rms | 3b328d4649eae2d574eab7ef71cf38a249b78d8b5fed20b3a1c549c361580027

Analysis

max time kernel
149s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

agent-7.6.2.0.exe
Size

22.3MB
MD5

c1b51dbd3b3b55a8af24abbf3ef8050b
SHA1

cb0f2984d2b91f6b9cc408ef9aaa676d364daeb7
SHA256

3b328d4649eae2d574eab7ef71cf38a249b78d8b5fed20b3a1c549c361580027
SHA512

5ef84faabb32e974e874e5f12df0b7e5f0d8ed7102ce90bd2239484a52d9c49c87c1c61cb1ce95d9eacc7004df52551b5da86ecc0b844f84d5eefb8f46ea40c7
SSDEEP

393216:HkCtFKocM21vr0SkISu8mzhTx8r1mmuBka7Z+jXmoU4zJHTJRykR1dHA4L9WMVNe:Htcm2vJzhTx8QPT7QXNnVTb5DLjNWnz

Score

10^/10

rms discovery persistence rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Rms family
rms

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AgentRunOnce = "C:\\Users\\Admin\\AppData\\Roaming\\Remote Utilities Agent\\70620\\AF0B95CED3\\rutserv.exe"	rutserv.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\International\Geo\Nation	rfusclient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\International\Geo\Nation	rutserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\International\Geo\Nation	rfusclient.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2860-28-0x0000000000290000-0x0000000003275000-memory.dmp	upx
behavioral1/memory/2860-73-0x0000000000290000-0x0000000003275000-memory.dmp	upx

Executes dropped EXE 4 IoCs

pid	Process
2804	rfusclient.exe
2652	rutserv.exe
1492	rutserv.exe
1880	rfusclient.exe

Loads dropped DLL 9 IoCs

pid	Process
2860	agent-7.6.2.0.exe
2804	rfusclient.exe
2804	rfusclient.exe
2804	rfusclient.exe
2804	rfusclient.exe
2804	rfusclient.exe
2652	rutserv.exe
1492	rutserv.exe
1880	rfusclient.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x0007000000016de8-56.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent-7.6.2.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\SysWOW64\ieframe.dll,-5723 = "The Internet"	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\prnfldr.dll,-8036 = "Printers"	rutserv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\NetworkExplorer.dll,-1 = "Network"	rutserv.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2804	rfusclient.exe
2804	rfusclient.exe
2652	rutserv.exe
2652	rutserv.exe
2652	rutserv.exe
1492	rutserv.exe
1492	rutserv.exe
1880	rfusclient.exe
1880	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2652	rutserv.exe
Token: SeTakeOwnershipPrivilege	1492	rutserv.exe
Token: SeTcbPrivilege	1492	rutserv.exe
Token: SeTcbPrivilege	1492	rutserv.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1880	rfusclient.exe
1880	rfusclient.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1880	rfusclient.exe
1880	rfusclient.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2652	rutserv.exe
2652	rutserv.exe
2652	rutserv.exe
2652	rutserv.exe
1492	rutserv.exe
1492	rutserv.exe
1492	rutserv.exe
1492	rutserv.exe
1492	rutserv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2804	2860	agent-7.6.2.0.exe	30
PID 2860 wrote to memory of 2804	2860	agent-7.6.2.0.exe	30
PID 2860 wrote to memory of 2804	2860	agent-7.6.2.0.exe	30
PID 2860 wrote to memory of 2804	2860	agent-7.6.2.0.exe	30
PID 2804 wrote to memory of 2652	2804	rfusclient.exe	31
PID 2804 wrote to memory of 2652	2804	rfusclient.exe	31
PID 2804 wrote to memory of 2652	2804	rfusclient.exe	31
PID 2804 wrote to memory of 2652	2804	rfusclient.exe	31
PID 1492 wrote to memory of 1880	1492	rutserv.exe	34
PID 1492 wrote to memory of 1880	1492	rutserv.exe	34
PID 1492 wrote to memory of 1880	1492	rutserv.exe	34
PID 1492 wrote to memory of 1880	1492	rutserv.exe	34

C:\Users\Admin\AppData\Local\Temp\agent-7.6.2.0.exe
"C:\Users\Admin\AppData\Local\Temp\agent-7.6.2.0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rfusclient.exe
  "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rfusclient.exe" -run_agent
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rutserv.exe
    "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rutserv.exe" -run_agent
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2652
  - - C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rutserv.exe
      "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rutserv.exe" -run_agent -second
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1492
    - - C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rfusclient.exe
        
        "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rfusclient.exe" /tray /user
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\eventmsg.dll

Filesize
57KB

MD5
382f1f40ace9eb75f55400d4bea1dbf6

SHA1
94176ea4b9529c377bbdec1cb70458691b2efade

SHA256
badd947460e6ac9ef7d9abc286054b5b73e17ab5694f827f26d56203974f1ea2

SHA512
3816d67e85ebf3b23c2094c1647f41f8b1ceff6ae864ea406aa9c4c481a10ce30ed0aede90af536c6a80edf9a62abdece29517035419706257d0a0c1c0ac802c

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\libasset32.dll

Filesize
8.8MB

MD5
ec1498f406642076468424ef2f45c452

SHA1
4ab87728753c802273ad96f5567ecabfe1274465

SHA256
c127f79b4996890a01986f88b4e2076ff7cdb8b6de01092c548b3f28aeda35dd

SHA512
df23385529ccf209478ab64756971e242caeb6c9157605bfc4c8b77bbc8af588f54c90b9fd3814372dd7f226edffb4425516eba296881ef5230bb5a9d591f60a

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\libcodec32.dll

Filesize
6.8MB

MD5
57d6a827675eebf81b140724fd7c6754

SHA1
ebd29678e93aeef160bac2d62d5112823bfca54e

SHA256
7c12b161b9f1be77a852cab4979fc0dc85f0e895d59d2f82622e573b9b00f860

SHA512
8fafc097f194fb63086765ffec8aa110ac50774d340fb683181072e76b23e87dbc6ae22cd7247a2aadbb52a00f871b5bef847b51009326d0eaf78e2ee335e757

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\licenses.txt

Filesize
19KB

MD5
11b4de5dc2e474660c966c79bbcc0704

SHA1
b921b50c8e4f68e2cdc76e00bbbfbdf479610b41

SHA256
4ef24da2e7933364af0c7918207927283d0b7664c615b888cc80843d7a62faa4

SHA512
22e6a9254249647858e5e2c6f324cf0b7dcc9fcad9438453a0b966813f14102fb73bc9c40a037da9a1edea6c1f4ebca4ab71e69219730dd57affaa0ed9c83512

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\privacy_policy.rtf

Filesize
139KB

MD5
b6d5dd2e4b2b3163f6bad087aa9f2ba4

SHA1
a9ef4821812d21c6bd93c9bc262494331d8eb130

SHA256
1fcb0c18d74b4157752a5776ca47bf31f893453b4bcb82ba67b402769d054c26

SHA512
06b30fa94a1177c08dbcdf2251f2e48640bfe6403849d99af5522e0dd6e6978d9d30abc3d1023498b51cd9833ef9dc9845b73310cad2cd29650379f6f7c80b9b

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rfusclient.exe

Filesize
10.8MB

MD5
6b9f07a3ee75fb38eb7fd9bc8a96ae02

SHA1
4c14f38f2d92bbbc3269dadfed870246eba2ebfe

SHA256
6a9cd931c9e8c4fcd39dcbfe09d7b94d367f31d22ed153239bd6fdece6e58377

SHA512
5d5c1adefb0d21b03410de27a9de337028b3084ae9fa357708b0f8ec096cc6785aa7289c8ac05a8ea50e48b23f8ba6d4186d5b7da9ab1fe80af8289f74bed76f

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\rutserv.exe

Filesize
21.0MB

MD5
9193d8f7d011b0687ab90a8cd9b8fa5b

SHA1
62358120d0e3c9602f97ff529f6ba50c82903284

SHA256
e3d1f9b01467d3013ae4612ccf577830a68b5e2e3b55c7fecba47cb88a031275

SHA512
45eea8d4a36ca8f215bd2cba0bb603ac95d181be4f188f56cdaa429d8e8c0523747d136fd5f9876bd8465b68f04c5e7c3fcfdd0de13d65c087e14d2e74d33205

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\vp8decoder.dll

Filesize
384KB

MD5
8e643fba05dbd17e52b0f57930a2b759

SHA1
55e11d1cc910700da3a35ba55dc2985f3795c4be

SHA256
851093c801f9f2f3ba670ff2c14c0a673b17efd72731c28a49ca3dcb64b57718

SHA512
266067cc095889c4431b7d2f7eb773bb023a6c9f920d9f66a3af27e75d704091d797c3b489ad4b92d1e10a6cf6ec4bea14db654ace5f7a97e1085298acf3dff6

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\vp8encoder.dll

Filesize
1.6MB

MD5
e58922447d2d0a9c007ccdca2a37cd81

SHA1
56dfa225585db1e31bea28a8225dfce18a4c0625

SHA256
1fad67e1677401751b4c1ef7d18167174f72c247d8656e99a91104901d1b1400

SHA512
cf1e9928bf2002c189c8667050fce9606a2338aefe29d7542ae21514417e623b8e2e2a83426b3d27755daa0868ed8aa6d4c82870a6abb8155214f8f45603eb82

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\webmmux.dll

Filesize
264KB

MD5
696b0057893c38580911c0579a9909b0

SHA1
59c22298a5c37ca26999acac9e16822247cdfc47

SHA256
1a1b4441fc6fdaf8b9d4a5de3e5855e15217e3810f4aca21a5ca9bb70afab5b4

SHA512
38236ca4c1e2e032172535a4f2aec6bbda231f951007b7316dbc787374d16296ba11e2d080989ca17964e5450e61de2ea3010b0d38cde20d4de1a30ab294759b

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\webmvorbisdecoder.dll

Filesize
369KB

MD5
170c0540946feeb20199d9a594e11879

SHA1
ee1e065d9c5fcb7af4f4d2f6809a1ee01dfcd0bd

SHA256
2d2a368c897f3aadeb4a8d0f46016f0148799fdc7b18059f1a6cce62883ae7de

SHA512
33e26e8083833aa8f9864ac38517581ccde33fa4a293e1779f32e2ad1d7782437836cb27598d837e7ecdf53e18716a54caf7e7d588347850d40674a3917cf6aa

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70620\AF0B95CED3\webmvorbisencoder.dll

Filesize
864KB

MD5
7a8acedc516cc199f7b56ca09def1ab0

SHA1
f0579f76bae11358f4efa0d4a2aa46a7c667865c

SHA256
f858c62cac8d5063a3cffb8a7beb241725b94ab326e0bd2442dacb8e70461721

SHA512
5b028c87c515ed32b6291c9b68bb66452f2e2b0a2aeffd62c07f87d62e517aa129199f49b9a3f7e926de790164f4f1e3251aad8dfcebe65b5f824ced1af6490f

Download Submit
memory/1492-157-0x00000000003B0000-0x000000000196D000-memory.dmp

Filesize
21.7MB

Download
memory/1492-132-0x00000000003B0000-0x000000000196D000-memory.dmp

Filesize
21.7MB

Download
memory/1492-117-0x00000000003B0000-0x000000000196D000-memory.dmp

Filesize
21.7MB

Download
memory/1492-152-0x00000000003B0000-0x000000000196D000-memory.dmp

Filesize
21.7MB

Download
memory/1492-147-0x00000000003B0000-0x000000000196D000-memory.dmp

Filesize
21.7MB

Download
memory/1492-142-0x00000000003B0000-0x000000000196D000-memory.dmp

Filesize
21.7MB

Download
memory/1492-137-0x00000000003B0000-0x000000000196D000-memory.dmp

Filesize
21.7MB

Download
memory/1492-162-0x00000000003B0000-0x000000000196D000-memory.dmp

Filesize
21.7MB

Download
memory/1492-98-0x00000000740C0000-0x000000007476A000-memory.dmp

Filesize
6.7MB

Download
memory/1492-97-0x00000000003B0000-0x000000000196D000-memory.dmp

Filesize
21.7MB

Download
memory/1492-108-0x00000000740C0000-0x000000007476A000-memory.dmp

Filesize
6.7MB

Download
memory/1492-107-0x00000000003B0000-0x000000000196D000-memory.dmp

Filesize
21.7MB

Download
memory/1492-167-0x00000000003B0000-0x000000000196D000-memory.dmp

Filesize
21.7MB

Download
memory/1492-127-0x00000000003B0000-0x000000000196D000-memory.dmp

Filesize
21.7MB

Download
memory/1492-112-0x00000000003B0000-0x000000000196D000-memory.dmp

Filesize
21.7MB

Download
memory/1492-122-0x00000000003B0000-0x000000000196D000-memory.dmp

Filesize
21.7MB

Download
memory/1880-110-0x00000000740C0000-0x000000007476A000-memory.dmp

Filesize
6.7MB

Download
memory/1880-134-0x0000000000D40000-0x00000000018BE000-memory.dmp

Filesize
11.5MB

Download
memory/1880-114-0x0000000000D40000-0x00000000018BE000-memory.dmp

Filesize
11.5MB

Download
memory/1880-124-0x0000000000D40000-0x00000000018BE000-memory.dmp

Filesize
11.5MB

Download
memory/1880-109-0x0000000000D40000-0x00000000018BE000-memory.dmp

Filesize
11.5MB

Download
memory/1880-129-0x0000000000D40000-0x00000000018BE000-memory.dmp

Filesize
11.5MB

Download
memory/1880-119-0x0000000000D40000-0x00000000018BE000-memory.dmp

Filesize
11.5MB

Download
memory/1880-154-0x0000000000D40000-0x00000000018BE000-memory.dmp

Filesize
11.5MB

Download
memory/1880-169-0x0000000000D40000-0x00000000018BE000-memory.dmp

Filesize
11.5MB

Download
memory/1880-139-0x0000000000D40000-0x00000000018BE000-memory.dmp

Filesize
11.5MB

Download
memory/1880-164-0x0000000000D40000-0x00000000018BE000-memory.dmp

Filesize
11.5MB

Download
memory/1880-144-0x0000000000D40000-0x00000000018BE000-memory.dmp

Filesize
11.5MB

Download
memory/1880-159-0x0000000000D40000-0x00000000018BE000-memory.dmp

Filesize
11.5MB

Download
memory/1880-149-0x0000000000D40000-0x00000000018BE000-memory.dmp

Filesize
11.5MB

Download
memory/2652-88-0x0000000073E60000-0x000000007450A000-memory.dmp

Filesize
6.7MB

Download
memory/2652-87-0x00000000003B0000-0x000000000196D000-memory.dmp

Filesize
21.7MB

Download
memory/2804-85-0x0000000073E60000-0x000000007450A000-memory.dmp

Filesize
6.7MB

Download
memory/2804-84-0x0000000000140000-0x0000000000CBE000-memory.dmp

Filesize
11.5MB

Download
memory/2860-73-0x0000000000290000-0x0000000003275000-memory.dmp

Filesize
47.9MB

Download
memory/2860-68-0x00000000032F0000-0x0000000003300000-memory.dmp

Filesize
64KB

Download
memory/2860-28-0x0000000000290000-0x0000000003275000-memory.dmp

Filesize
47.9MB

Download
memory/2860-29-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download