Overview

overview

10

Static

static

5

ebe315f586...d7.msi

windows10-2004-x64

10

ebe315f586...d7.msi

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/10/2026, 04:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ebe315f58648a2d4a30e607230fd07cebd6251a054d4b7fe3e1078e8991857d7.msi
  • Size 21.5MB
  • Sample261002-es6testfma
  • SHA256 ebe315f58648a2d4a30e607230fd07cebd6251a054d4b7fe3e1078e8991857d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordiscoveryruratpersistenceprivilege_escalationransomwaretrojan

Malware Config

Signatures

  • Family: RuRAT

    RuRAT is a remote admin tool sold as legitimate software but regularly abused in malicious phishing campaigns.

    trojanbackdoorrurat
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 15 IoCs
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 47 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 57 IoCs
  • Drops file in Windows directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 22 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 50 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 29 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ebe315f58648a2d4a30e607230fd07cebd6251a054d4b7fe3e1078e8991857d7.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3768
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4384
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 42769F3FCFFB7D5A9AA009A98DC5BA36 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:396
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4732
      • C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
        "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\ebe315f58648a2d4a30e607230fd07cebd6251a054d4b7fe3e1078e8991857d7.msi"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2204
      • C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
        "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1068
      • C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
        "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4716
      • C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
        "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3116
      • C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
        "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /CONFIG /SETSECURITY
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4108
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4348
    • C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
      "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1924
    • C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
      "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3644
      • C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
        "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe"
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1884
        • C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
          "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:796
      • C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
        "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5116
      • C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
        "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4832

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e595a0e.rbs
          • Path C:\Config.Msi\e595a0e.rbs
          • Size 28KB
          • SHA256 07012acf6f61523af75e95e7ef3b0ad38fec7f90a7905974a3e9d10e8ad4689e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          eventmsg.dll
          • Path C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll
          • Size 51KB
          • SHA256 ccd5b9e5947f956e880bd2285a6091dc9f1ee9b0eb8df627ec4e72b451a1c745
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libeay32.dll
          • Path C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll
          • Size 1.3MB
          • SHA256 7975ac81130ae8fe09caf6bef313c44fe064b67ed9205f0bd11ac165386e2f95
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rfusclient.exe
          • Path C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
          • Size 10.4MB
          • SHA256 02003563373af3215195ca0c23af03f845921fcfa31f58770927266b03c2ac40
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rutserv.exe
          • Path C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
          • Size 19.8MB
          • SHA256 f2a5023cd559597a1b70a7e02345fb9c80b740377fcf7341d5df2d462efafda5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ssleay32.dll
          • Path C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll
          • Size 337KB
          • SHA256 af029ac96a935594de92f771ef86c3e92fe22d08cb78ebf815cbfd4ef0cb94b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vp8decoder.dll
          • Path C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll
          • Size 380KB
          • SHA256 36993fc3312ce757c8adeca3e5969e1fcc11d5b51b12c458ba8d54d73b64d4e7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vp8encoder.dll
          • Path C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll
          • Size 1.6MB
          • SHA256 0961d83cb25e1a50d5c0ec2f9fb0d17f2504dae0b22a865f6e1ea8e987e1c6fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          webmmux.dll
          • Path C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll
          • Size 260KB
          • SHA256 bd520007864b44e0bda7a466384d12c3c3f328326cf3549ba1853a58ccdbc99d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          webmvorbisdecoder.dll
          • Path C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll
          • Size 365KB
          • SHA256 f3465ce8a23db5e8228eed5a60a6f7a096d1a9adf3012c39bc6d81d4e57e8e9e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          webmvorbisencoder.dll
          • Path C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll
          • Size 860KB
          • SHA256 83e1c1eb55bfd0f2d85d41c1e4dee65046b064ccb263ec7f412a5f329c75cfd1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF
          • Size 338B
          • SHA256 6206912027afbfcca70e4c871a7743cc174e149f172915e720faa504a514cb77
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          3EC49180A59F0C351C30F112AD97CFA5_248D75C56270E62EB694EC79FE3D3584
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC49180A59F0C351C30F112AD97CFA5_248D75C56270E62EB694EC79FE3D3584
          • Size 314B
          • SHA256 67482b278372bc9de42451bdf8ca8803353f5886c9a2eb70fea44b3f55829ef8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF
          • Size 404B
          • SHA256 fa8a728cf35f35b9f79a8839154a380727b17ef28e7c7a9b6821f6aeba049ce1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          3EC49180A59F0C351C30F112AD97CFA5_248D75C56270E62EB694EC79FE3D3584
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC49180A59F0C351C30F112AD97CFA5_248D75C56270E62EB694EC79FE3D3584
          • Size 404B
          • SHA256 fb7bf6e812845bc0c7f1f70595f1e8968a1175b9e77ae5d1c0781b3a239cac31
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI88F2.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI88F2.tmp
          • Size 165KB
          • SHA256 1f6f0d9f136bc170cfbc48a1015113947087ac27aed1e3e91673ffc91b9f390b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e595a0f.msi
          • Path C:\Windows\Installer\e595a0f.msi
          • Size 21.5MB
          • SHA256 ebe315f58648a2d4a30e607230fd07cebd6251a054d4b7fe3e1078e8991857d7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.1MB
          • SHA256 93dc8533075243d3d6df84c40767f48b39807f9598ed51e4a75515c8e0e05554
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {68eb90d2-c56a-4ae6-946d-27b6e04aedad}_OnDiskSnapshotProp
          • Path \??\Volume{9f840213-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{68eb90d2-c56a-4ae6-946d-27b6e04aedad}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 5f7e3fc525ff1f5ee14f8918b1667d7d3df7575d2a0ca38a7df22bb0a2b3418e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/796-158-0x0000000000400000-0x0000000000F17000-memory.dmp
          Download

          memory/1068-107-0x0000000000400000-0x0000000001896000-memory.dmp
          Download

          memory/1884-161-0x0000000000400000-0x0000000000F17000-memory.dmp
          Download

          memory/1924-123-0x0000000000400000-0x0000000001896000-memory.dmp
          Download

          memory/2204-94-0x0000000000400000-0x0000000000F17000-memory.dmp
          Download

          memory/3116-136-0x0000000000400000-0x0000000001896000-memory.dmp
          Download

          memory/3644-171-0x0000000000400000-0x0000000001896000-memory.dmp
          Download

          memory/3644-198-0x0000000000400000-0x0000000001896000-memory.dmp
          Download

          memory/3644-165-0x0000000000400000-0x0000000001896000-memory.dmp
          Download

          memory/3644-159-0x0000000000400000-0x0000000001896000-memory.dmp
          Download

          memory/3644-194-0x0000000000400000-0x0000000001896000-memory.dmp
          Download

          memory/3644-176-0x0000000000400000-0x0000000001896000-memory.dmp
          Download

          memory/3644-188-0x0000000000400000-0x0000000001896000-memory.dmp
          Download

          memory/3644-180-0x0000000000400000-0x0000000001896000-memory.dmp
          Download

          memory/4108-149-0x0000000000400000-0x0000000001896000-memory.dmp
          Download

          memory/4716-111-0x0000000000400000-0x0000000001896000-memory.dmp
          Download

          memory/4832-184-0x0000000000400000-0x0000000001896000-memory.dmp
          Download

          memory/5116-167-0x0000000000400000-0x0000000000F17000-memory.dmp
          Download

          memory/5116-186-0x0000000000400000-0x0000000000F17000-memory.dmp
          Download

          memory/5116-178-0x0000000000400000-0x0000000000F17000-memory.dmp
          Download

          memory/5116-192-0x0000000000400000-0x0000000000F17000-memory.dmp
          Download

          memory/5116-173-0x0000000000400000-0x0000000000F17000-memory.dmp
          Download

          memory/5116-196-0x0000000000400000-0x0000000000F17000-memory.dmp
          Download

          memory/5116-162-0x0000000000400000-0x0000000000F17000-memory.dmp
          Download

          memory/5116-200-0x0000000000400000-0x0000000000F17000-memory.dmp
          Download