Overview

overview

10

Static

static

b1edde38cd...51.exe

windows7-x64

10

b1edde38cd...51.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b1edde38cdde5a77410a3b1286f4e4de9f23e8c85661e27131a912f0c63fcd51

  • Size

    339KB

  • Sample

    221123-qlrxgaec64

  • MD5

    6f2079524dfbcc1873b236623bf54332

  • SHA1

    81d9fa986239d2cddb88b0171ef8cc310636a92a

  • SHA256

    b1edde38cdde5a77410a3b1286f4e4de9f23e8c85661e27131a912f0c63fcd51

  • SHA512

    281d5f300c68947b506c4041341e8a5823caf66233d2aec2d026e73dce26edaf0c485b506f1fb6f31665d641df6632ee867ff0d4e095dc548d46d439ba6597f4

  • SSDEEP

    6144:L2gD4gPNYTcl6bWq0o5ACUJVymf7ouQo97HAXvc1GZ/9ctltCc/+EvFkywdg:ggEbWfoSCUqcao97gXvc1ylItCc/+EQ

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      b1edde38cdde5a77410a3b1286f4e4de9f23e8c85661e27131a912f0c63fcd51

    • Size

      339KB

    • MD5

      6f2079524dfbcc1873b236623bf54332

    • SHA1

      81d9fa986239d2cddb88b0171ef8cc310636a92a

    • SHA256

      b1edde38cdde5a77410a3b1286f4e4de9f23e8c85661e27131a912f0c63fcd51

    • SHA512

      281d5f300c68947b506c4041341e8a5823caf66233d2aec2d026e73dce26edaf0c485b506f1fb6f31665d641df6632ee867ff0d4e095dc548d46d439ba6597f4

    • SSDEEP

      6144:L2gD4gPNYTcl6bWq0o5ACUJVymf7ouQo97HAXvc1GZ/9ctltCc/+EvFkywdg:ggEbWfoSCUqcao97gXvc1ylItCc/+EQ

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks