Overview

overview

10

Static

static

ADNOC_ RFQ...02.exe

windows7_x64

10

ADNOC_ RFQ...02.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ADNOC_ RFQ Nº 100400806-02.exe

  • Size

    1.1MB

  • Sample

    210422-xy7cza62na

  • MD5

    1f5b694c435df053ef0704fd7eb0c94a

  • SHA1

    442d0d0f9ccdbc5ed44cbaad5bd89e40a3112934

  • SHA256

    7788ed54eaa344eea1db37d5efaed03d0c8b1d811c8ad6361a448eb5d88cdbaf

  • SHA512

    bf48216dae6c8f5fc750c7bb11e593ef38ba8476724dfc1383d1084b2b5906901fd5ece387dec6da91fa7d2274a37e840fb1732998621f1ead345bbddab6c176

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

abino.hopto.org:2404

Targets

    • Target

      ADNOC_ RFQ Nº 100400806-02.exe

    • Size

      1.1MB

    • MD5

      1f5b694c435df053ef0704fd7eb0c94a

    • SHA1

      442d0d0f9ccdbc5ed44cbaad5bd89e40a3112934

    • SHA256

      7788ed54eaa344eea1db37d5efaed03d0c8b1d811c8ad6361a448eb5d88cdbaf

    • SHA512

      bf48216dae6c8f5fc750c7bb11e593ef38ba8476724dfc1383d1084b2b5906901fd5ece387dec6da91fa7d2274a37e840fb1732998621f1ead345bbddab6c176

    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks