Overview

overview

10

Static

static

05d17bbb3a...3b.exe

windows7-x64

8

05d17bbb3a...3b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05d17bbb3af3947e4aab748ca50eb028197dc9eedaf831129792981199f1b23b

  • Size

    468KB

  • Sample

    221021-telcwsaahr

  • MD5

    717e9dc766680d93384f6faed13181b0

  • SHA1

    c3309e501fdb9115c39b588c7ba33c329b7c657d

  • SHA256

    05d17bbb3af3947e4aab748ca50eb028197dc9eedaf831129792981199f1b23b

  • SHA512

    1afe5d1bbc8e58b89efd3f7cf7d2cbc64bd99149e5528f1c1c69c7195a2966b79e7ced1dc380d57c8c381a7423570759856ec2a3ae13307a49ee13172c4ec340

  • SSDEEP

    6144:u3lB8iygOCQwIf6wgkcm/SBrB7KTcF2mH0MS3u3p3MHj+/D7F/w:8BggOuG6I/wMHmH0Mkq3MHj+/9/w

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      05d17bbb3af3947e4aab748ca50eb028197dc9eedaf831129792981199f1b23b

    • Size

      468KB

    • MD5

      717e9dc766680d93384f6faed13181b0

    • SHA1

      c3309e501fdb9115c39b588c7ba33c329b7c657d

    • SHA256

      05d17bbb3af3947e4aab748ca50eb028197dc9eedaf831129792981199f1b23b

    • SHA512

      1afe5d1bbc8e58b89efd3f7cf7d2cbc64bd99149e5528f1c1c69c7195a2966b79e7ced1dc380d57c8c381a7423570759856ec2a3ae13307a49ee13172c4ec340

    • SSDEEP

      6144:u3lB8iygOCQwIf6wgkcm/SBrB7KTcF2mH0MS3u3p3MHj+/D7F/w:8BggOuG6I/wMHmH0Mkq3MHj+/9/w

    Score
    10/10
    persistenceimminentspywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks