rms | 3b03d8ee3dc4406d7be3d995552965ad4b4b9f1f3d106580820ce3e1fa62b2ca

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b03d8ee3dc4406d7be3d995552965ad4b4b9f1f3d106580820ce3e1fa62b2ca.exe
Size 17.1MB
Sample241006-bf3pfssfqg
SHA256 3b03d8ee3dc4406d7be3d995552965ad4b4b9f1f3d106580820ce3e1fa62b2ca
MD5 2ac561231ba80f987b7bf1f6c3fb2c3b
SHA1 9742aa5faeef8d90a116a5f86066acf72071ca26
SHA512 4ea8a999b419472a3b4703535b4e6a3fe0a93de7bd44ef48dce11cf8d5bd7da8c72f585de9dad5534f270ff14f2ad5a16a5688498402cb1141d38a470fa34f50
SSDEEP 393216:r93WcIGlUHbn+WE2WQoCyJ8ZKNhNUNXaRdeX:53W7bE2WQoVVhNaXaza
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rms discovery rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	rutserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	3b03d8ee3dc4406d7be3d995552965ad4b4b9f1f3d106580820ce3e1fa62b2ca.exe

Executes dropped EXE 4 IoCs

pid	Process
1584	rfusclient.exe
3936	rutserv.exe
1664	rutserv.exe
3872	rfusclient.exe

Loads dropped DLL 4 IoCs

pid	Process
3936	rutserv.exe
3936	rutserv.exe
1664	rutserv.exe
1664	rutserv.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164	rutserv.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4172-0-0x0000000000400000-0x000000000296D000-memory.dmp	upx
behavioral2/memory/4172-81-0x0000000000400000-0x000000000296D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b03d8ee3dc4406d7be3d995552965ad4b4b9f1f3d106580820ce3e1fa62b2ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\NetworkExplorer.dll,-1 = "Network"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\ieframe.dll,-5723 = "The Internet"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-9216 = "This PC"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\prnfldr.dll,-8036 = "Printers"	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rutserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rutserv.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	rutserv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	rutserv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	rutserv.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1584	rfusclient.exe
1584	rfusclient.exe
3936	rutserv.exe
3936	rutserv.exe
3936	rutserv.exe
3936	rutserv.exe
3936	rutserv.exe
3936	rutserv.exe
3936	rutserv.exe
3936	rutserv.exe
1664	rutserv.exe
1664	rutserv.exe
1664	rutserv.exe
1664	rutserv.exe
1664	rutserv.exe
1664	rutserv.exe
1664	rutserv.exe
1664	rutserv.exe
3872	rfusclient.exe
3872	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3936	rutserv.exe
Token: SeTakeOwnershipPrivilege	1664	rutserv.exe
Token: SeTcbPrivilege	1664	rutserv.exe
Token: SeTcbPrivilege	1664	rutserv.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3872	rfusclient.exe
3872	rfusclient.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3872	rfusclient.exe
3872	rfusclient.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3936	rutserv.exe
3936	rutserv.exe
3936	rutserv.exe
3936	rutserv.exe
1664	rutserv.exe
1664	rutserv.exe
1664	rutserv.exe
1664	rutserv.exe
1664	rutserv.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 1584	4172	3b03d8ee3dc4406d7be3d995552965ad4b4b9f1f3d106580820ce3e1fa62b2ca.exe	82
PID 4172 wrote to memory of 1584	4172	3b03d8ee3dc4406d7be3d995552965ad4b4b9f1f3d106580820ce3e1fa62b2ca.exe	82
PID 4172 wrote to memory of 1584	4172	3b03d8ee3dc4406d7be3d995552965ad4b4b9f1f3d106580820ce3e1fa62b2ca.exe	82
PID 1584 wrote to memory of 3936	1584	rfusclient.exe	83
PID 1584 wrote to memory of 3936	1584	rfusclient.exe	83
PID 1584 wrote to memory of 3936	1584	rfusclient.exe	83
PID 1664 wrote to memory of 3872	1664	rutserv.exe	87
PID 1664 wrote to memory of 3872	1664	rutserv.exe	87
PID 1664 wrote to memory of 3872	1664	rutserv.exe	87

C:\Users\Admin\AppData\Local\Temp\3b03d8ee3dc4406d7be3d995552965ad4b4b9f1f3d106580820ce3e1fa62b2ca.exe
"C:\Users\Admin\AppData\Local\Temp\3b03d8ee3dc4406d7be3d995552965ad4b4b9f1f3d106580820ce3e1fa62b2ca.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\rfusclient.exe
  "C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\rfusclient.exe" -run_agent
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\rutserv.exe
    "C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\rutserv.exe" -run_agent
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3936
  - - C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\rutserv.exe
      "C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\rutserv.exe" -run_agent -second
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1664
    - - C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\rfusclient.exe
        
        "C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\rfusclient.exe" /tray /user
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EULA.rtf

Path C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\EULA.rtf
Size 133KB
SHA256 f9c56736029b7d278bf8fabc6e0f5bdac67e24b088f2172ea07df2baa3072c19
MD5 7fd09e69fa62629a04d1e23bb8ca5ff6
SHA1 3952c5f339c8bbdf17aff113bcb0149ac8ce4fa6
SHA512 e66d523eb5bdfc517749b608ffcd66b883be9c4b8c5c42dbf7e48fe412a5c0ca0876d0dbc8a68355e7bb532ce8749c5e444a25f996b4c27e382e79579ab2b59a
SSDEEP 768:wu3f4JDvJNJt2cGTXxl5loUWDTEhkClEgoKt9ai1IYdO5NVSUeDfyF6tEBn2JNC1:wug3F12OqrYZlKFiSEGH4qs
MD5 SHA1 SHA512 SSDEEP

Submit Download

branding.ini

Path C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\branding.ini
Size 376B
SHA256 61887e6a22ce059c09bead6b2bef9f3e2444ee74cc3939bca8c23ccbd7198b23
MD5 b4db1dd8a734175ba9302fbccf334aaa
SHA1 a42f3006dd087a62ab4b8bfc9fece5b080b4dc52
SHA512 d0e8b340e58c5c33eabb665fe587485233a4cc24e513bfaf4cb9ace24b0ceaa97226e33c8a3d947b7cf0aac16847d102cbd7e6fcccad9cabe7f9882c7fdf42df
MD5 SHA1 SHA512

Submit Download

eventmsg.dll

Path C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\eventmsg.dll
Size 51KB
SHA256 0526073f28a3b5999528bfa0e680d668922499124f783f02c52a3b25c367ef6d
MD5 4e84df6558c385bc781cddea34c9fba3
SHA1 6d63d87c19c11bdbfa484a5835ffffd7647296c8
SHA512 c35da0744568bfffeff09e6590d059e91e5d380c5feb3a0fbc5b19477ceca007a882884a7033345ce408fce1deac5248ad9b046656478d734fe494b787f8a9f2
SSDEEP 768:MsmrWdCS5PvBHOUYTKJgr0OMpqdBwFrGjYBZyIh9rOQ:Mza/pu/TKJ/OMpTryYzyMCQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

libeay32.dll

Path C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\libeay32.dll
Size 1.3MB
SHA256 4771b71a48190504094d104087dd431c1c40bde6fad0338a86aa42f7f2a457a5
MD5 5222eaf78313758b0520be16e3f8392e
SHA1 9c7cc8fb340618fef38422cf0c75c4c9bfb216e2
SHA512 459503146f963c64777c56176e480e3334c5bcff2bfef14fc2925b38f1f32117c387dc957789e1691a68798c004c9e672460bda51edcc7b45fb0e1553bf66812
SSDEEP 24576:/NaU+KpPikndiNfzN4jH3PlMQzMjYpOtJqTp/kqg1P:hlUfzN4jH3PlyjYpOLqd/kP1P
MD5 SHA1 SHA512 SSDEEP

Submit Download

logo.png

Path C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\logo.png
Size 5KB
SHA256 a3e6d60bded010557eecede0f550f78f8d117ce67cf154c78daf2dedfaa8250c
MD5 6afe72d31e07025501ce76394e769ed5
SHA1 a6254ecf4004eb67e927b1f89ca671c89343d857
SHA512 d5faff296c8be0b8fad67030a49efb58995f509dc1003111a17bb259fab6fc4e635dc13a441915883299983cdccee6f39a15fe0944c37cf0864d1c92ae619b24
SSDEEP 96:vFdEqCxoKsQkG+N17hsmCQPUOiLxdL1z6FousNb4PmUG6gcHFh/LB1Z41:tt0AQkLNdhnUBHL1uQ4PmSdF/1ZA
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfusclient.exe

Path C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\rfusclient.exe
Size 10.3MB
SHA256 cf49b75a2d687a2699a32f34bbebca1e5b65421ce0828c22e226dda1e26dd28b
MD5 2edafb34eb63daee875fecc5b19246a2
SHA1 2a43141312241ba7f3830242f6934a0e1203350d
SHA512 cf732dfc0151ece0fcd637ee1cd9d59a1728a587f6922646465c03b347a235211fe38459e96c7304cf88418a886a5441c93ee31e16b7917c94347013fdc606b3
SSDEEP 98304:RmpKY+mHGBmkQuug3Njg+652sBr3NocQzbNXiDAuJ4mZlDLpvBRNte:lmsmms+6jDNo5zbpiDPJ48F1vze
MD5 SHA1 SHA512 SSDEEP

Submit Download

rutserv.exe

Path C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\rutserv.exe
Size 20.2MB
SHA256 399f620d9b547d9f9e5d41067e6cbe2d58714d4991901180fbac5661b149d077
MD5 4bd8516dc7c798b63b69b7b668d4fc20
SHA1 57f3a92681aa9e4a57ddf9b0ac5091c0e393053e
SHA512 71469af6064d3e1d279a7b249d4cd18e8cf4abbf8375f35ca1f7287ae7b29848bb23dbfe0cc2962283a9fae6886aa64d328e165de9eb2198b82a6803ff348d81
SSDEEP 196608:/2pcjUzEsEAYrX0H896ZWCAny8ejDjISuBelxXx/zGXI6vin98J:/2pPzEeYrGaCTuelNJzf6Qi
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\settings.dat
Size 7KB
SHA256 6efc5f8e35f8386e1cf5efaa48beb1c3c185a675f5cdebbb2ebf8c83fecb8441
MD5 91dfa7416e006a6c13247baa8a1b50e7
SHA1 b4a5fa20cb3cb866ea65ab7da6f0c4c3542da30e
SHA512 757742e9a2b633621f6f4147ec15b99efdb10f02f1a230d1c5fe4af6b697f1effa967b8e2593fab0abd3c4c2a8290b12f2eca733c05d05769263f4ab84a85efb
SSDEEP 192:GEJv2dIc9mfb/jia+75L+vO8byxDMRpfQhPgxLghat:hQOQ75p8bySfmgvt
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssleay32.dll

Path C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\ssleay32.dll
Size 337KB
SHA256 4f475bd6235d2f761f6c6dbdf3f4b2f35fc6a3787e6b1b28a1912e85cb9be2f6
MD5 90a4b7fc6807693e68dd32b68614d989
SHA1 785484ef531ca90f323d5b017fefcff05e68093a
SHA512 97b970cb24774f141042149ac53e45b3fc42f9ce911c0ca774aa3812f48d7744434bf31d217b2a8522439d0e3f71048cc916556c18a71be61b203c942373a81c
SSDEEP 6144:K6MNzVTEz1LgXCpfoaDRQHojjYkARhcPL0U2pHGS5VdQ/TOEzrqArrpA1riT1PiS:K6MNzVgz1LgXCpfoaDqHojjYkARqPL0g
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8decoder.dll

Path C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\vp8decoder.dll
Size 379KB
SHA256 b419ed0374e3789b4f83d4af601f796d958e366562a0aaea5d2f81e82abdcf33
MD5 e247666cdea63da5a95aebc135908207
SHA1 4642f6c3973c41b7d1c9a73111a26c2d7ac9c392
SHA512 06da11e694d5229783cfb058dcd04d855a1d0758beeaa97bcd886702a1502d0bf542e7890aa8f2e401be36ccf70376b5c091a5d328bb1abe738bc0798ab98a54
SSDEEP 6144:YIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwc8:YI8tiDOzyH9H8Tu6h04fZMZoMPuvfj0h
MD5 SHA1 SHA512 SSDEEP

Submit Download

vp8encoder.dll

Path C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\vp8encoder.dll
Size 1.6MB
SHA256 11c7004851e6e6624158990dc8abe3aa517bcab708364d469589ad0ca3dba428
MD5 d5c2a6ac30e76b7c9b55adf1fe5c1e4a
SHA1 3d841eb48d1a32b511611d4b9e6eed71e2c373ee
SHA512 3c1c7fb535e779ac6c0d5aef2d4e9239f1c27136468738a0bd8587f91b99365a38808be31380be98fd74063d266654a6ac2c2e88861a3fe314a95f1296699e1d
SSDEEP 49152:OSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww3:OSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmmux.dll

Path C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\webmmux.dll
Size 259KB
SHA256 1d6407d7c7ffd2642ea7f97c86100514e8e44f58ff522475cb42bcc43a1b172b
MD5 49c51ace274d7db13caa533880869a4a
SHA1 b539ed2f1a15e2d4e5c933611d736e0c317b8313
SHA512 13440009e2f63078dce466bf2fe54c60feb6cedeed6e9e6fc592189c50b0780543c936786b7051311089f39e9e3ccb67f705c54781c4cae6d3a8007998befbf6
SSDEEP 3072:MW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTl:MWSfr7sXSmPDbKPJ6/AsNk+1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmvorbisdecoder.dll

Path C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\webmvorbisdecoder.dll
Size 364KB
SHA256 c4683eb09d65d692ca347c0c21f72b086bd2faf733b13234f3a6b28444457d7d
MD5 eda07083af5b6608cb5b7c305d787842
SHA1 d1703c23522d285a3ccdaf7ba2eb837d40608867
SHA512 be5879621d544c4e2c4b0a5db3d93720623e89e841b2982c7f6c99ba58d30167e0dd591a12048ed045f19ec45877aa2ef631b301b903517effa17579c4b7c401
SSDEEP 6144:faoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88RtOd:noPH0GgEp0gVd1ValsQXsHOd
MD5 SHA1 SHA512 SSDEEP

Submit Download

webmvorbisencoder.dll

Path C:\Users\Admin\AppData\Roaming\RMS Agent\70220\C10E65EE99\webmvorbisencoder.dll
Size 859KB
SHA256 63b4b5db4a96a8abec82b64034f482b433cd4168c960307ac5cc66d2fbf67ede
MD5 642dc7e57f0c962b9db4c8fb346bc5a7
SHA1 acee24383b846f7d12521228d69135e5704546f6
SHA512 fb163a0ce4e3ad0b0a337f5617a7bf59070df05cc433b6463384e8687af3edc197e447609a0d86fe25ba3ee2717fd470f2620a8fc3a2998a7c3b3a40530d0bae
SSDEEP 12288:vTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRN9S:YYF+Eyx2lzujtEIYRc1cQmsGa7ON9S
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1584-86-0x0000000000C20000-0x0000000001712000-memory.dmp

Download

memory/1584-83-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Download

memory/1664-135-0x00000000004F0000-0x00000000019E1000-memory.dmp

Download

memory/1664-144-0x00000000004F0000-0x00000000019E1000-memory.dmp

Download

memory/1664-170-0x00000000004F0000-0x00000000019E1000-memory.dmp

Download

memory/1664-167-0x00000000004F0000-0x00000000019E1000-memory.dmp

Download

memory/1664-129-0x00000000004F0000-0x00000000019E1000-memory.dmp

Download

memory/1664-164-0x00000000004F0000-0x00000000019E1000-memory.dmp

Download

memory/1664-132-0x00000000004F0000-0x00000000019E1000-memory.dmp

Download

memory/1664-161-0x00000000004F0000-0x00000000019E1000-memory.dmp

Download

memory/1664-158-0x00000000004F0000-0x00000000019E1000-memory.dmp

Download

memory/1664-155-0x00000000004F0000-0x00000000019E1000-memory.dmp

Download

memory/1664-138-0x00000000004F0000-0x00000000019E1000-memory.dmp

Download

memory/1664-152-0x00000000004F0000-0x00000000019E1000-memory.dmp

Download

memory/1664-141-0x00000000004F0000-0x00000000019E1000-memory.dmp

Download

memory/1664-149-0x00000000004F0000-0x00000000019E1000-memory.dmp

Download

memory/3872-147-0x0000000000C20000-0x0000000001712000-memory.dmp

Download

memory/3872-159-0x0000000000C20000-0x0000000001712000-memory.dmp

Download

memory/3872-142-0x0000000000C20000-0x0000000001712000-memory.dmp

Download

memory/3872-150-0x0000000000C20000-0x0000000001712000-memory.dmp

Download

memory/3872-139-0x0000000000C20000-0x0000000001712000-memory.dmp

Download

memory/3872-153-0x0000000000C20000-0x0000000001712000-memory.dmp

Download

memory/3872-136-0x0000000000C20000-0x0000000001712000-memory.dmp

Download

memory/3872-156-0x0000000000C20000-0x0000000001712000-memory.dmp

Download

memory/3872-171-0x0000000000C20000-0x0000000001712000-memory.dmp

Download

memory/3872-168-0x0000000000C20000-0x0000000001712000-memory.dmp

Download

memory/3872-133-0x0000000000C20000-0x0000000001712000-memory.dmp

Download

memory/3872-162-0x0000000000C20000-0x0000000001712000-memory.dmp

Download

memory/3872-130-0x0000000000C20000-0x0000000001712000-memory.dmp

Download

memory/3872-165-0x0000000000C20000-0x0000000001712000-memory.dmp

Download

memory/3936-92-0x00000000004F0000-0x00000000019E1000-memory.dmp

Download

memory/4172-81-0x0000000000400000-0x000000000296D000-memory.dmp

Download

memory/4172-1-0x0000000002E80000-0x0000000002E81000-memory.dmp

Download

memory/4172-0-0x0000000000400000-0x000000000296D000-memory.dmp

Download