Overview

overview

10

Static

static

596078614b...31.exe

windows7-x64

10

596078614b...31.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    596078614be4defaea31d0c0e5b1582a6217a67c63b2ef429d4f080c93e27131

  • Size

    667KB

  • Sample

    220724-eqzmbsehc7

  • MD5

    2b7b5d13885e9a78a307fb6682fed0a2

  • SHA1

    2952700955f26433727807d5413faa08bf4d9d23

  • SHA256

    596078614be4defaea31d0c0e5b1582a6217a67c63b2ef429d4f080c93e27131

  • SHA512

    7f3785e6767b842c2ac2dcfbd2e80d84bcdac8c45278e0349572a9a7e627b9e87b30e434f68e57443785356677cfa03dcc45ef56caae4f2565a2de69c46393e2

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      596078614be4defaea31d0c0e5b1582a6217a67c63b2ef429d4f080c93e27131

    • Size

      667KB

    • MD5

      2b7b5d13885e9a78a307fb6682fed0a2

    • SHA1

      2952700955f26433727807d5413faa08bf4d9d23

    • SHA256

      596078614be4defaea31d0c0e5b1582a6217a67c63b2ef429d4f080c93e27131

    • SHA512

      7f3785e6767b842c2ac2dcfbd2e80d84bcdac8c45278e0349572a9a7e627b9e87b30e434f68e57443785356677cfa03dcc45ef56caae4f2565a2de69c46393e2

    Score
    10/10
    persistenceimminentspywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks