RMM
RAdmin
RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.
Tool overview
- Category
- RMM
- Research authors
- Nasreddine Bencherchali
- Created
- 2024-08-05
- Last modified
- 2024-08-05
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
Windows
Executables & installation paths
- Filename
- RServer3.exe
- OriginalFileName
- RServer3.exe
- InternalName
- RServer3
- Description
- Radmin Server
- Product
- Radmin Server
- Comments
- Radmin - Remote Control Server
- Filename
- Radmin.exe
- OriginalFileName
- Radmin.exe
- InternalName
- Radmin
- Description
- Radmin Viewer
- Product
- Radmin Viewer
- Comments
- Radmin Viewer
Installation paths
C:\Program Files (x86)\Radmin Viewer 3\Radmin.exe
C:\Windows\SysWOW64\rserver30\rserver3.exe
C:\Windows\SysWOW64\rserver30\FamItrfc
C:\Windows\SysWOW64\rserver30\FamItrf2
Code signing
- signer name
- Famatech Corp.
- certificate thumbprint
- 9DC1CD24C50424A2BF993D8350F7A0F62DE34823
- src file sha256
- 839153d334bd3fb89488f1499cece43e7d1077f35fe0b0f79c2bd413bc3a9aaa
- src file path
- downloaded_files/radmin/839153d334bd3fb89488f1499cece43e7d1077f35fe0b0f79c2bd413bc3a9aaa
- src file company
- Famatech Corp.
FORENSIC EVIDENCE
Disk artifacts
- File
- C:\Windows\SysWOW64\rserver30\Radm_log.htm
- Description
- RAdmin log file (32-bit)
- OS
- Windows
- File
- C:\Windows\System32\rserver30\Radm_log.htm
- Description
- RAdmin log file (64-bit)
- OS
- Windows
- File
- C:\Windows\System32\rserver30\CHATLOGS\*\*.htm
- Description
- RAdmin chat logs
- OS
- Windows
- File
- C:\Users\*\Documents\ChatLogs\*\*.htm
- Description
- RAdmin user chat logs
- OS
- Windows
FORENSIC EVIDENCE
Registry artifacts
- Path
- HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin Security
- Description
- N/A
FORENSIC EVIDENCE
Network artifacts
- Description
- N/A
- Domains
- radmin.com
- Ports
- 443
Detections
- Sigma
- https://github.com/SigmaHQ/sigma/blob/782f0f524e6f797ea114fe0d87b22cb4abaa6b7c/rules/windows/process_creation/proc_creation_win_pua_radmin.yml
- Description
- PUA - Radmin Viewer Utility Execution
- Sigma
- https://github.com/SigmaHQ/sigma/blob/782f0f524e6f797ea114fe0d87b22cb4abaa6b7c/rules/windows/process_creation/proc_creation_win_registry_enumeration_for_credentials_cli.yml
- Description
- Enumeration for 3rd Party Creds From CLI
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/radmin_registry_sigma.yml
- Description
- Detects potential registry activity of RAdmin RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/radmin_network_sigma.yml
- Description
- Detects potential network activity of RAdmin RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/radmin_files_sigma.yml
- Description
- Detects potential files activity of RAdmin RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/radmin_processes_sigma.yml
- Description
- Detects potential processes activity of RAdmin RMM tool
References
Acknowledgements
- Person
- Nasreddine Bencherchali
- Handle
- @nas_bench