Overview

overview

10

Static

static

4a7aaa4411...95.exe

windows7_x64

10

4a7aaa4411...95.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95

  • Size

    387KB

  • Sample

    220712-qcwjasebh9

  • MD5

    4b66d7bf224196da8a0a5eeb040e1a0d

  • SHA1

    0e149b61f868b3561f495eca8a9754705a1b132e

  • SHA256

    4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95

  • SHA512

    ed9c4027971a6abccf5d3e1286e858a3da33741328097d92bc650c7272b6e929c3b08fdb4a07d1bf3b8b6e15c56a12d7b6994e1102517e453ebf27ba2aa5c79a

Score
10/10
imminentspywaretrojan

Malware Config

Targets

    • Target

      4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95

    • Size

      387KB

    • MD5

      4b66d7bf224196da8a0a5eeb040e1a0d

    • SHA1

      0e149b61f868b3561f495eca8a9754705a1b132e

    • SHA256

      4a7aaa4411e687109a080a9a5f9f0909d8ef9d21418d2102cb80973df4d39d95

    • SHA512

      ed9c4027971a6abccf5d3e1286e858a3da33741328097d92bc650c7272b6e929c3b08fdb4a07d1bf3b8b6e15c56a12d7b6994e1102517e453ebf27ba2aa5c79a

    Score
    10/10
    imminentspywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks