Overview

overview

10

Static

static

7736020e4a...3b.exe

windows7-x64

10

7736020e4a...3b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7736020e4a0d8609dcb5b141cbbf0ac8cd2ee08751ba28b3f6d87b16b2e0103b

  • Size

    416KB

  • Sample

    221021-w6zeyaafhm

  • MD5

    16f1944958ccf7f1f9b40776782d89d0

  • SHA1

    16dec19cf9c7d35f044b433c7a6118a5ca112644

  • SHA256

    7736020e4a0d8609dcb5b141cbbf0ac8cd2ee08751ba28b3f6d87b16b2e0103b

  • SHA512

    772255e4295f3dff6032160c7c9856742e2aae7f272d8f6a49cf817ad549e83a019aae9c18422a3b2941b02716125e9f4f08f1447d5dff4378a16d66a1b49e04

  • SSDEEP

    6144:5YFrE87KPG5GS2rRW7LU3n5PZz5MUed2cVoQ1hNWK2WdXRDanRKBqoBR4GF:5Y+HS28O5PJGRTuQxdKO5R4GF

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      7736020e4a0d8609dcb5b141cbbf0ac8cd2ee08751ba28b3f6d87b16b2e0103b

    • Size

      416KB

    • MD5

      16f1944958ccf7f1f9b40776782d89d0

    • SHA1

      16dec19cf9c7d35f044b433c7a6118a5ca112644

    • SHA256

      7736020e4a0d8609dcb5b141cbbf0ac8cd2ee08751ba28b3f6d87b16b2e0103b

    • SHA512

      772255e4295f3dff6032160c7c9856742e2aae7f272d8f6a49cf817ad549e83a019aae9c18422a3b2941b02716125e9f4f08f1447d5dff4378a16d66a1b49e04

    • SSDEEP

      6144:5YFrE87KPG5GS2rRW7LU3n5PZz5MUed2cVoQ1hNWK2WdXRDanRKBqoBR4GF:5Y+HS28O5PJGRTuQxdKO5R4GF

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks