Overview

overview

10

Static

static

492f7ec585...43.exe

windows7_x64

8

492f7ec585...43.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    492f7ec585c9b70db7462bcb8956d51ba9a3952645c1c69eeb39d9fe7c458143

  • Size

    406KB

  • Sample

    220714-ax9cwseafl

  • MD5

    bc6cbbc2bcd1c2d288df884247a61022

  • SHA1

    30f01bee0b52d6e38b37c8be8a94264014184bc8

  • SHA256

    492f7ec585c9b70db7462bcb8956d51ba9a3952645c1c69eeb39d9fe7c458143

  • SHA512

    dacb252e8110931be4f739743eea4b1109b9e78021ab764360cdd9261acdef6044cbd612ccae7ac9f1e4fc6cdf0bc836783bf3953d40b8adf9b381e83722efb7

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      492f7ec585c9b70db7462bcb8956d51ba9a3952645c1c69eeb39d9fe7c458143

    • Size

      406KB

    • MD5

      bc6cbbc2bcd1c2d288df884247a61022

    • SHA1

      30f01bee0b52d6e38b37c8be8a94264014184bc8

    • SHA256

      492f7ec585c9b70db7462bcb8956d51ba9a3952645c1c69eeb39d9fe7c458143

    • SHA512

      dacb252e8110931be4f739743eea4b1109b9e78021ab764360cdd9261acdef6044cbd612ccae7ac9f1e4fc6cdf0bc836783bf3953d40b8adf9b381e83722efb7

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks