Overview

overview

10

Static

static

RFQ-00421-0505.exe

windows7_x64

10

RFQ-00421-0505.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RFQ-00421-0505.exe

  • Size

    759KB

  • Sample

    210505-3btmmb3rpj

  • MD5

    5810ce2501a4eb374d6645f732c7a09c

  • SHA1

    b10725b4231b66db00b7d070b1598d97b6fedd39

  • SHA256

    07a065c4b19b8f98199e9ad84c2b2073e84bf0abdc3c075b9976abdeb5e40e73

  • SHA512

    7c31c0e4ae9f5d983a83670700f54132cb9709056a46449a52a349ea2ce0e194b385f7682a9643eeb2b02b834006c7a970f6239f4592d33892f655dad1abad53

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

style.ptbagasps.co.id:42024

Targets

    • Target

      RFQ-00421-0505.exe

    • Size

      759KB

    • MD5

      5810ce2501a4eb374d6645f732c7a09c

    • SHA1

      b10725b4231b66db00b7d070b1598d97b6fedd39

    • SHA256

      07a065c4b19b8f98199e9ad84c2b2073e84bf0abdc3c075b9976abdeb5e40e73

    • SHA512

      7c31c0e4ae9f5d983a83670700f54132cb9709056a46449a52a349ea2ce0e194b385f7682a9643eeb2b02b834006c7a970f6239f4592d33892f655dad1abad53

    Score
    10/10
    remcospersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks