rms | 817221fcb088aba938a3aa441fd4128f4e7a158845e37249286e3624416ab503

Analysis

max time kernel
147s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2025 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_42009d9ac7ef4a0211165c2c2ffedf39.exe
Size

3.5MB
MD5

42009d9ac7ef4a0211165c2c2ffedf39
SHA1

ad2fe7fdc29bca8e545bd9433b359707a04a1459
SHA256

817221fcb088aba938a3aa441fd4128f4e7a158845e37249286e3624416ab503
SHA512

772125c698ba3cba416f82262fa924533d5ed088f0819ed807c20617d6642b19ddfe8a19181218da895aca65a126794c25e17ef4c14132860b51c58a1f9f7570
SSDEEP

98304:6Ew1tFnCCfh01zPcm2mXklKyUdzFvJBG90XWAykhY5W0:SoSIzPOOUOFvi9WpG5

Score

10^/10

rms defense_evasion discovery execution persistence privilege_escalation rat trojan upx

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Rms family
rms

Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
2560	net.exe
1596	net1.exe

Modifies Windows Firewall 2 TTPs 8 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3856	netsh.exe
4432	netsh.exe
372	netsh.exe
3116	netsh.exe
3848	netsh.exe
2424	netsh.exe
3076	netsh.exe
3108	netsh.exe

Sets file to hidden 1 TTPs 3 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3540	attrib.exe
4752	attrib.exe
2740	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	JaffaCakes118_42009d9ac7ef4a0211165c2c2ffedf39.exe

Executes dropped EXE 7 IoCs

pid	Process
2712	rutserv.exe
3308	rutserv.exe
1692	rutserv.exe
2872	rutserv.exe
1720	rfusclient.exe
1892	rfusclient.exe
3512	rfusclient.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\catroot9\rfusclient.exe	cmd.exe
File created	C:\Windows\SysWOW64\catroot9\RIPCServer.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot9\rutserv.exe	cmd.exe
File created	C:\Windows\SysWOW64\catroot9\RWLN.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot9\dsfVorbisDecoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot9\rfusclient.exe	cmd.exe
File created	C:\Windows\SysWOW64\catroot9\Logs\rms_log_2025-01.html	rutserv.exe
File opened for modification	C:\Windows\SysWOW64\catroot9	attrib.exe
File created	C:\Windows\SysWOW64\catroot9\msvcp90.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot9\msvcp90.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot9\settings.bat	cmd.exe
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File created	C:\Windows\SysWOW64\catroot9\vp8encoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot9\dsfVorbisDecoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot9\msvcr90.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot9\RIPCServer.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot9\gdiplus.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot9\Microsoft.VC90.CRT.manifest	cmd.exe
File created	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File created	C:\Windows\SysWOW64\catroot9\Microsoft.VC90.CRT.manifest	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot9\msvcr90.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot9\RWLN.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot9\vp8decoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot9\vp8encoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot9\vp8decoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot9\settings.bat	cmd.exe
File created	C:\Windows\SysWOW64\catroot9\gdiplus.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot9\rutserv.exe	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/920-0-0x0000000000400000-0x000000000128D000-memory.dmp	upx
behavioral2/memory/920-90-0x0000000000400000-0x000000000128D000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1852	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_42009d9ac7ef4a0211165c2c2ffedf39.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rutserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
2880	taskkill.exe
4696	taskkill.exe
1656	taskkill.exe
4568	taskkill.exe
2784	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
3120	reg.exe
1312	reg.exe

Runs net.exe

Runs regedit.exe 1 IoCs

pid	Process
1756	regedit.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2872	rutserv.exe
2872	rutserv.exe
2872	rutserv.exe
2872	rutserv.exe
1720	rfusclient.exe
1720	rfusclient.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
3512	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	taskkill.exe
Token: SeDebugPrivilege	1656	taskkill.exe
Token: SeDebugPrivilege	4568	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	2880	taskkill.exe
Token: SeDebugPrivilege	2712	rutserv.exe
Token: SeDebugPrivilege	1692	rutserv.exe
Token: SeTakeOwnershipPrivilege	2872	rutserv.exe
Token: SeTcbPrivilege	2872	rutserv.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1892	rfusclient.exe
1892	rfusclient.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1892	rfusclient.exe
1892	rfusclient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 3716	920	JaffaCakes118_42009d9ac7ef4a0211165c2c2ffedf39.exe	82
PID 920 wrote to memory of 3716	920	JaffaCakes118_42009d9ac7ef4a0211165c2c2ffedf39.exe	82
PID 920 wrote to memory of 3716	920	JaffaCakes118_42009d9ac7ef4a0211165c2c2ffedf39.exe	82
PID 3716 wrote to memory of 4696	3716	cmd.exe	85
PID 3716 wrote to memory of 4696	3716	cmd.exe	85
PID 3716 wrote to memory of 4696	3716	cmd.exe	85
PID 3716 wrote to memory of 1656	3716	cmd.exe	87
PID 3716 wrote to memory of 1656	3716	cmd.exe	87
PID 3716 wrote to memory of 1656	3716	cmd.exe	87
PID 3716 wrote to memory of 3384	3716	cmd.exe	88
PID 3716 wrote to memory of 3384	3716	cmd.exe	88
PID 3716 wrote to memory of 3384	3716	cmd.exe	88
PID 3716 wrote to memory of 3540	3716	cmd.exe	89
PID 3716 wrote to memory of 3540	3716	cmd.exe	89
PID 3716 wrote to memory of 3540	3716	cmd.exe	89
PID 3716 wrote to memory of 4752	3716	cmd.exe	90
PID 3716 wrote to memory of 4752	3716	cmd.exe	90
PID 3716 wrote to memory of 4752	3716	cmd.exe	90
PID 3716 wrote to memory of 2740	3716	cmd.exe	91
PID 3716 wrote to memory of 2740	3716	cmd.exe	91
PID 3716 wrote to memory of 2740	3716	cmd.exe	91
PID 3716 wrote to memory of 4488	3716	cmd.exe	92
PID 3716 wrote to memory of 4488	3716	cmd.exe	92
PID 3716 wrote to memory of 4488	3716	cmd.exe	92
PID 4488 wrote to memory of 2828	4488	net.exe	93
PID 4488 wrote to memory of 2828	4488	net.exe	93
PID 4488 wrote to memory of 2828	4488	net.exe	93
PID 3716 wrote to memory of 4568	3716	cmd.exe	94
PID 3716 wrote to memory of 4568	3716	cmd.exe	94
PID 3716 wrote to memory of 4568	3716	cmd.exe	94
PID 3716 wrote to memory of 2784	3716	cmd.exe	95
PID 3716 wrote to memory of 2784	3716	cmd.exe	95
PID 3716 wrote to memory of 2784	3716	cmd.exe	95
PID 3716 wrote to memory of 2880	3716	cmd.exe	96
PID 3716 wrote to memory of 2880	3716	cmd.exe	96
PID 3716 wrote to memory of 2880	3716	cmd.exe	96
PID 3716 wrote to memory of 4552	3716	cmd.exe	97
PID 3716 wrote to memory of 4552	3716	cmd.exe	97
PID 3716 wrote to memory of 4552	3716	cmd.exe	97
PID 3716 wrote to memory of 2836	3716	cmd.exe	98
PID 3716 wrote to memory of 2836	3716	cmd.exe	98
PID 3716 wrote to memory of 2836	3716	cmd.exe	98
PID 3716 wrote to memory of 2776	3716	cmd.exe	99
PID 3716 wrote to memory of 2776	3716	cmd.exe	99
PID 3716 wrote to memory of 2776	3716	cmd.exe	99
PID 3716 wrote to memory of 1388	3716	cmd.exe	100
PID 3716 wrote to memory of 1388	3716	cmd.exe	100
PID 3716 wrote to memory of 1388	3716	cmd.exe	100
PID 3716 wrote to memory of 4920	3716	cmd.exe	101
PID 3716 wrote to memory of 4920	3716	cmd.exe	101
PID 3716 wrote to memory of 4920	3716	cmd.exe	101
PID 3716 wrote to memory of 2760	3716	cmd.exe	102
PID 3716 wrote to memory of 2760	3716	cmd.exe	102
PID 3716 wrote to memory of 2760	3716	cmd.exe	102
PID 3716 wrote to memory of 1256	3716	cmd.exe	103
PID 3716 wrote to memory of 1256	3716	cmd.exe	103
PID 3716 wrote to memory of 1256	3716	cmd.exe	103
PID 1256 wrote to memory of 3060	1256	net.exe	104
PID 1256 wrote to memory of 3060	1256	net.exe	104
PID 1256 wrote to memory of 3060	1256	net.exe	104
PID 3716 wrote to memory of 1852	3716	cmd.exe	105
PID 3716 wrote to memory of 1852	3716	cmd.exe	105
PID 3716 wrote to memory of 1852	3716	cmd.exe	105
PID 3716 wrote to memory of 2884	3716	cmd.exe	106

Views/modifies file attributes 1 TTPs 10 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2836	attrib.exe
4752	attrib.exe
4920	attrib.exe
1388	attrib.exe
2760	attrib.exe
4552	attrib.exe
4608	attrib.exe
3540	attrib.exe
2740	attrib.exe
2776	attrib.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42009d9ac7ef4a0211165c2c2ffedf39.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42009d9ac7ef4a0211165c2c2ffedf39.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7E9F.tmp\microsoft.bat" "
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im RManServer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rutserv.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3384
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\Windows\System32\catroot9"
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3540
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\microsoft.bat"
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4752
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r "C:\Windows\System32\miki913\de.exe"
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2740
- - C:\Windows\SysWOW64\net.exe
    net stop rserver3
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop rserver3
      4⤵
      System Location Discovery: System Language Discovery
      PID:2828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rserver3.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im r_server.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cam_server.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r "C:\Windows\system32\cam_server.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4552
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r "C:\Windows\SysWOW64\cam_server.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2836
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Windows\system32\rserver30"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2776
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Windows\SysWOW64\rserver30"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1388
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r "C:\Windows\system32\r_server.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4920
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r "C:\Windows\SysWOW64\r_server.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2760
- - C:\Windows\SysWOW64\net.exe
    net stop Telnet
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Telnet
      4⤵
      System Location Discovery: System Language Discovery
      PID:3060
- - C:\Windows\SysWOW64\sc.exe
    sc config tlntsvr start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1852
- - C:\Windows\SysWOW64\net.exe
    net stop "Service Host Controller"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2884
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Service Host Controller"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3876
- - C:\Windows\SysWOW64\net.exe
    net user HelpAssistant /delete
    3⤵
    - Indicator Removal: Network Share Connection Removal
    - System Location Discovery: System Language Discovery
    PID:2560
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user HelpAssistant /delete
      4⤵
      Indicator Removal: Network Share Connection Removal
      System Location Discovery: System Language Discovery
      PID:1596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn security /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4908
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="RealIP"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:372
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="Microsoft Outlook Express"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3116
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="Service Host Controller"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3848
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ß½πªí Windows"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2424
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ºáñáτ Windows"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3076
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete portopening tcp 57009
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3108
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="cam_server"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3856
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete portopening tcp 57011 all
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4432
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Ä»Ñαáµ¿«¡¡á∩ ß¿ßΓÑ¼á Microsoft Windows" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3120
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Service Host Controller" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1312
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v HelpAssistant /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3112
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "cam_server.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4956
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\System\CurrentControlSet\Services\RServer3" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2496
- - C:\Windows\SysWOW64\catroot9\rutserv.exe
    "rutserv.exe" /silentinstall
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- - C:\Windows\SysWOW64\catroot9\rutserv.exe
    "rutserv.exe" /firewall
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3308
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s settings.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs regedit.exe
    PID:1756
- - C:\Windows\SysWOW64\catroot9\rutserv.exe
    "rutserv.exe" /start
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\microsoft.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4608

C:\Windows\SysWOW64\catroot9\rutserv.exe
C:\Windows\SysWOW64\catroot9\rutserv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872
- C:\Windows\SysWOW64\catroot9\rfusclient.exe
  C:\Windows\SysWOW64\catroot9\rfusclient.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1720
- - C:\Windows\SysWOW64\catroot9\rfusclient.exe
    C:\Windows\SysWOW64\catroot9\rfusclient.exe /tray
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    PID:3512
- C:\Windows\SysWOW64\catroot9\rfusclient.exe
  C:\Windows\SysWOW64\catroot9\rfusclient.exe /tray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7E9F.tmp\Microsoft.VC90.CRT.manifest

Filesize
1KB

MD5
53213fc8c2cb0d6f77ca6cbd40fff22c

SHA1
d8ba81ed6586825835b76e9d566077466ee41a85

SHA256
03d0776812368478ce60e8160ec3c6938782db1832f5cb53b7842e5840f9dbc5

SHA512
e3ced32a2eabfd0028ec16e62687573d86c0112b2b1d965f1f9d0bb5557cef5fdf5233e87fe73be621a52affe4ce53bedf958558aa899646fa390f4541cf11eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7E9F.tmp\RIPCServer.dll

Filesize
144KB

MD5
30e269f850baf6ca25187815912e21c5

SHA1
eb160de97d12b4e96f350dd0d0126d41d658afb3

SHA256
379191bfd34d41e96760c7a539e2056a22be3d44bf0e8712b53e443f55aead90

SHA512
9b86a4eefdcae46e605f85e752ef61e39fd0212a19b7fd4c35eb3ab99851a0b906d048d12d1e1e985a340a67a64d405b8cf803555865137278f0c19d686df5e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7E9F.tmp\RWLN.dll

Filesize
357KB

MD5
bb1f3e716d12734d1d2d9219a3979a62

SHA1
0ef66eed2f2ae45ec2d478902833b830334109cb

SHA256
d7e9c9043ed7df2af800d9b2a33e3efddf68b70f043e9717afc4b7dd4e13e077

SHA512
bbc90747dd45a01b05f5c0b6fa58ffe18af894b05363267ac1cc9fe3262f5e65c8ae4e08dfd82d89b9112e86e42d24a12784b79f5ea30b6443015c19b6792c9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7E9F.tmp\dsfVorbisDecoder.dll

Filesize
234KB

MD5
8e3f59b8c9dfc933fca30edefeb76186

SHA1
37a78089d5936d1bc3b60915971604c611a94dbd

SHA256
528c0656751b336c10cb4c49b703eae9c3863f7f416d0e09b198b082cc54aeb8

SHA512
3224c20c30556774fd4bed78909f451b9a5a46aa59271b5e88b1e0e60145d217802a8f1fda3d3fabcd8546ca7783e0c70f0c419a28efe6c5160a102553a3c91d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7E9F.tmp\gdiplus.dll

Filesize
1.6MB

MD5
871c903a90c45ca08a9d42803916c3f7

SHA1
d962a12bc15bfb4c505bb63f603ca211588958db

SHA256
f1da32183b3da19f75fa4ef0974a64895266b16d119bbb1da9fe63867dba0645

SHA512
985b0b8b5e3d96acfd0514676d9f0c5d2d8f11e31f01acfa0f7da9af3568e12343ca77f541f55edda6a0e5c14fe733bda5dc1c10bb170d40d15b7a60ad000145

Download Submit
C:\Users\Admin\AppData\Local\Temp\7E9F.tmp\microsoft.bat

Filesize
4KB

MD5
b158481e20280844437ee65c96c823ae

SHA1
98a975e14e3e8088dc3a2531620b56f224220abd

SHA256
92a36d2792837f9c48b7dabef46608cbf64f63753c9d403d63f65dea78e20d05

SHA512
697aff838853be80f4f2bd5e5966e1f6f3b357c2c42b611da1b320df5f0ff36758e8ce23b86e7992303e05d43a80194cedb05afebf7ba61cf874df4b7894986a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7E9F.tmp\msvcp90.dll

Filesize
556KB

MD5
b2eee3dee31f50e082e9c720a6d7757d

SHA1
3322840fef43c92fb55dc31e682d19970daf159d

SHA256
4608beedd8cf9c3fc5ab03716b4ab6f01c7b7d65a7c072af04f514ffb0e02d01

SHA512
8b1854e80045001e7ab3a978fb4aa1de19a3c9fc206013d7bc43aec919f45e46bb7555f667d9f7d7833ab8baa55c9098af8872006ff277fc364a5e6f99ee25d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7E9F.tmp\msvcr90.dll

Filesize
637KB

MD5
7538050656fe5d63cb4b80349dd1cfe3

SHA1
f825c40fee87cc9952a61c8c34e9f6eee8da742d

SHA256
e16bc9b66642151de612ee045c2810ca6146975015bd9679a354567f56da2099

SHA512
843e22630254d222dfd12166c701f6cd1dca4a8dc216c7a8c9c0ab1afc90189cfa8b6499bbc46408008a1d985394eb8a660b1fa1991059a65c09e8d6481a3af8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7E9F.tmp\rfusclient.exe

Filesize
3.8MB

MD5
ebdfd6c8e430a012004a1366816bd18e

SHA1
48234645e99c9a8c3a714a0e1892ec2cb1a9503b

SHA256
211ae4639da26766e25d1b09466a3c0ae786930d24551ad5e3a9c29cb44e1cdb

SHA512
b58e7e35281935a581c3b51ba070c17b6deadd5514bc9b39dbdb35130ebc60d7bdeb8607fe868d5099c83a97be8f28ac4d4fea1cc3df643eda9cf7874545e2e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7E9F.tmp\rutserv.exe

Filesize
4.5MB

MD5
7751c37d01685b0d7b99a48b72b6e4a1

SHA1
d4e07b40dcdb3d2d2430466bb010b3aaa92f3e0c

SHA256
1470278fbc092ceb5f820fa964546f24fa87d58f13ba6838e4e31bfcb65a16ee

SHA512
dca0e7b5106b7376282dc65cae71673e64f0e7c227fb103caae9c30e67c70060371a7984a42c4589696142a1cd95d7ae733fd71a730af45a5bdfa49deeba6286

Download Submit
C:\Users\Admin\AppData\Local\Temp\7E9F.tmp\settings.bat

Filesize
5KB

MD5
e889ea342e2fb9cc3299f8e210bc0f93

SHA1
7420d4e0e0d71218e980da5cc1a46b6b263734ad

SHA256
4c601d3a79faff5015de6f6912560a1384028688c0fa630d7609182e2f0579f5

SHA512
d73cf0250d0f87a68e69dfd6205173b6a01e244cceceeb2f2fd438a7ef7cdcb97f56199f2df1a26788ffc0ab41cd538dd079e362329a89f7723c80523c8a5eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\7E9F.tmp\vp8decoder.dll

Filesize
403KB

MD5
6f6bfe02e84a595a56b456f72debd4ee

SHA1
90bad3ae1746c7a45df2dbf44cd536eb1bf3c8e2

SHA256
5e59b566eda7bb36f3f5d6dd39858bc9d6cf2c8d81deca4ea3c409804247da51

SHA512
ed2a7402699a6d00d1eac52b0f2dea4475173be3320dfbad5ca58877f06638769533229bc12bce6650726d3166c0e5ebac2dad7171b77b29186d4d5e65818c50

Download Submit
C:\Users\Admin\AppData\Local\Temp\7E9F.tmp\vp8encoder.dll

Filesize
685KB

MD5
c638bca1a67911af7f9ed67e7b501154

SHA1
0fd74d2f1bd78f678b897a776d8bce36742c39b7

SHA256
519078219f7f6db542f747702422f902a21bfc3aef8c6e6c3580e1c5e88162b8

SHA512
ca8133399f61a1f339a14e3fad3bfafc6fe3657801fd66df761c88c18b2dc23ceb02ba6faa536690986972933bec2808254ef143c2c22f881285facb4364659f

Download Submit
memory/920-0-0x0000000000400000-0x000000000128D000-memory.dmp

Filesize
14.6MB

Download
memory/920-90-0x0000000000400000-0x000000000128D000-memory.dmp

Filesize
14.6MB

Download
memory/1692-89-0x0000000000400000-0x000000000090D000-memory.dmp

Filesize
5.1MB

Download
memory/1720-96-0x0000000000400000-0x0000000000861000-memory.dmp

Filesize
4.4MB

Download
memory/1892-100-0x0000000000400000-0x0000000000861000-memory.dmp

Filesize
4.4MB

Download
memory/1892-135-0x0000000000400000-0x0000000000861000-memory.dmp

Filesize
4.4MB

Download
memory/1892-104-0x0000000000400000-0x0000000000861000-memory.dmp

Filesize
4.4MB

Download
memory/1892-97-0x0000000000400000-0x0000000000861000-memory.dmp

Filesize
4.4MB

Download
memory/2712-72-0x0000000000400000-0x000000000090D000-memory.dmp

Filesize
5.1MB

Download
memory/2872-102-0x0000000000400000-0x000000000090D000-memory.dmp

Filesize
5.1MB

Download
memory/2872-98-0x0000000000400000-0x000000000090D000-memory.dmp

Filesize
5.1MB

Download
memory/2872-95-0x0000000000400000-0x000000000090D000-memory.dmp

Filesize
5.1MB

Download
memory/2872-109-0x0000000000400000-0x000000000090D000-memory.dmp

Filesize
5.1MB

Download
memory/2872-116-0x0000000000400000-0x000000000090D000-memory.dmp

Filesize
5.1MB

Download
memory/2872-123-0x0000000000400000-0x000000000090D000-memory.dmp

Filesize
5.1MB

Download
memory/2872-130-0x0000000000400000-0x000000000090D000-memory.dmp

Filesize
5.1MB

Download
memory/2872-137-0x0000000000400000-0x000000000090D000-memory.dmp

Filesize
5.1MB

Download
memory/3308-74-0x0000000000400000-0x000000000090D000-memory.dmp

Filesize
5.1MB

Download
memory/3512-94-0x0000000000400000-0x0000000000861000-memory.dmp

Filesize
4.4MB

Download