85fe63d3a3d801f135d12409736742c4fc16ba1dc15529df136577dc8975736146437dd56467576fdedb4ac50cf05ab054547504f3dc5ca0c35
SSDEEP 768:tsmrWdCS5PvBHOUYTKJgr0OMpqdBwFrGjYdhXdsn:tza/pu/TKJ/OMpTryYvan
MD5 SHA1 SHA512 SSDEEP

Submit Download

libeay32.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\libeay32.dll
Size 1.3MB
SHA256 dfc847405be60c29e86e3e3222e7f63c1ff584727d87d3c35c25c4893e19fda0
MD5 0d51927274281007657c7f3e0df7becb
SHA1 6de3746d9d0980f5715cec6c676a8eb53b5efc49
SHA512 eef74088a94635184192d82bb6dcc0758749cb290c8deeff211881e8a280aec73a53334eff8846df618204b0f318e757eab23e76951a472ba6e086905000d9a5
SSDEEP 24576:nD8B+KpPexB6mqwktXUcAVEaFQXhL0porIqo+FrzbN:EKkmlktXUcAVEDhQporIqo+FrzbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

logo.png

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\logo.png
Size 57KB
SHA256 b022cea1a3caeb02da1334f5f1ac7afdb3ae4fca1cd4ccd9ae106a0c9457613b
MD5 09ddf08d88dbd240de9704da196e7264
SHA1 9f25e23079cf1cfa86e519aeff4ed72510f95fb3
SHA512 7ce5ae872d9678254f7b227199ff5880502f66ccbcc6d13024a6c1f916c6ec57ed2a10a4ed13915e4f85c6b04880c77e5e104dd5c297015bb808e4633689cc2e
SSDEEP 1536:p6XUUFmi67t342fdCHPvYmuf8zE7EIdWPPkUszR8yV/:J+mxIifFHdWHXKR8i/
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\rfusclient.exe
Size 11.2MB
SHA256 41ea3c0b8421ebdea1eb6a508a38e120b1fbb38b9a2e1379deabc5a167a87408
MD5 43cc976800c506662c325478eb8bf9ea
SHA1 6d18795469c3a0ac6e4b8bb0024fffba51c45c60
SHA512 396a97698a815316b1bd1b927f089c1d4934ea9fb8b31be72941e46030059978f98866cc19c5daf36722d5a768af007434c875de53b3f3ab9497b6a2bcd9dd54
SSDEEP 196608:P7Lmc33S6HGGLbt/ouGp3ueqS9w73g95qjBjuW:jLm23DtdBSIIJ50Bj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\rutserv.exe
Size 18.0MB
SHA256 ce5ba1e5d70d95d52b89a1b8278ff8dd4d1e25c38c90ca202b43bdc014795d78
MD5 6c6ba57be4b7b2fb661a99fea872f6b8
SHA1 aa95f1662a80e2c31fc24e60a9168b6df93c42e7
SHA512 15d89d9b89bf585acef483212c3e0cd37ee5c680e03d5e4e9f6ae73e058e5ece0ff6e52df36f695a2aed20c5115e1b1ab6eb6afa580e7349d4871ad4c079c37f
SSDEEP 393216:jwoZwIhy4ksLov8EkBK8vEJ9Gf5Lf2e1Q:XAlCYmQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\settings.dat
Size 8KB
SHA256 202fc5f1f030a19911f9405629f1d3ac082c2742b4b49a60e1b5a59d869fee4b
MD5 bb31b030afb8e40feac28217b00d3d6a
SHA1 319ddd5828ac73ec6b159985c4cdfe7b3f483583
SHA512 dc833aa168c31242562e041d22d6fa8d852fede9e9fcc3d27f1bd7a94b4b7ae937e5014166050cc362a22469769aa6a66ba21a64c8faa88bcbce115a04303ffa
SSDEEP 192:GuDH6g5vxAmvO8byxDMRlfQFkR0Em7WublSy8t0mr:5vxY8byef3gC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssleay32.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\ssleay32.dll
Size 337KB
SHA256 303c78aba3b776472c245f17020f9aa5a53f09a6f6c1e4f34b8e18e33906b5ee
MD5 197da919e4c91125656bf905877c9b5a
SHA1 9574ec3e87bb0f7acce72d4d59d176296741aa83
SHA512 33c1b853181f83cab2f57f47fb7e093badf83963613e7328ebd23f0d62f59416d7a93063c6237435fbb6833a69bc44ebbc13aa585da010f491c680b2ea335c47
SSDEEP 6144:IEXfWSXFKIsrpivdM+kPsmWak8dfthPDP0wrE90k7DUT/NaDB7JlwScihgbX5/Gd:IEXfWSVKIsrpivdM+msmWak8dfnPDPPG
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8decoder.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\vp8decoder.dll
Size 380KB
SHA256 36993fc3312ce757c8adeca3e5969e1fcc11d5b51b12c458ba8d54d73b64d4e7
MD5 41acd8b6d9d80a61f2f686850e3d676a
SHA1 38428a08915cf72dd2eca25b3d87613d9aa027dd
SHA512 d174638965ec781cbcb2927ceafb295c3176dc78da8938467faca3e512a42fe71a9dc1070f23e1c95f0b7c157fff3b00a8b572c39e4670713564f1310360ed23
SSDEEP 6144:lIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwcS:lI8tiDOzyH9H8Tu6h04fZMZoMPuvfC
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8encoder.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\vp8encoder.dll
Size 1.6MB
SHA256 0961d83cb25e1a50d5c0ec2f9fb0d17f2504dae0b22a865f6e1ea8e987e1c6fa
MD5 2ac39d6990170ca37a735f2f15f970e8
SHA1 8148a9cdc6b3fe6492281ebad79636433a6064ab
SHA512 7e30fde909d5f8efd6c2e40e125525697267273163ac35cf53561a2bd32e5dad8e4fba32905f53e422c9c73b8ad9a0c151f8d36042c5f156b50bf42dc21a9cee
SSDEEP 49152:mSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwz:mSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmmux.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\webmmux.dll
Size 260KB
SHA256 bd520007864b44e0bda7a466384d12c3c3f328326cf3549ba1853a58ccdbc99d
MD5 8a683f90a78778fba037565588a6f752
SHA1 011939c1fa7b73272db340c32386a13e140adc6a
SHA512 9280fbb121f8b94f57560d1be3bcfe5e7c308d54dac278f13ea6c00256444fb9f17f543dd0d32c9844460818c1a50d83b26ce51c79698e9ca7a304652a3f5ea9
SSDEEP 3072:xW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTY:xWSfr7sXSmPDbKPJ6/AsNk+S
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmvorbisdecoder.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\webmvorbisdecoder.dll
Size 365KB
SHA256 f3465ce8a23db5e8228eed5a60a6f7a096d1a9adf3012c39bc6d81d4e57e8e9e
MD5 c9d412c1d30abb9d61151a10371f4140
SHA1 87120faa6b859f5e23f7344f9547b2fc228af15b
SHA512 1c020afa89cdae55f4dcb80a455dc1b352f40455142f3947ed29c3e3d51fbd465b6e0ea16cd103186c252783a3f2a7f7c417e4df5727d9b2db511b650308face
SSDEEP 6144:RaoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88RtL:loPH0GgEp0gVd1ValsQXsHL
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmvorbisencoder.dll

Path C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70020\A5110FEF53\webmvorbisencoder.dll
Size 860KB
SHA256 83e1c1eb55bfd0f2d85d41c1e4dee65046b064ccb263ec7f412a5f329c75cfd1
MD5 a59f69797c42324540e26c7c7998c18c
SHA1 7f7bc5bc62a8744f87a7d2e30cc6dd74c72e19b4
SHA512 837f244e6b70658974506ac35bd3ee2d413b89fe4b26e75f4a61cc7bec63e999c9c2cffb690ad567f74962bab13f2f5471300cd0e0cfe61bb1084072cb55c38b
SSDEEP 12288:vTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRN1:YYF+Eyx2lzujtEIYRc1cQmsGa7ON1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/640-122-0x0000000000400000-0x0000000000FCE000-memory.dmp

Download

memory/640-128-0x0000000000400000-0x0000000000FCE000-memory.dmp

Download

memory/640-157-0x0000000000400000-0x0000000000FCE000-memory.dmp

Download

memory/640-139-0x0000000000400000-0x0000000000FCE000-memory.dmp

Download

memory/640-131-0x0000000000400000-0x0000000000FCE000-memory.dmp

Download

memory/640-142-0x0000000000400000-0x0000000000FCE000-memory.dmp

Download

memory/640-154-0x0000000000400000-0x0000000000FCE000-memory.dmp

Download

memory/640-111-0x0000000000400000-0x0000000000FCE000-memory.dmp

Download

memory/640-151-0x0000000000400000-0x0000000000FCE000-memory.dmp

Download

memory/640-136-0x0000000000400000-0x0000000000FCE000-memory.dmp

Download

memory/640-148-0x0000000000400000-0x0000000000FCE000-memory.dmp

Download

memory/640-125-0x0000000000400000-0x0000000000FCE000-memory.dmp

Download

memory/640-145-0x0000000000400000-0x0000000000FCE000-memory.dmp

Download

memory/640-160-0x0000000000400000-0x0000000000FCE000-memory.dmp

Download

memory/1516-86-0x0000000000400000-0x0000000000FCE000-memory.dmp

Download

memory/1516-83-0x0000000003340000-0x0000000003341000-memory.dmp

Download

memory/2816-92-0x0000000000400000-0x00000000016BA000-memory.dmp

Download

memory/3048-124-0x0000000000400000-0x00000000016BA000-memory.dmp

Download

memory/3048-150-0x0000000000400000-0x00000000016BA000-memory.dmp

Download

memory/3048-135-0x0000000000400000-0x00000000016BA000-memory.dmp

Download

memory/3048-141-0x0000000000400000-0x00000000016BA000-memory.dmp

Download

memory/3048-130-0x0000000000400000-0x00000000016BA000-memory.dmp

Download

memory/3048-144-0x0000000000400000-0x00000000016BA000-memory.dmp

Download

memory/3048-127-0x0000000000400000-0x00000000016BA000-memory.dmp

Download

memory/3048-147-0x0000000000400000-0x00000000016BA000-memory.dmp

Download

memory/3048-159-0x0000000000400000-0x00000000016BA000-memory.dmp

Download

memory/3048-138-0x0000000000400000-0x00000000016BA000-memory.dmp

Download

memory/3048-121-0x0000000000400000-0x00000000016BA000-memory.dmp

Download

memory/3048-153-0x0000000000400000-0x00000000016BA000-memory.dmp

Download

memory/3048-110-0x0000000000400000-0x00000000016BA000-memory.dmp

Download

memory/3048-156-0x0000000000400000-0x00000000016BA000-memory.dmp

Download

memory/5056-81-0x0000000000400000-0x0000000002843000-memory.dmp

Download

memory/5056-1-0x0000000002F40000-0x0000000002F41000-memory.dmp

Download

memory/5056-0-0x0000000000400000-0x0000000002843000-memory.dmp

Download