Trojan.DownLoader41.7697

Technical Information

Modifies file system

Creates the following files

%TEMP%\7zipsfx.000\english.lg
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\8eb35376744f392396307460d546222d_ec1c46868a78521d3a7ed5209ef9cb19
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\8eb35376744f392396307460d546222d_ec1c46868a78521d3a7ed5209ef9cb19
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\378b079587a9184b2e2ab859cb263f40_524ad1b9b08d3c6450727265ae77b7d2
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\378b079587a9184b2e2ab859cb263f40_524ad1b9b08d3c6450727265ae77b7d2
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\3c987c966d19b79b9d9f35b962fcc8fa
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\3c987c966d19b79b9d9f35b962fcc8fa
%APPDATA%\rms_settings\logs\rms_log_2021-08.html
%APPDATA%\rms-agent\68001\b1bc49ad75\rfusclient.exe
%TEMP%\7zipsfx.000\rutserv.exe
%TEMP%\7zipsfx.000\rfusclient.exe
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\bb06c0093717b8f556d7ecbb4720787e
%TEMP%\7zipsfx.000\vp8encoder.dll
%TEMP%\7zipsfx.000\rwln.dll
%TEMP%\7zipsfx.000\webmvorbisdecoder.dll
%TEMP%\7zipsfx.000\webmmux.dll
%TEMP%\7zipsfx.000\vp8decoder.dll
%TEMP%\7zipsfx.000\ripcserver.dll
%TEMP%\7zipsfx.000\settings.dat
%TEMP%\7zipsfx.000\eula.rtf
%TEMP%\7zipsfx.000\config.txt
%TEMP%\7zipsfx.000\install.cmd
%TEMP%\7zipsfx.000\russian.lg
%TEMP%\7zipsfx.000\webmvorbisencoder.dll
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\bb06c0093717b8f556d7ecbb4720787e

Deletes the following files

%TEMP%\7zipsfx.000\rfusclient.exe

Moves the following files

from %TEMP%\7zipsfx.000\config.txt to %APPDATA%\rms-agent\68001\b1bc49ad75\config.txt
from %TEMP%\7zipsfx.000\english.lg to %APPDATA%\rms-agent\68001\b1bc49ad75\english.lg
from %TEMP%\7zipsfx.000\eula.rtf to %APPDATA%\rms-agent\68001\b1bc49ad75\eula.rtf
from %TEMP%\7zipsfx.000\install.cmd to %APPDATA%\rms-agent\68001\b1bc49ad75\install.cmd
from %TEMP%\7zipsfx.000\ripcserver.dll to %APPDATA%\rms-agent\68001\b1bc49ad75\ripcserver.dll
from %TEMP%\7zipsfx.000\russian.lg to %APPDATA%\rms-agent\68001\b1bc49ad75\russian.lg
from %TEMP%\7zipsfx.000\rutserv.exe to %APPDATA%\rms-agent\68001\b1bc49ad75\rutserv.exe
from %TEMP%\7zipsfx.000\rwln.dll to %APPDATA%\rms-agent\68001\b1bc49ad75\rwln.dll
from %TEMP%\7zipsfx.000\settings.dat to %APPDATA%\rms-agent\68001\b1bc49ad75\settings.dat
from %TEMP%\7zipsfx.000\vp8decoder.dll to %APPDATA%\rms-agent\68001\b1bc49ad75\vp8decoder.dll
from %TEMP%\7zipsfx.000\vp8encoder.dll to %APPDATA%\rms-agent\68001\b1bc49ad75\vp8encoder.dll
from %TEMP%\7zipsfx.000\webmmux.dll to %APPDATA%\rms-agent\68001\b1bc49ad75\webmmux.dll
from %TEMP%\7zipsfx.000\webmvorbisdecoder.dll to %APPDATA%\rms-agent\68001\b1bc49ad75\webmvorbisdecoder.dll
from %TEMP%\7zipsfx.000\webmvorbisencoder.dll to %APPDATA%\rms-agent\68001\b1bc49ad75\webmvorbisencoder.dll

Network activity

Connects to

'rm##sys.ru':80

TCP

HTTP GET requests

http://rm##sys.ru/utils/inet_id_notify.php?te####

UDP

DNS ASK rm##sys.ru

Miscellaneous

Creates and executes the following

'%TEMP%\7zipsfx.000\rfusclient.exe' -deploy
'%APPDATA%\rms-agent\68001\b1bc49ad75\rfusclient.exe' -run_agent
'%APPDATA%\rms-agent\68001\b1bc49ad75\rutserv.exe'
'%APPDATA%\rms-agent\68001\b1bc49ad75\rutserv.exe' -second
'%APPDATA%\rms-agent\68001\b1bc49ad75\rfusclient.exe' /tray /user
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\install.cmd" "' (with hidden window)

Executes the following