RMM
CrossTec Remote Control
CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only.
Tool overview
- Category
- RMM
- Research authors
- Not recorded
- Created
- 2024-08-02
- Last modified
- 2024-08-02
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
- Not recorded
Executables & installation paths
- Filename
- Not recorded
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
PCIVIDEO.EXE
supporttool.exe
Code signing
- signer name
- Microsoft Windows Component Publisher
- issuer
- CN=Microsoft Windows Verification Intermediate PCA
- certificate thumbprint
- 5C4D0AED88959C9D30C1B30F9AA916BE57544CF6
- tbs sha256
- DDFD99125B30665247E714C0B2A4D17908F2228DD04FBA2EC311249F9BFB678D
- tbs sha1
- 2169D040A744D6C45E0214C48517B372289D79AF
- valid from
- 2005-10-11T23:24:57+00:00
- valid to
- 2007-01-11T23:34:57+00:00
- signer name
- Microsoft Corporation
- issuer
- CN=Microsoft Code Signing PCA 2011
- certificate thumbprint
- 62009AAABDAE749FD47D19150958329BF6FF4B34
- tbs sha256
- E17764C39F2AFD7114F8528D2F9783D9A591F6679715EECE730A262CF5CFD3B3
- tbs sha1
- 3D07186A55AD7D7691B88AC4D130F2002F664B16
- valid from
- 2019-05-02T21:37:46+00:00
- valid to
- 2020-05-02T21:37:46+00:00
search names
pcivideo.exe
supporttool.exe
company names
signer names
Microsoft Corporation
Microsoft Windows Component Publisher
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- user_managed
- Ports
- Not recorded
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/crosstec_remote_control_network_sigma.yml
- Description
- Detects potential network activity of CrossTec Remote Control RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/crosstec_remote_control_processes_sigma.yml
- Description
- Detects potential processes activity of CrossTec Remote Control RMM tool