Overview

overview

10

Static

static

3208175e7d...47.exe

windows7_x64

10

3208175e7d...47.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3208175e7d69432beeb4e69dad7aa9d343ced9942284cdf9a5f1c5df45093347

  • Size

    399KB

  • Sample

    220620-vcdeyahdh6

  • MD5

    9feaf964c8cf229116b3439a7520bbed

  • SHA1

    0a606159afef156db4df1f6a2b79d933379b5198

  • SHA256

    3208175e7d69432beeb4e69dad7aa9d343ced9942284cdf9a5f1c5df45093347

  • SHA512

    7111a74efa2ec69381baf5d28e81f91dd172dc1478b976a1c0b0075ad1bc2785d8869f87cd3e2d172dae045710cffba30139beb263f8278e0e5b95f46264ec02

Score
10/10
imminentspywaretrojan

Malware Config

Targets

    • Target

      3208175e7d69432beeb4e69dad7aa9d343ced9942284cdf9a5f1c5df45093347

    • Size

      399KB

    • MD5

      9feaf964c8cf229116b3439a7520bbed

    • SHA1

      0a606159afef156db4df1f6a2b79d933379b5198

    • SHA256

      3208175e7d69432beeb4e69dad7aa9d343ced9942284cdf9a5f1c5df45093347

    • SHA512

      7111a74efa2ec69381baf5d28e81f91dd172dc1478b976a1c0b0075ad1bc2785d8869f87cd3e2d172dae045710cffba30139beb263f8278e0e5b95f46264ec02

    Score
    10/10
    imminentspywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks