Overview

overview

10

Static

static

264e72b132...d2.exe

windows7_x64

10

264e72b132...d2.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

  • Size

    1.0MB

  • Sample

    220616-kv1yvabffp

  • MD5

    c0b375a5c4bcfc0a08699ad368de0b67

  • SHA1

    644ec97218b4b0b41e560a1e8f57221de1b3fbf5

  • SHA256

    264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

  • SHA512

    bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

Score
10/10
imminentspywaretrojan

Malware Config

Targets

    • Target

      264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

    • Size

      1.0MB

    • MD5

      c0b375a5c4bcfc0a08699ad368de0b67

    • SHA1

      644ec97218b4b0b41e560a1e8f57221de1b3fbf5

    • SHA256

      264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

    • SHA512

      bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

    Score
    10/10
    imminentspywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks