rms | 7eda5b485a18b19d4fce8df81459246438770056c33a00fd8f1a359ffd026789

Sharing

Copy URL Twitter E-mail

General

Target
Archive.zip
Size 187.5MB
Sample260608-pc8cescz5r
SHA256 7eda5b485a18b19d4fce8df81459246438770056c33a00fd8f1a359ffd026789
MD5 5a6325e3ef5d29069f23d163089b100f
SHA1 55b3d4f342f911d226ee0c864ee5530b0adb125b
SHA512 53fe7f9def6438ec4fe2bf632a535565811fdb7abc9cc6665d982e4aebb05f084bf24b48f8258b5e78e59f21a6a891b1ffdfd34eda30b53b7bf761ab94ba3105
SSDEEP 3145728:s7hOMJ8hvHMzuC4XhCbKkYeUnEXkiPXBn/1JmMvNMAPu3bKkYeUnEXkiPXBn/1JH:WT+HMy5J9z6k6XB/OiKq9z6k6XB/OiKS
TLSH
T11E9833665B6FD881ED8719723CE7F3A4900CF6D0916AAF06D211DBA0ED18B580E5B13F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ReaItekHD/taskhost.exe
- Size 20.1MB
- SHA256 7b282e0d58d0e728865652e1f59ec6fafd048a8b2e2247dda0d6b7a50af80e5a
- MD5 a2500f21ae10a72db2a1637c0536d71d
- SHA1 6a5c00ea198932c1ac8212b6ec5b8aa7c412b062
- SHA512 6df76f72db5c47eca1dc7872b3559a78d249a0ae2ba740d98ecd8433f2ffeb47163c945ed81f1d1de9488dc2ea82d06204053d5f04824c68307b9d4ac1628c70
- SSDEEP 393216:oZuqM0mfVvHMUozbgVucUFlo0cNOA28k59LHGFL17PW:axM/tvsNQVucl1Z2NHmFL1zW
- TLSH
  T1232733E0ABBBB28AE05AF77A3077FA3C1396844889633D52F017B551D8508D7B74163B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution xmrig miner themida trojan
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- XMRig Miner payload
  miner
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  ReaItekHD/taskhostw.exe
- Size 26.4MB
- SHA256 37067f685c2a44fc5b7b008a8400ee917bfa7f9f2dc524b89f0b3cdb61553cf3
- MD5 aefd1a61f2cbb0f859d86543ab16065c
- SHA1 3eed46f132dc844af0fea20e338e2f9b05b1c7f6
- SHA512 64c1505f027289cd696a65c60f0229a57ba62d3d13482149b9e10f38cc87af77a6219898ef07f1ba52fcbb146fb18db5ee57dcf7258ae164b8543c4b2e7e15d3
- SSDEEP 393216:2jzDFOBckRqlkJVQMXR2H7a/Vu8XwibpQucBI798X5wjEMGgljwaDh5XD465GH:2jFcceDC7KIqNbJcBIq7MZEEhlf5GH
- TLSH
  T11E5723AD2526447BC5D00D30BCD99BA258060DFE049CA64DE7ECFDBAB56830C45B27BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion persistence themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Drops file in Drivers directory
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  Windows Tasks Service/winserv.exe
- Size 10.2MB
- SHA256 99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98
- MD5 3f4f5a6cb95047fea6102bd7d2226aa9
- SHA1 fc09dd898b6e7ff546e4a7517a715928fbafc297
- SHA512 de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688
- SSDEEP 196608:iz+UZcWP4jBrfWgEgIV8Rzy7Vj4FZvEo:i6UZcWWeVj4FZ
- TLSH
  T172B67E32B688643ED06B5E328C3B9594693B7E723A1ACC1767F42D0C4F356816A3B747
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery rms persistence rat trojan
- Family: RMS
  Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
  trojan rat rms
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral3
- Target
  WindowsTask/AMD.exe
- Size 71.1MB
- SHA256 7411902ba3632eb8c449486f61ee1b556520aca7f3ae5229d81d6b263c733fcb
- MD5 ac62edd743bc189fb5e31ef5843ac6a4
- SHA1 1dc5950034991f72cae33f4bba1bc43e842ee08c
- SHA512 04c607b3ccdaf0509d876993b5a539a12f701654d8d551cd35075583529455c5ee395b52a11073d4705c2d4ac759a5cd8d26ef08e4540de351ad79d93560ce84
- SSDEEP 1572864:ScsepK5+vi1e6yQIZpLYz5F5SghrbD+uz9uY2hyM0FLq/qlmHt0rwBIGtrU9eIq2:DsOK5+K1erXkz5LXbyU9uZYM0lqPlvtS
- TLSH
  T1B1F72366B1A540E8D0BAC0BE8F5A8D03EBB174561330DBDB05E095A71FA7AF06E7D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  WindowsTask/AppHost.exe
- Size 303KB
- SHA256 b4e264dc7bf4ed7807d8e09e67f5cb6ea887ab016458859de7821106081d6eef
- MD5 7d85bfb28dd45f743c697d4c030c7c76
- SHA1 26367ad0db272d851af19f8776a2c91d12fa1c3b
- SHA512 fc73b53372c9bf15d7d75dd64cae7aa4c9ce8303c4cbcbc18b34c6dd09f64582443550ed1d3779e0f8a94785f64e5f40e091cc82360475fc123410c38a8b79d8
- SSDEEP 6144:KfSFkVKL0m3D6UBCxwSNy7KtohXy8lqBVZFDeP:K6FkcLR3GUxSsUoZRc78
- TLSH
  T106648D5973A80CF9EC77813DC9564646EA72B8150760DBAF03E0865A9F33690AD3FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  WindowsTask/AppModule.exe
- Size 71.1MB
- SHA256 7411902ba3632eb8c449486f61ee1b556520aca7f3ae5229d81d6b263c733fcb
- MD5 ac62edd743bc189fb5e31ef5843ac6a4
- SHA1 1dc5950034991f72cae33f4bba1bc43e842ee08c
- SHA512 04c607b3ccdaf0509d876993b5a539a12f701654d8d551cd35075583529455c5ee395b52a11073d4705c2d4ac759a5cd8d26ef08e4540de351ad79d93560ce84
- SSDEEP 1572864:ScsepK5+vi1e6yQIZpLYz5F5SghrbD+uz9uY2hyM0FLq/qlmHt0rwBIGtrU9eIq2:DsOK5+K1erXkz5LXbyU9uZYM0lqPlvtS
- TLSH
  T1B1F72366B1A540E8D0BAC0BE8F5A8D03EBB174561330DBDB05E095A71FA7AF06E7D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  WindowsTask/MicrosoftHost.exe
- Size 5.4MB
- SHA256 12a209356db82dc1fc47da0a9a146096f6a9e7cd99e2ec71d513f394b57fc5f8
- MD5 7c4884f067e34d59c685665a7a8eb8dd
- SHA1 d130a72a930695871c366946a11654c6198c9f1d
- SHA512 f5713884d7dcce1a2db9afe5e0c938e9e09ff02c27ffca0ac6861ab452f202709789a20be0a192a1396fae34749a341be5770f282944da48498f4f4c107d0239
- SSDEEP 98304:IXe45MEd6tWTUIJ3laRbIErC9r28qsm4ILXtyIrk8pSbTy9ME41AV6/YU:r4MEda87m4IL9yIJSbTy9Mx2KY
- TLSH
  T102469D26B2A500E9C9BAC13CC64B9A17F7B1781553B0ABDB17F052A91F237D15E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  WindowsTask/audiodg.exe
- Size 5.6MB
- SHA256 7d1a99b80e0728e4ae5c349ec1ff2870607cffe3b01b2a60d64745f88485ef9d
- MD5 b28db401409a4055aab8c0fad45e47d5
- SHA1 250832c56ecfd92e7b81d1d41380a2335533e320
- SHA512 8f40024650e77b80b178a70369417f96d4a326845efe5902eb269f64acafbd916affa67ab1468e6174b9d8f3b6ee6027dc3661b5d1b6dd1837d8e3189d52b53f
- SSDEEP 98304:9BDW/kygsPWWNDlv+8nY7FtY1VZv62NMhD/pICGxSrpR9C+UDu71w5KgNBrySoN+:9BRWNBXs07N6D/sKR9C+UDuAKGBrcmV
- TLSH
  T12C5633E18EF579D0E06970F3B020653CB3D65E99CE16482CF21FF15E60A29C651EAF1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral8
- Target
  WindowsTask/winlogon.bat
- Size 134B
- SHA256 39128f3f6e8910fc7766da7eb80e5bea6b1c32cbd47ac6d1c7b60ee11d088ba9
- MD5 4b09f42752d782958f48e3a4094fb235
- SHA1 699cda02f1d20d720d3a24ab23c0700aee8f052e
- SHA512 621532f1aee46a5bbe691a153092e721f36af827554b7211f34e56c0531a4c73569805d9d7ab86e571daed60966201bbdfcf8553a320f0c7da471096c0004542
- TLSH
  T154C02B1101364BC0647B4CEB8A0E4A80AD07653532CC8C44312C47EE860C380922C209
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: xmrig

Modifies visibility of hidden/system files in Explorer

XMRig Miner payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Executes dropped EXE

Modifies file permissions

Themida packer

Checks whether UAC is enabled

Command and Scripting Interpreter: PowerShell

AutoIT Executable

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Drops file in Drivers directory

Checks BIOS information in registry

Themida packer

Adds Run key to start application

Checks whether UAC is enabled

Looks up external IP address via web service

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

Family: RMS

Checks computer location settings

Adds Run key to start application

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9