rms | 8edbedff95b25d5e437e4ff1ff5197c50ebce68020c9531ccaa09510c6f94a13

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-09-2024 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d864a0ac635e811332124e1df1458257_JaffaCakes118.exe
Size

10.4MB
MD5

d864a0ac635e811332124e1df1458257
SHA1

8d2e8e36ad08c6d7a38fdb3304ce25181586cd5c
SHA256

8edbedff95b25d5e437e4ff1ff5197c50ebce68020c9531ccaa09510c6f94a13
SHA512

f1cf8119708965ecf5052be88732e23031afc47676da3482227ce93b90f06064e363012448fb699ee4fdf1bd8643b3aad647de1b77d36ae0a74c6ff8f5ab0f1b
SSDEEP

196608:xoeZUtx0psIKcQEgNvR5ffalRn2amSNJiWa:xlqSsIiEgNvbfSlB2amSNJir

Score

10^/10

rms discovery rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d864a0ac635e811332124e1df1458257_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	d864a0ac635e811332124e1df1458257_JaffaCakes118.exe

Executes dropped EXE 7 IoCs

Processes:

rutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid	Process
1468	rutserv.exe
4488	rutserv.exe
2292	rutserv.exe
1524	rutserv.exe
2688	rfusclient.exe
2128	rfusclient.exe
992	rfusclient.exe

Drops file in System32 directory 19 IoCs

Processes:

cmd.exerutserv.exerutserv.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\RWLN.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	cmd.exe
File created	C:\Windows\SysWOW64\vp8decoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\exe\rutserv.pdb	rutserv.exe
File created	C:\Windows\SysWOW64\rfusclient.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rfusclient.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\RIPCServer.dll	cmd.exe
File created	C:\Windows\SysWOW64\rutserv.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\dsfVorbisDecoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\RIPCServer.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\vp8decoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\vp8encoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\symbols\exe\rutserv.pdb	rutserv.exe
File created	C:\Windows\SysWOW64\dsfVorbisDecoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rutserv.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\vp8encoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File created	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\rutserv.pdb	rutserv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rutserv.exerutserv.exerutserv.exerfusclient.exed864a0ac635e811332124e1df1458257_JaffaCakes118.exereg.exerutserv.exerfusclient.exerfusclient.execmd.exeregedit.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d864a0ac635e811332124e1df1458257_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid	Process
2812	regedit.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exe

pid	Process
1468	rutserv.exe
1468	rutserv.exe
4488	rutserv.exe
4488	rutserv.exe
2292	rutserv.exe
2292	rutserv.exe
1524	rutserv.exe
1524	rutserv.exe
1524	rutserv.exe
1524	rutserv.exe
1524	rutserv.exe
1524	rutserv.exe
2128	rfusclient.exe
2128	rfusclient.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

rfusclient.exe

pid	Process
992	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

rutserv.exerutserv.exerutserv.exe

description	pid	Process
Token: SeDebugPrivilege	1468	rutserv.exe
Token: SeDebugPrivilege	2292	rutserv.exe
Token: SeTakeOwnershipPrivilege	1524	rutserv.exe
Token: SeTcbPrivilege	1524	rutserv.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

d864a0ac635e811332124e1df1458257_JaffaCakes118.execmd.exerutserv.exerfusclient.exe

description	pid	Process	procid_target
PID 1744 wrote to memory of 1448	1744	d864a0ac635e811332124e1df1458257_JaffaCakes118.exe	85
PID 1744 wrote to memory of 1448	1744	d864a0ac635e811332124e1df1458257_JaffaCakes118.exe	85
PID 1744 wrote to memory of 1448	1744	d864a0ac635e811332124e1df1458257_JaffaCakes118.exe	85
PID 1448 wrote to memory of 2624	1448	cmd.exe	89
PID 1448 wrote to memory of 2624	1448	cmd.exe	89
PID 1448 wrote to memory of 2624	1448	cmd.exe	89
PID 1448 wrote to memory of 1468	1448	cmd.exe	90
PID 1448 wrote to memory of 1468	1448	cmd.exe	90
PID 1448 wrote to memory of 1468	1448	cmd.exe	90
PID 1448 wrote to memory of 4488	1448	cmd.exe	91
PID 1448 wrote to memory of 4488	1448	cmd.exe	91
PID 1448 wrote to memory of 4488	1448	cmd.exe	91
PID 1448 wrote to memory of 2812	1448	cmd.exe	92
PID 1448 wrote to memory of 2812	1448	cmd.exe	92
PID 1448 wrote to memory of 2812	1448	cmd.exe	92
PID 1448 wrote to memory of 2292	1448	cmd.exe	93
PID 1448 wrote to memory of 2292	1448	cmd.exe	93
PID 1448 wrote to memory of 2292	1448	cmd.exe	93
PID 1524 wrote to memory of 2688	1524	rutserv.exe	95
PID 1524 wrote to memory of 2688	1524	rutserv.exe	95
PID 1524 wrote to memory of 2688	1524	rutserv.exe	95
PID 1524 wrote to memory of 2128	1524	rutserv.exe	96
PID 1524 wrote to memory of 2128	1524	rutserv.exe	96
PID 1524 wrote to memory of 2128	1524	rutserv.exe	96
PID 2128 wrote to memory of 992	2128	rfusclient.exe	97
PID 2128 wrote to memory of 992	2128	rfusclient.exe	97
PID 2128 wrote to memory of 992	2128	rfusclient.exe	97

C:\Users\Admin\AppData\Local\Temp\d864a0ac635e811332124e1df1458257_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d864a0ac635e811332124e1df1458257_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\83F5.tmp\1213.bat" "
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2624
- - C:\Windows\SysWOW64\rutserv.exe
    "C:\Windows\System32\rutserv.exe" /silentinstall
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1468
- - C:\Windows\SysWOW64\rutserv.exe
    "C:\Windows\System32\rutserv.exe" /firewall
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4488
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s "settings.reg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:2812
- - C:\Windows\SysWOW64\rutserv.exe
    "C:\Windows\System32\rutserv.exe" /start
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2292

C:\Windows\SysWOW64\rutserv.exe
C:\Windows\SysWOW64\rutserv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\rfusclient.exe
  C:\Windows\SysWOW64\rfusclient.exe /tray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2688
- C:\Windows\SysWOW64\rfusclient.exe
  C:\Windows\SysWOW64\rfusclient.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\rfusclient.exe
    C:\Windows\SysWOW64\rfusclient.exe /tray
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    PID:992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\83F5.tmp\1213.bat

Filesize
1KB

MD5
a1b4263a202c77f63141c716e836a4ab

SHA1
f3859ca14556b04192ed95ff0d9876500a9ab52d

SHA256
3c85a85ca0516b3763fa370e8347da94b65b047d194847756879c8f482d78231

SHA512
64498944db72ca33ff2877d60f375e67f42fc5c9624a2b7617fe5b5776db06c66f4af3763b6bb2e3b6c654a1b148494e7397286e5d69f76aaa35e3abdfbf41bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\83F5.tmp\RIPCServer.dll

Filesize
144KB

MD5
30e269f850baf6ca25187815912e21c5

SHA1
eb160de97d12b4e96f350dd0d0126d41d658afb3

SHA256
379191bfd34d41e96760c7a539e2056a22be3d44bf0e8712b53e443f55aead90

SHA512
9b86a4eefdcae46e605f85e752ef61e39fd0212a19b7fd4c35eb3ab99851a0b906d048d12d1e1e985a340a67a64d405b8cf803555865137278f0c19d686df5e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\83F5.tmp\RWLN.dll

Filesize
357KB

MD5
bb1f3e716d12734d1d2d9219a3979a62

SHA1
0ef66eed2f2ae45ec2d478902833b830334109cb

SHA256
d7e9c9043ed7df2af800d9b2a33e3efddf68b70f043e9717afc4b7dd4e13e077

SHA512
bbc90747dd45a01b05f5c0b6fa58ffe18af894b05363267ac1cc9fe3262f5e65c8ae4e08dfd82d89b9112e86e42d24a12784b79f5ea30b6443015c19b6792c9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\83F5.tmp\dsfVorbisDecoder.dll

Filesize
234KB

MD5
8e3f59b8c9dfc933fca30edefeb76186

SHA1
37a78089d5936d1bc3b60915971604c611a94dbd

SHA256
528c0656751b336c10cb4c49b703eae9c3863f7f416d0e09b198b082cc54aeb8

SHA512
3224c20c30556774fd4bed78909f451b9a5a46aa59271b5e88b1e0e60145d217802a8f1fda3d3fabcd8546ca7783e0c70f0c419a28efe6c5160a102553a3c91d

Download Submit
C:\Users\Admin\AppData\Local\Temp\83F5.tmp\rfusclient.exe

Filesize
3.9MB

MD5
511ab5d90c2e370a942fc3b9077c38d3

SHA1
a7d4f2dc7ab8ca93a4bec1bac2468166c0ed3f86

SHA256
0f07353d08de0a6265d25b66a273fabeef807f868779ad79559cd17c203e313c

SHA512
82861f55433d9bc6daeb9657c9b8c056fa7cfc7c09bc51d3e4cef7684e3ca4d78036ad1a07ad2336e5e49510bab41fa5a3888dae80ef674a7ff5c16305e240c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\83F5.tmp\rutserv.exe

Filesize
4.7MB

MD5
4b528d3392dbd69301ed25d816baed9f

SHA1
e9d6dc6fd5765e0d177dd990788898b834560fd1

SHA256
7dcf2ff3f5d01c4a0ed4cfef05fbd03f2ccaa794d6330fdb6012696b2ae7dd03

SHA512
f4003e3c5abcc41a294414c6f41db37829b16bc19eb25120fabd68cebfe1318a13147c693f74473baeb49fab9383cd96b84ae99d5bbbcfcdd10b523bd2ce2a05

Download Submit
C:\Users\Admin\AppData\Local\Temp\83F5.tmp\settings.reg

Filesize
22KB

MD5
f70d5b1d76e8bd8aebcb4f5082c0f909

SHA1
6ab4bbf4e87c994b192282ae79136ba55d4cc82f

SHA256
e6302eed15fb6ac7e71382e298c7e15e20195874a5dfa2f5075f85ac72963f38

SHA512
c15e341f25cc282b15dd889e5c29db45d224f81716342786f673b7a5739866dcf203f9aceb7329ba045fda4428330dac9d084bad58c0eea20729213dedbe41b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\83F5.tmp\vp8decoder.dll

Filesize
403KB

MD5
6f6bfe02e84a595a56b456f72debd4ee

SHA1
90bad3ae1746c7a45df2dbf44cd536eb1bf3c8e2

SHA256
5e59b566eda7bb36f3f5d6dd39858bc9d6cf2c8d81deca4ea3c409804247da51

SHA512
ed2a7402699a6d00d1eac52b0f2dea4475173be3320dfbad5ca58877f06638769533229bc12bce6650726d3166c0e5ebac2dad7171b77b29186d4d5e65818c50

Download Submit
C:\Users\Admin\AppData\Local\Temp\83F5.tmp\vp8encoder.dll

Filesize
685KB

MD5
c638bca1a67911af7f9ed67e7b501154

SHA1
0fd74d2f1bd78f678b897a776d8bce36742c39b7

SHA256
519078219f7f6db542f747702422f902a21bfc3aef8c6e6c3580e1c5e88162b8

SHA512
ca8133399f61a1f339a14e3fad3bfafc6fe3657801fd66df761c88c18b2dc23ceb02ba6faa536690986972933bec2808254ef143c2c22f881285facb4364659f

Download Submit
memory/992-63-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/1468-44-0x0000000002880000-0x0000000002881000-memory.dmp

Filesize
4KB

Download
memory/1468-46-0x0000000000400000-0x0000000000939000-memory.dmp

Filesize
5.2MB

Download
memory/1524-106-0x0000000000400000-0x0000000000939000-memory.dmp

Filesize
5.2MB

Download
memory/1524-78-0x0000000000400000-0x0000000000939000-memory.dmp

Filesize
5.2MB

Download
memory/1524-64-0x0000000000400000-0x0000000000939000-memory.dmp

Filesize
5.2MB

Download
memory/1524-99-0x0000000000400000-0x0000000000939000-memory.dmp

Filesize
5.2MB

Download
memory/1524-67-0x0000000000400000-0x0000000000939000-memory.dmp

Filesize
5.2MB

Download
memory/1524-92-0x0000000000400000-0x0000000000939000-memory.dmp

Filesize
5.2MB

Download
memory/1524-71-0x0000000000400000-0x0000000000939000-memory.dmp

Filesize
5.2MB

Download
memory/1524-85-0x0000000000400000-0x0000000000939000-memory.dmp

Filesize
5.2MB

Download
memory/2128-66-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2292-59-0x0000000000400000-0x0000000000939000-memory.dmp

Filesize
5.2MB

Download
memory/2688-72-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2688-68-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2688-65-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/4488-48-0x0000000000400000-0x0000000000939000-memory.dmp

Filesize
5.2MB

Download