Overview

overview

10

Static

static

5

391239c707...a7.exe

windows7_x64

10

391239c707...a7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    391239c70724940871a1257de67bdd596f62457a0059395198dda22f6da542a7

  • Size

    1.5MB

  • Sample

    220625-wjgxdaecgq

  • MD5

    b56c15d84914a2f6531fa7644f0843a4

  • SHA1

    a293b6868a0b82621e94be1266d09c49f1ff7e0b

  • SHA256

    391239c70724940871a1257de67bdd596f62457a0059395198dda22f6da542a7

  • SHA512

    0a97f8db4c61312def019c51605f330c027df1a100c09e16c668e5a3bc4bca82dfbf080e6509a284bebcdb1a6cfc20c7bd7315eb44a66af90bc7028c6f9137b7

Score
10/10
imminentspywaretrojan

Malware Config

Targets

    • Target

      391239c70724940871a1257de67bdd596f62457a0059395198dda22f6da542a7

    • Size

      1.5MB

    • MD5

      b56c15d84914a2f6531fa7644f0843a4

    • SHA1

      a293b6868a0b82621e94be1266d09c49f1ff7e0b

    • SHA256

      391239c70724940871a1257de67bdd596f62457a0059395198dda22f6da542a7

    • SHA512

      0a97f8db4c61312def019c51605f330c027df1a100c09e16c668e5a3bc4bca82dfbf080e6509a284bebcdb1a6cfc20c7bd7315eb44a66af90bc7028c6f9137b7

    Score
    10/10
    imminentspywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops desktop.ini file(s)

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks