neshta | 713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8

Analysis

max time kernel
148s
max time network
144s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe
Size

7.1MB
MD5

d3e1dd11e0f01bbbe93f9ac0406c54c0
SHA1

2c7adcd44d5ed660cd9cdb97426a4c91eff00368
SHA256

713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8
SHA512

7cff26517356dcf48e3da0ee7a69f0023c1e72a2cb07e4a81e0bbed9200ef808245ae68ad6db42f4613eb6e08ca730b7a846dd24dfc7f4d92330d238b8aacb5f
SSDEEP

196608:Eb2IrnugKVAuAwVbdiU9mRwvuoklW0YrUvw:BgKVAuAIluDLlDYYI

Score

10^/10

neshta rms discovery persistence rat spyware stealer trojan

Malware Config

Signatures

Detect Neshta payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\hider.exe	family_neshta
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe	family_neshta
behavioral1/memory/2972-170-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2972-172-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 12 IoCs

Processes:

Desktop.exeRMS.sfx.exeRMS.exehider.exehider.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exe

pid	process
2052	Desktop.exe
2728	RMS.sfx.exe
1912	RMS.exe
2972	hider.exe
2408	hider.exe
552	rutserv.exe
2272	rutserv.exe
2320	rutserv.exe
2732	rutserv.exe
2332	rfusclient.exe
320	rfusclient.exe
1800	rfusclient.exe

Loads dropped DLL 15 IoCs

Processes:

713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.execmd.exeRMS.sfx.execmd.exehider.exeMsiExec.exerutserv.exe

pid	process
2744	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe
2744	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe
2744	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe
2716	cmd.exe
2728	RMS.sfx.exe
2728	RMS.sfx.exe
2728	RMS.sfx.exe
2728	RMS.sfx.exe
1036	cmd.exe
1036	cmd.exe
2972	hider.exe
2972	hider.exe
2792	MsiExec.exe
2732	rutserv.exe
2732	rutserv.exe

Modifies system executable filetype association 2 TTPs 1 IoCs
persistence

Modify Registry
T1112

Change Default File Association
T1546.001

Processes:

hider.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" hider.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Blocklisted process makes network request 4 IoCs

Processes:

msiexec.exe

flow pid process

3 2936 msiexec.exe
5 2936 msiexec.exe
7 2936 msiexec.exe
9 2936 msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	hider.exe

flow	pid	process
3	2936	msiexec.exe
5	2936	msiexec.exe
7	2936	msiexec.exe
9	2936	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\hider.exe	autoit_exe
\Users\Admin\AppData\Local\Temp\3582-490\hider.exe	autoit_exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exehider.exe

description	ioc	process
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\VPDAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.gpd	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmspm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rms.dll	msiexec.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf	msiexec.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	hider.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd	msiexec.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	hider.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	hider.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg	msiexec.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\VPDAgent_x64.exe	msiexec.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	hider.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	hider.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\progress.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\uninstall.cmd	msiexec.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	hider.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	hider.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	hider.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rmspm.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rms.dll	msiexec.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	hider.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.ini	msiexec.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	hider.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	hider.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	hider.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	hider.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	hider.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	hider.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	hider.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	hider.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	hider.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	hider.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rms.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\fwproc.exe	msiexec.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	hider.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\SampleClient.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\progress.exe	msiexec.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rms.lng	msiexec.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	hider.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	hider.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	hider.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	hider.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\fwproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	msiexec.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	hider.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	hider.exe
File created	C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rmsui2.exe	msiexec.exe

Drops file in Windows directory 19 IoCs

Processes:

msiexec.exehider.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIDC84.tmp	msiexec.exe
File created	C:\Windows\Installer\f77a144.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f77a142.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77a13f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD7F.tmp	msiexec.exe
File created	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	msiexec.exe
File created	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	msiexec.exe
File opened for modification	C:\Windows\svchost.com	hider.exe
File created	C:\Windows\Installer\f77a13f.msi	msiexec.exe
File created	C:\Windows\Installer\f77a142.ipi	msiexec.exe
File created	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rutserv.exerutserv.exerfusclient.exemsiexec.exeMsiExec.exerutserv.exechcp.commsiexec.exehider.exerutserv.execmd.exeRMS.sfx.exeRMS.exe713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exeregedit.exemsiexec.exehider.exePING.EXErfusclient.exerfusclient.exeDllHost.exeDesktop.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hider.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RMS.sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RMS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hider.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Desktop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

3040 PING.EXE

pid	process
3040	PING.EXE

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe

Modifies registry class 45 IoCs

Processes:

regedit.exemsiexec.exehider.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\Version = "100603060"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\Assignment = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\AdvertiseFlags = "388"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\DeploymentFlags = "3"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\Media\1 = "DISK1;1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\Version = "100925440"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\LastUsedSource = "n;1;C:\\Users\\836D~1\\AppData\\Local\\Temp\\7ZipSfx.003\\"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\Net\1 = "C:\\Users\\836D~1\\AppData\\Local\\Temp\\7ZipSfx.003\\"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\ProductName = "Remote Manipulator System - Host"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\Language = "1049"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\ProductIcon = "C:\\Windows\\Installer\\{C2AD926E-45DC-4C5F-88A0-63AEE6A3262A}\\ARPPRODUCTICON.exe"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\InstanceType = "0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\202FD250301F9C6428D4824FBB40AD3B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\202FD250301F9C6428D4824FBB40AD3B\RMS	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\PackageCode = "CA621BAB2625C4F47B0824566FC192D8"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\Media\DiskPrompt = "[1]"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\Net	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\ProductIcon = "C:\\Windows\\Installer\\{052DF202-F103-46C9-824D-28F4BB04DAB3}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\PackageName = "host.msi"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\SourceList\Media	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	hider.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\PackageCode = "9F93235A3BF2E414AB9ABB0B9ED903C5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\202FD250301F9C6428D4824FBB40AD3B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\Language = "1049"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\Clients = 3a0000000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\ProductName	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E629DA2CCD54F5C4880A36EA6E3A62A2\AuthorizedLUAApp = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\202FD250301F9C6428D4824FBB40AD3B\SourceList\PackageName = "host.msi"	msiexec.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1004 regedit.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3040 PING.EXE

pid	process
1004	regedit.exe

pid	process
3040	PING.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

msiexec.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exe

pid	process
2936	msiexec.exe
2936	msiexec.exe
552	rutserv.exe
552	rutserv.exe
552	rutserv.exe
552	rutserv.exe
2272	rutserv.exe
2272	rutserv.exe
2320	rutserv.exe
2320	rutserv.exe
2732	rutserv.exe
2732	rutserv.exe
2732	rutserv.exe
2732	rutserv.exe
320	rfusclient.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

hider.exe

pid process

2408 hider.exe
Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

rfusclient.exe

pid process

1800 rfusclient.exe

pid	process
2408	hider.exe

pid	process
1800	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2008	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2008	msiexec.exe
Token: SeRestorePrivilege	2936	msiexec.exe
Token: SeTakeOwnershipPrivilege	2936	msiexec.exe
Token: SeSecurityPrivilege	2936	msiexec.exe
Token: SeCreateTokenPrivilege	2008	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2008	msiexec.exe
Token: SeLockMemoryPrivilege	2008	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2008	msiexec.exe
Token: SeMachineAccountPrivilege	2008	msiexec.exe
Token: SeTcbPrivilege	2008	msiexec.exe
Token: SeSecurityPrivilege	2008	msiexec.exe
Token: SeTakeOwnershipPrivilege	2008	msiexec.exe
Token: SeLoadDriverPrivilege	2008	msiexec.exe
Token: SeSystemProfilePrivilege	2008	msiexec.exe
Token: SeSystemtimePrivilege	2008	msiexec.exe
Token: SeProfSingleProcessPrivilege	2008	msiexec.exe
Token: SeIncBasePriorityPrivilege	2008	msiexec.exe
Token: SeCreatePagefilePrivilege	2008	msiexec.exe
Token: SeCreatePermanentPrivilege	2008	msiexec.exe
Token: SeBackupPrivilege	2008	msiexec.exe
Token: SeRestorePrivilege	2008	msiexec.exe
Token: SeShutdownPrivilege	2008	msiexec.exe
Token: SeDebugPrivilege	2008	msiexec.exe
Token: SeAuditPrivilege	2008	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2008	msiexec.exe
Token: SeChangeNotifyPrivilege	2008	msiexec.exe
Token: SeRemoteShutdownPrivilege	2008	msiexec.exe
Token: SeUndockPrivilege	2008	msiexec.exe
Token: SeSyncAgentPrivilege	2008	msiexec.exe
Token: SeEnableDelegationPrivilege	2008	msiexec.exe
Token: SeManageVolumePrivilege	2008	msiexec.exe
Token: SeImpersonatePrivilege	2008	msiexec.exe
Token: SeCreateGlobalPrivilege	2008	msiexec.exe
Token: SeShutdownPrivilege	1892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1892	msiexec.exe
Token: SeCreateTokenPrivilege	1892	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1892	msiexec.exe
Token: SeLockMemoryPrivilege	1892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1892	msiexec.exe
Token: SeMachineAccountPrivilege	1892	msiexec.exe
Token: SeTcbPrivilege	1892	msiexec.exe
Token: SeSecurityPrivilege	1892	msiexec.exe
Token: SeTakeOwnershipPrivilege	1892	msiexec.exe
Token: SeLoadDriverPrivilege	1892	msiexec.exe
Token: SeSystemProfilePrivilege	1892	msiexec.exe
Token: SeSystemtimePrivilege	1892	msiexec.exe
Token: SeProfSingleProcessPrivilege	1892	msiexec.exe
Token: SeIncBasePriorityPrivilege	1892	msiexec.exe
Token: SeCreatePagefilePrivilege	1892	msiexec.exe
Token: SeCreatePermanentPrivilege	1892	msiexec.exe
Token: SeBackupPrivilege	1892	msiexec.exe
Token: SeRestorePrivilege	1892	msiexec.exe
Token: SeShutdownPrivilege	1892	msiexec.exe
Token: SeDebugPrivilege	1892	msiexec.exe
Token: SeAuditPrivilege	1892	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1892	msiexec.exe
Token: SeChangeNotifyPrivilege	1892	msiexec.exe
Token: SeRemoteShutdownPrivilege	1892	msiexec.exe
Token: SeUndockPrivilege	1892	msiexec.exe
Token: SeSyncAgentPrivilege	1892	msiexec.exe
Token: SeEnableDelegationPrivilege	1892	msiexec.exe
Token: SeManageVolumePrivilege	1892	msiexec.exe
Token: SeImpersonatePrivilege	1892	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

DllHost.exemsiexec.exemsiexec.exerfusclient.exe

pid process

2124 DllHost.exe
2008 msiexec.exe
2008 msiexec.exe
1892 msiexec.exe
1892 msiexec.exe
2332 rfusclient.exe
2332 rfusclient.exe
2332 rfusclient.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

rfusclient.exe

pid process

2332 rfusclient.exe
2332 rfusclient.exe
2332 rfusclient.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

DllHost.exerutserv.exerutserv.exerutserv.exerutserv.exe

pid process

2124 DllHost.exe
2124 DllHost.exe
552 rutserv.exe
2272 rutserv.exe
2320 rutserv.exe
2732 rutserv.exe

pid	process
2124	DllHost.exe
2008	msiexec.exe
2008	msiexec.exe
1892	msiexec.exe
1892	msiexec.exe
2332	rfusclient.exe
2332	rfusclient.exe
2332	rfusclient.exe

pid	process
2332	rfusclient.exe
2332	rfusclient.exe
2332	rfusclient.exe

pid	process
2124	DllHost.exe
2124	DllHost.exe
552	rutserv.exe
2272	rutserv.exe
2320	rutserv.exe
2732	rutserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exeDesktop.execmd.exeRMS.sfx.exeRMS.execmd.exe

description	pid	process	target process
PID 2744 wrote to memory of 2052	2744	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe	Desktop.exe
PID 2744 wrote to memory of 2052	2744	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe	Desktop.exe
PID 2744 wrote to memory of 2052	2744	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe	Desktop.exe
PID 2744 wrote to memory of 2052	2744	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe	Desktop.exe
PID 2744 wrote to memory of 2052	2744	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe	Desktop.exe
PID 2744 wrote to memory of 2052	2744	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe	Desktop.exe
PID 2744 wrote to memory of 2052	2744	713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe	Desktop.exe
PID 2052 wrote to memory of 2716	2052	Desktop.exe	cmd.exe
PID 2052 wrote to memory of 2716	2052	Desktop.exe	cmd.exe
PID 2052 wrote to memory of 2716	2052	Desktop.exe	cmd.exe
PID 2052 wrote to memory of 2716	2052	Desktop.exe	cmd.exe
PID 2052 wrote to memory of 2716	2052	Desktop.exe	cmd.exe
PID 2052 wrote to memory of 2716	2052	Desktop.exe	cmd.exe
PID 2052 wrote to memory of 2716	2052	Desktop.exe	cmd.exe
PID 2716 wrote to memory of 2728	2716	cmd.exe	RMS.sfx.exe
PID 2716 wrote to memory of 2728	2716	cmd.exe	RMS.sfx.exe
PID 2716 wrote to memory of 2728	2716	cmd.exe	RMS.sfx.exe
PID 2716 wrote to memory of 2728	2716	cmd.exe	RMS.sfx.exe
PID 2716 wrote to memory of 2728	2716	cmd.exe	RMS.sfx.exe
PID 2716 wrote to memory of 2728	2716	cmd.exe	RMS.sfx.exe
PID 2716 wrote to memory of 2728	2716	cmd.exe	RMS.sfx.exe
PID 2728 wrote to memory of 1912	2728	RMS.sfx.exe	RMS.exe
PID 2728 wrote to memory of 1912	2728	RMS.sfx.exe	RMS.exe
PID 2728 wrote to memory of 1912	2728	RMS.sfx.exe	RMS.exe
PID 2728 wrote to memory of 1912	2728	RMS.sfx.exe	RMS.exe
PID 2728 wrote to memory of 1912	2728	RMS.sfx.exe	RMS.exe
PID 2728 wrote to memory of 1912	2728	RMS.sfx.exe	RMS.exe
PID 2728 wrote to memory of 1912	2728	RMS.sfx.exe	RMS.exe
PID 1912 wrote to memory of 1036	1912	RMS.exe	cmd.exe
PID 1912 wrote to memory of 1036	1912	RMS.exe	cmd.exe
PID 1912 wrote to memory of 1036	1912	RMS.exe	cmd.exe
PID 1912 wrote to memory of 1036	1912	RMS.exe	cmd.exe
PID 1912 wrote to memory of 1036	1912	RMS.exe	cmd.exe
PID 1912 wrote to memory of 1036	1912	RMS.exe	cmd.exe
PID 1912 wrote to memory of 1036	1912	RMS.exe	cmd.exe
PID 1036 wrote to memory of 2600	1036	cmd.exe	chcp.com
PID 1036 wrote to memory of 2600	1036	cmd.exe	chcp.com
PID 1036 wrote to memory of 2600	1036	cmd.exe	chcp.com
PID 1036 wrote to memory of 2600	1036	cmd.exe	chcp.com
PID 1036 wrote to memory of 2600	1036	cmd.exe	chcp.com
PID 1036 wrote to memory of 2600	1036	cmd.exe	chcp.com
PID 1036 wrote to memory of 2600	1036	cmd.exe	chcp.com
PID 1036 wrote to memory of 2008	1036	cmd.exe	msiexec.exe
PID 1036 wrote to memory of 2008	1036	cmd.exe	msiexec.exe
PID 1036 wrote to memory of 2008	1036	cmd.exe	msiexec.exe
PID 1036 wrote to memory of 2008	1036	cmd.exe	msiexec.exe
PID 1036 wrote to memory of 2008	1036	cmd.exe	msiexec.exe
PID 1036 wrote to memory of 2008	1036	cmd.exe	msiexec.exe
PID 1036 wrote to memory of 2008	1036	cmd.exe	msiexec.exe
PID 1036 wrote to memory of 1892	1036	cmd.exe	msiexec.exe
PID 1036 wrote to memory of 1892	1036	cmd.exe	msiexec.exe
PID 1036 wrote to memory of 1892	1036	cmd.exe	msiexec.exe
PID 1036 wrote to memory of 1892	1036	cmd.exe	msiexec.exe
PID 1036 wrote to memory of 1892	1036	cmd.exe	msiexec.exe
PID 1036 wrote to memory of 1892	1036	cmd.exe	msiexec.exe
PID 1036 wrote to memory of 1892	1036	cmd.exe	msiexec.exe
PID 1036 wrote to memory of 2972	1036	cmd.exe	hider.exe
PID 1036 wrote to memory of 2972	1036	cmd.exe	hider.exe
PID 1036 wrote to memory of 2972	1036	cmd.exe	hider.exe
PID 1036 wrote to memory of 2972	1036	cmd.exe	hider.exe
PID 1036 wrote to memory of 2972	1036	cmd.exe	hider.exe
PID 1036 wrote to memory of 2972	1036	cmd.exe	hider.exe
PID 1036 wrote to memory of 2972	1036	cmd.exe	hider.exe
PID 1036 wrote to memory of 1004	1036	cmd.exe	regedit.exe

C:\Users\Admin\AppData\Local\Temp\713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe
"C:\Users\Admin\AppData\Local\Temp\713ee5303a9b0d04d6d5107ead0a624d40c2cdd1e4ad43e4ab2fdcfe813b23a8N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\Desktop.exe
  "C:\Users\Admin\AppData\Local\Temp\Desktop.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\1.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\RMS.sfx.exe
      RMS.sfx.exe -p112233 -dC:\Users\Admin\AppData\Local\Temp
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\RMS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RMS.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1912
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd" "
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2600
        
        C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /passive REBOOT=ReallySuppress
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:2008
        
        C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /x {052DF202-F103-46C9-824D-28F4BB04DAB3} /passive REBOOT=ReallySuppress
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\hider.exe
        
        hider.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system executable filetype association
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\hider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\hider.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:2408
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s regedit.reg
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Runs .reg file with regedit
        
        PID:1004
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3040
        
        C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /I "host.msi" /qn
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1040

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2124

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C1472432A4C05E99038EF881A4528917
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2792
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:552
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2272
- C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2320

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2732
- C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:320
- - C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
    "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    PID:1800
- C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
  "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f77a143.rbs

Filesize
19KB

MD5
255ad8acf52acdf067a37fe1c5e6868e

SHA1
e106b901623723e07a5371a57b8bc070d6030aef

SHA256
5dae9a8e6e9e7416577db52f6a9e95949c4ffcd2fd9dfb5cd396668626f3c527

SHA512
c06a29099907df78ba05954e54ce6e2c2cd8822c06a0f7e43d5ccef58c95501a9147c8c38ad77be4ed6f5cbeb1b916ad543f0cd48c65f3900018bef43890a3eb

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe

Filesize
1.1MB

MD5
566ed4f62fdc96f175afedd811fa0370

SHA1
d4b47adc40e0d5a9391d3f6f2942d1889dd2a451

SHA256
e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460

SHA512
cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\English.lg

Filesize
43KB

MD5
3e9f90664b9634099e9727d179bc11b7

SHA1
de77b77f74d84a5ffeeda14f036a3917ae1195a3

SHA256
490c7d1cb173a86b2039406541ea51c1d375f49547ad2a06de127481c2ac7ecf

SHA512
d2159afbffd409d3a595cd8b1256366fedaf5fa49badd4534dc8de6e61a6658c87300297b24d4ca9c498f1c14c053e1caf222b8c5867547b4efe7bab2efa7129

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\RIPCServer.dll

Filesize
145KB

MD5
a2c0939df5f3c48227dd31c3f95b6de1

SHA1
99fa87b995fc78c3edacb231a31cce33a337f371

SHA256
fe7be342564d8ed7fd584f0e47601dd4a3e4aeb3af51fadb49ec70a2b7827e6a

SHA512
c881a40dd857637ae7dae67dec83918fdb39d02eb5bce84c7bc6ff0111ddc57af844f60fe3b259fb903b10609139f22783c746c7610ab552c9ebec584dd6f8b3

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\RWLN.dll

Filesize
976KB

MD5
ce8162b35f8853fb34ba2ff47b4aac73

SHA1
852d647635f9841671de9b931831e49eade8cada

SHA256
1f4d34244807ca97e13ee49718ab42ebf9673095619fd0dcf1ef7a2cd789008d

SHA512
3600bcc6e7c77841d1356c484a8f46257c0c0c396f3aa5aa78a5509f2847cde5117f047ec8a07374b03abb41e51151c08d45bc1dfde6775e9ae5d13ca5af6fc1

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\Russian.lg

Filesize
48KB

MD5
78394a154feb33ccc8906dc5aa8abdfc

SHA1
9b9f3c219ebe07753ba72d0161ab52258a541159

SHA256
77d7745e1f368f009da80def11ff3c38d72265ad258524996bf777b04b9f3c55

SHA512
828cccf1add88cd8a953ea76e4fd4a2728156c01253192ef95efdb92045755935aea0445b158a74d0d42f0e2b7706e637c623441bd5159870793cf360575a946

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Filesize
5.1MB

MD5
3a0f8eded8325feabe74c0921271c6e6

SHA1
be20ba359e25a02212bf3c05989e30a343b155d1

SHA256
2f26fbc1f0e7747f2356c391860bfb651adfb62c63bca05a41e39f4763b9afe3

SHA512
bc20a4af1d1e7ec95ce47daefb20aa3958b898927efe0caba3ef5298a6b86746a2b8ac5837a8f778b3391208c35fa50fb5d5ccd0649423310897b01bbac16443

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Filesize
6.1MB

MD5
13b2bad4e17ce849587746dc186ebce2

SHA1
2d1c673dbcc75e561a9e35c9994e01395b5025d0

SHA256
5631cffa8b148ffa478f49a178de266508b685fef86c32fb7a899379e732249a

SHA512
a9d3f41534c7126cb08cf840409c5b48b2420f853364e78101a70f71d0c7e5ec0e19d4c61acbea88b723aef810cad0d7ae3e73c986d683e46229f88b7ab653b7

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

Filesize
368KB

MD5
eae4541acd1011a52deb706440c47ac1

SHA1
1648c82f20bcc77e099194fbe5f307cd4cdd0b51

SHA256
416c3a671a5e88509b00ac434f0d2002ea03993fa222bb437b0f1f34c93480b1

SHA512
60e023f8db5a524cbfae3137cfd57c9fba654ebf2f693a0181e3282cce5b7381f0f30f3b280d7048443e968f7cabcf9a48432dbaf0f6bf63c1e5ba2d9e7a6159

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

Filesize
624KB

MD5
b59068db99550dccda9d26cbfdefe50f

SHA1
612b153a0f000ee0114335c9bb2ba668572c172e

SHA256
59192c88831aa9f06cf2a699145a289c8482ad57888de1ca6f031971e54838ef

SHA512
9ed46090aeeecd33216189d759b5db62ade28e8f2efec7999116bcd30b3a003492a9a5f8d8cc2f1d4799b126556fb589436c1a538a70f2803b6539a30cd1783a

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll

Filesize
236KB

MD5
917ddc7d35424c3ae0d875bb98824a81

SHA1
0f91e4229952ab1f27ac57cd0a09682418569fe7

SHA256
9f2b3d24dea4d90679c1ee5d0c90b45683dde390323ad47ab1e4b7c34b7c62ff

SHA512
4b6c1cbd4b69cf2230c989301db36d06c4e66517e79a16e699b2497c80ca8b315194a38095afadd6373c9e0811d9dbd277a91e4be90bdd70680f8e5f4bf33aaf

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll

Filesize
324KB

MD5
4dfef8a4490a49790be02abd7483f135

SHA1
68ce62ea1f6bc5f2706fb1b86dd8d88f035625b7

SHA256
4190a7866c28cf4ac40ef2e8f1b31e48e3df79b1497c3a31136774bbd0cf6087

SHA512
3706e36fe6fa2b9a27008ce263fe00ba045151b69de87ec2d9638032336660281c63fcc6efb202b725720e186bfade2ba04722df2e692c0ccfce03b8629002da

Download Submit
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll

Filesize
1.7MB

MD5
de2a525d42130c9d119ae870da97ec71

SHA1
8d86b03e1c6b34c365c3ab50884e1f4067fe4068

SHA256
b1fa6f9b5c036e44b00550da019ffb7d4d6c7d36d94f1b5af629f35d6c60eeb4

SHA512
aada65b93ea510604df53ac40548c33e5a6348d70b898eeb335839b1dc7c273d01de7c9989dbceb4a5609e1eb6b33cff81a8e71a6f12ae0fa621163c17aad476

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.bat

Filesize
29B

MD5
8a75801ccaaa5caa9823f1baf2840571

SHA1
5457940aad7af0ea1b88e70bec0621a13ee968b7

SHA256
0cb9043c598db88734389e663457966c383b1c6dcc06306f4250b21ba6bde2b9

SHA512
d811eecf41e022bb1ccca4ffeb51b0a78c50db54d6d861086d6bea052414d81c869ebcc96c1f593a31e4e2b7d4c4e663eae672f87d64b2e6c80a7c1693646aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\hider.exe

Filesize
880KB

MD5
0c796e388e5bb3517a61bdb0e2a8810e

SHA1
86b2c29152a0038e34053093ebdcc4f251268e9e

SHA256
74edad6c32d5d0cd251d9e5fe630327cf4e692c9ebe436ba281ab8c3b25f53bc

SHA512
614305e9c69e5f6881ebce0b2e95c6f0c236dad88237e7aa0d97b4c46811ade4cec934b0f057d53e2159b14e8d5edbf912436e05b26fdcd876bfabd35fd42390

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\host.msi

Filesize
7.0MB

MD5
cbfb4ce0261a2a2aaca840e36f9e729b

SHA1
4ccc8f8b4cd31063afecaaf041b4ed97f0b57dad

SHA256
12df9c6dc2d8e2a23420ebe6b58ebd1db2fb772d880820193cbce85bb934749f

SHA512
9b94f6bb94e4dfeac1e2464b317a2394914eae333e10ce93cc3473467d2a698ad71b90a72e090453631ccd0a3b418e2a50256bd8146b0133be8dbd33a8db6852

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\install.cmd

Filesize
264B

MD5
435aec1fbfb10c119fa243778142c1dc

SHA1
b3b01913c49920fcbf0dbe23159d75cc6eb058b3

SHA256
307e24d67bdce6b881750c967585ca3c4feeecdcbabfbe32f7fc8e9ee0f3139a

SHA512
e5bc200a50ce9937afb423eaacb87ab212765b7ecc0f1d617787688b6067eefc95e8e8cedeb51a5e7a6cfbf89725bfaf75e7c3ea4d8cd17d5528b3c080c202d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\regedit.reg

Filesize
3KB

MD5
66e2270250f7e8f568c706be75067e4b

SHA1
96b85b7fecfe0aaa4fb3b1329099a733a58529ae

SHA256
ab379c50047643d2e1b062e9a938d8391a78c85055941face68aa810952c6603

SHA512
1019882ae644bbc81fcbcfc6a85bac919be3ada1677349c9e52bf431a6faa10b81b37d20d0bba73843634588452e86efc7199c2efd936d683be7e63f6a211cad

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD1E2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RMS.sfx.exe

Filesize
6.7MB

MD5
af0d19d8035b07f70e70eaed1b03ac03

SHA1
c5be6e7308b81c5058fbe13b8777b4f940d7f57e

SHA256
37eab2baf4069ba154dda245b795d5cabe3fa1a9d26204da0b2e9c01b8486d91

SHA512
0b298dcd045cb51cea16736d8deb6e4c4f7a1aacdb2811a3403e3a40c068f116eede32ac12628d82ff20d1309663342ed1f33f76d9817a0f50046bf35b1de092

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD1F4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\rekviziti.jpg

Filesize
305KB

MD5
0767e80f4598317d832ef9c7a43d238d

SHA1
efad4f80eaf8bcb267e6005956fb437d8ff7e349

SHA256
c660e8b4a8915217e987e97ed22f0f9898f064c071f52493d199961a9b7513c8

SHA512
86da31d619beece218652603e07822acab55e5d839d9eb6fe69126daae1d3dd8e21e03b324059bb3aab77d4623981cd307fdf64bb0a5c69be6aea55c80ae272d

Download Submit
C:\Windows\Installer\MSIDC84.tmp

Filesize
125KB

MD5
b0bcc622f1fff0eec99e487fa1a4ddd9

SHA1
49aa392454bd5869fa23794196aedc38e8eea6f5

SHA256
b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

SHA512
1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

Download Submit
C:\Windows\Installer\{052DF202-F103-46C9-824D-28F4BB04DAB3}\server_start_C00864331B9D4391A8A26292A601EBE2.exe

Filesize
96KB

MD5
9e2c097647125ee25068784acb01d7d3

SHA1
1a90c40c7f89eec18f47f0dae3f1d5cd3a3d49b5

SHA256
b4614281771ed482970fd0d091604b3a65c7e048f7d7fa8794abd0a0c638f5d2

SHA512
e2f334f31361ea1ffc206184808cb51002486fe583dc23b4f617bead0e3940fdc97b72cda2a971e2cf00462940b31e065228f643835d156e7166e8803e3181f1

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\hider.exe

Filesize
839KB

MD5
045fde9f9507c142cd8433e21d778f42

SHA1
231b352e986a1ac71fa08f7b26be785d36424a85

SHA256
b12943cafc7b9a793ccc486049d9eb7be1167494664f01fd715083b8608f16a7

SHA512
8c32a3b015f66027d4cb6b7f0a585eb7bd3a31ea2232fbefa66b2cf2d0a74e889bfdd8f86a30fb14ed82c56eecc12f4bfc58d6ce9816633d7e093cde0f68154d

Download Submit
\Users\Admin\AppData\Local\Temp\Desktop.exe

Filesize
6.8MB

MD5
fc9f1cfbbe0e5a33c365571d27f660c6

SHA1
09dae91cc367c188af28a51843df8ad87fa5a502

SHA256
41a67e8943d68107f79101a91e045ba34a5d8ee653310b4b8753b8a53400bfd6

SHA512
f88b59df41865ca97a66888bb5cda5f930105e9521f086a9173038ee7d921f05e755cbf196c6324667430b706747dd1cd4cf55e5f9c74c8fa059a7f57739898e

Download Submit
\Users\Admin\AppData\Local\Temp\RMS.exe

Filesize
6.6MB

MD5
f74cca6d5ae0e8cfdff100d2cf607eb5

SHA1
18efbce1da063fb90f9af4be9f9f23607feb9d12

SHA256
35165f8a7218eff0c6ad478d92e182e019eed97278a24a33985a1451f0c919ac

SHA512
b20e7d373de3664d94dfa268bcec7dea294c5b4b1fca9570cb9d416ea5f3895c42910ca34bf828655040b78459c7cd460341d4d36021e72ec77a7485250dca68

Download Submit
memory/320-342-0x0000000000400000-0x00000000009A4000-memory.dmp

Filesize
5.6MB

Download
memory/552-300-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/1800-340-0x0000000000400000-0x00000000009A4000-memory.dmp

Filesize
5.6MB

Download
memory/2124-5-0x0000000000150000-0x0000000000152000-memory.dmp

Filesize
8KB

Download
memory/2272-303-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/2320-332-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/2332-347-0x0000000000400000-0x00000000009A4000-memory.dmp

Filesize
5.6MB

Download
memory/2332-351-0x0000000000400000-0x00000000009A4000-memory.dmp

Filesize
5.6MB

Download
memory/2332-366-0x0000000000400000-0x00000000009A4000-memory.dmp

Filesize
5.6MB

Download
memory/2332-343-0x0000000000400000-0x00000000009A4000-memory.dmp

Filesize
5.6MB

Download
memory/2332-359-0x0000000000400000-0x00000000009A4000-memory.dmp

Filesize
5.6MB

Download
memory/2732-349-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/2732-345-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/2732-357-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/2732-364-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/2732-341-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/2732-367-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/2732-371-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/2732-378-0x0000000000400000-0x0000000000AB2000-memory.dmp

Filesize
6.7MB

Download
memory/2744-4-0x0000000000B80000-0x0000000000B82000-memory.dmp

Filesize
8KB

Download
memory/2972-172-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2972-170-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download