Analysis
-
max time kernel
20s -
max time network
23s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
19-10-2022 22:30
General
-
Target
78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe
-
Size
293KB
-
MD5
5090efbff6669644e61b70a6614e53b0
-
SHA1
eac8dc59f54f265fa2e71a265c42299f34378034
-
SHA256
78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157
-
SHA512
ed8dc4df183e89fadaf2691a74822ee225893891a413164a9539c50da1fbcfdfd3b3b3fe497d31830d09e8eaa3bad1ef21d275ab56fa47a374a1a784c4d8ae49
-
SSDEEP
6144:bpJXZO9tcfeMV8vOOrrN051yp2p6FEgN/hVvJy44ALvremUYDQctl:bP1feGIN054b5/vJyF0remUTI
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe"C:\Users\Admin\AppData\Local\Temp\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe"C:\Users\Admin\AppData\Local\Temp\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 15043⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
293KB
MD55090efbff6669644e61b70a6614e53b0
SHA1eac8dc59f54f265fa2e71a265c42299f34378034
SHA25678258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157
SHA512ed8dc4df183e89fadaf2691a74822ee225893891a413164a9539c50da1fbcfdfd3b3b3fe497d31830d09e8eaa3bad1ef21d275ab56fa47a374a1a784c4d8ae49
-
Filesize
293KB
MD55090efbff6669644e61b70a6614e53b0
SHA1eac8dc59f54f265fa2e71a265c42299f34378034
SHA25678258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157
SHA512ed8dc4df183e89fadaf2691a74822ee225893891a413164a9539c50da1fbcfdfd3b3b3fe497d31830d09e8eaa3bad1ef21d275ab56fa47a374a1a784c4d8ae49
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB