Overview

overview

10

Static

static

4c95cd5e2a...1c.exe

windows7_x64

10

4c95cd5e2a...1c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4c95cd5e2a9dbaa6ae39fdf1cd92253efb5c1a4150a855b0adbd902c793e671c

  • Size

    1.8MB

  • Sample

    220625-d96z3scghl

  • MD5

    cd55232383785ab644fe00e97b33de8c

  • SHA1

    57936dbc491a89583662e6c380396553a93784e3

  • SHA256

    4c95cd5e2a9dbaa6ae39fdf1cd92253efb5c1a4150a855b0adbd902c793e671c

  • SHA512

    12889a3eb616e4916749496e45ac9cbaa82861b4c4421fe583550dc6d5eb035271805bc90962850c4c359e607eda273810a4b0042b904389acadbcda97ddfedc

Score
10/10
imminentspywaretrojan

Malware Config

Targets

    • Target

      4c95cd5e2a9dbaa6ae39fdf1cd92253efb5c1a4150a855b0adbd902c793e671c

    • Size

      1.8MB

    • MD5

      cd55232383785ab644fe00e97b33de8c

    • SHA1

      57936dbc491a89583662e6c380396553a93784e3

    • SHA256

      4c95cd5e2a9dbaa6ae39fdf1cd92253efb5c1a4150a855b0adbd902c793e671c

    • SHA512

      12889a3eb616e4916749496e45ac9cbaa82861b4c4421fe583550dc6d5eb035271805bc90962850c4c359e607eda273810a4b0042b904389acadbcda97ddfedc

    Score
    10/10
    imminentspywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks