Overview

overview

10

Static

static

Urgent RFQ...df.exe

windows7_x64

8

Urgent RFQ...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Urgent RFQ_AP65425652_032421,pdf.exe

  • Size

    795KB

  • Sample

    210416-jyg22gnfts

  • MD5

    2c01f256b290b5366e18d6cf17ab20dd

  • SHA1

    cd50c60b4f6a9fc43c6aa7d0b8c03cc1ff465046

  • SHA256

    d171d6bfdf320dd4cb4f29596bdd63b41272d087b5e61edc8e0eb47c68fc5cad

  • SHA512

    e905f448f1864a96ca86bec75bbade8443b5fae0efa6ea19614ce06f2879b27cb438d22b360d0e032f609d2efb1978d8f3cd4a9be16a952a0473be8f9e615d6e

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

putcalligoanswer.hopto.org:9882

Targets

    • Target

      Urgent RFQ_AP65425652_032421,pdf.exe

    • Size

      795KB

    • MD5

      2c01f256b290b5366e18d6cf17ab20dd

    • SHA1

      cd50c60b4f6a9fc43c6aa7d0b8c03cc1ff465046

    • SHA256

      d171d6bfdf320dd4cb4f29596bdd63b41272d087b5e61edc8e0eb47c68fc5cad

    • SHA512

      e905f448f1864a96ca86bec75bbade8443b5fae0efa6ea19614ce06f2879b27cb438d22b360d0e032f609d2efb1978d8f3cd4a9be16a952a0473be8f9e615d6e

    Score
    10/10
    persistenceremcosrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks