Overview

overview

10

Static

static

Urgente RF...df.exe

windows7_x64

10

Urgente RF...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Urgente RFQ_AP65425652_032421,pdf.iso

  • Size

    850KB

  • Sample

    210414-6ay5j2s7pn

  • MD5

    2eb60b5e2f8c3e59136574a70cc115d8

  • SHA1

    f20e6a5794dfe589ae72eeebefdddf5d603609d4

  • SHA256

    fd8c95afd9ab5625a685eae15f74b44d8a728557b1bfb94e1cd209bcffcf50b3

  • SHA512

    f3a887802b89132cda972230f84fc4184f3c4140466d2b24009ba60f353cc97b4495f5bfec277123c64821f37efffc7e3f9cec24651e969e0b0effcf02adcf3b

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

zubby2468.hopto.org:8905

Targets

    • Target

      Urgente RFQ_AP65425652_032421,pdf.exe

    • Size

      788KB

    • MD5

      63ca0fa8f02c466cefcaff3f05070159

    • SHA1

      81f5fa8cbeec9c8a0ea7a72401868b239c210a26

    • SHA256

      4856356208e0bfb8b15d3ce4250f910392bce45bac58cdfe83c8c447f2f1b85e

    • SHA512

      4a7cf6951b82efb012ea562677f1014cc70baa07e4eb4b600269164388f18e1b21b86411670e37bfed7f895690104b0e5e6a71cd91d1cf60dbad19ea5d2a6e10

    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks