Analysis
-
max time kernel
148s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
04-10-2022 02:45
General
-
Target
e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe
-
Size
1.1MB
-
MD5
60e6d51d8c8e568b2f721daa8517e330
-
SHA1
599bfcabaaf49e843a363057d4b5baade0c9bf1e
-
SHA256
e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a
-
SHA512
b124440bd73647c403f810604918526e873868b7355ee6c8e613ec8a965567c209fc5233b0f214f6f7c147925659df93ad6184ae0d8d9a883626d957979880d9
-
SSDEEP
24576:Htb20pkaCqT5TBWgNQ7alF6NnrqoedRaKR8B96A:EVg5tQ7alUrqTdnRk5
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 9 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe"C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe"C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\791913" "C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD531a67a9a9b3add7bc836e3348191b2f8
SHA140d9198c3be878b55bc4e1404fa2eca853282c31
SHA25646453e6da45258c2c06fecc44508cb5dab64efe57a345189f60153200d4ed8b7
SHA5124d4100f03d68e872d6a109265a90ec4b9795978c5895c4a8aa851ea6f482973740b03702525110b676defc0bc09bb4b29911396ae94d0280e459bee4b45f810f
-
Filesize
19KB
MD5cf37a7b7d39af92bc45571433e1df301
SHA1cce6c2a3c32c5ff7bdad549422cdddf5deccfd13
SHA256d29bb4c5f8b8b32149e319f5efecb755c3b8f5465f1f33c30bbbc8774e870937
SHA5128b4ebf92723d8b8b4c2d2928ced1c44328eb05429d7db8a7a8b282c4519cf6a168097bbdf6cdb12e1ddb65a87410cbdc7ef54d77140f4b28afc939e606840e0c
-
Filesize
299KB
MD56cb65cda337af8c947fb213ebf5370cb
SHA178dda4b942251aba07465d2778da59a0068da92f
SHA256390cefc7566dde54ea95718d83235aa83fd02090420b679bae5ec31847e565a6
SHA5125ac12ca2f58bc2b3f9cb18a199b4d37e0b73ed739b12b9823d0c65a3e7aa564808518014bd66de3e182907cb1349e014c3303c30c2a5c5f85cb69fdc541122b2
-
Filesize
328KB
-
Filesize
624KB
-
Filesize
5.6MB