Overview

overview

10

Static

static

06eba92d52...95.exe

windows7_x64

10

06eba92d52...95.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06eba92d52705ce2af6862a2a2f3b0510807b5f14ed965fa9ba9c618a70a3995

  • Size

    1.1MB

  • Sample

    220531-emj3gahecr

  • MD5

    1ed830b0902a89718453d8a9479d0df5

  • SHA1

    6ebe1b790078f3b1ae78dbf1c48f72231f515801

  • SHA256

    06eba92d52705ce2af6862a2a2f3b0510807b5f14ed965fa9ba9c618a70a3995

  • SHA512

    2e127e9348ebcf7fb0ca1cb5115d205422556347fbbaabb9038bad79ca28aa6b4cb2b93694104748ea1a566dfac772e78507b66954e181779db65f37bc9647cd

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      06eba92d52705ce2af6862a2a2f3b0510807b5f14ed965fa9ba9c618a70a3995

    • Size

      1.1MB

    • MD5

      1ed830b0902a89718453d8a9479d0df5

    • SHA1

      6ebe1b790078f3b1ae78dbf1c48f72231f515801

    • SHA256

      06eba92d52705ce2af6862a2a2f3b0510807b5f14ed965fa9ba9c618a70a3995

    • SHA512

      2e127e9348ebcf7fb0ca1cb5115d205422556347fbbaabb9038bad79ca28aa6b4cb2b93694104748ea1a566dfac772e78507b66954e181779db65f37bc9647cd

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks