Analysis
-
max time kernel
153s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 18:24
General
-
Target
d5a20aedb39de900453979312f67a9fafee20130e107783fb327a5bfc5b2a15d.exe
-
Size
1.0MB
-
MD5
73545a681827b75ed487a704961065d7
-
SHA1
f8e2dd5c853ddc2f53387f22b3418a0feb60c2ad
-
SHA256
d5a20aedb39de900453979312f67a9fafee20130e107783fb327a5bfc5b2a15d
-
SHA512
b555ab75d7a784b4510e2e5c324a0a51e1d3f271524d61da976714cb917892d94387661cfee04aafe62ab20655bbb7acb1a15fb0a3b2d67734f24686887f5f04
-
SSDEEP
24576:c2O/Gli7HVTbEJRjPgKlXjbnFVPV187qL/CydNqS4I/nU:6xErPgYXj51eqWSNWI/nU
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5a20aedb39de900453979312f67a9fafee20130e107783fb327a5bfc5b2a15d.exe"C:\Users\Admin\AppData\Local\Temp\d5a20aedb39de900453979312f67a9fafee20130e107783fb327a5bfc5b2a15d.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\ekiz55lcb\hYuofe.com"C:\Users\Admin\ekiz55lcb\hYuofe.com" iGSd.IZJ2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30B
MD5d0b479d174024436f72c1301f529fb15
SHA1a484dd819a39b9dd97ebb79caa799abdf40d6a95
SHA2568970ce3c7cd1a8921d3852274b57453eddbc10f8b191044e20cae26d718ee696
SHA5125425d721db6a6535e30cce6dcc23ec375d4bced21b940ba4641ca8632329e5df7ef44631dceeb89a96b77b6203e5e442b3bd3e90e373303b6d57d6a7eb39dd28
-
Filesize
271KB
MD5a9cb8508e7f752e78c21f85bdc71045a
SHA1edad5671d38dfb6cab31232a418c0b02bdbfedf9
SHA256d1f9d96f53c4e4b4772eeb47e7f19cb79e741bbc91aa9db8e3a6dc166f945b7f
SHA512aedbf071ee2c78995d2587c323ddb018a8045a65f3e6c2ed3129bc79186ce9c2387ec2d471d5f6cc9ac6ef6e9e45780787ad2ddcde31e19fcbd7f030bbc35d51
-
Filesize
912KB
MD56a93a4071cc7c22628af40a4d872f49b
SHA1ba916e686aa0cae19ab907bdab94924ada92b5f4
SHA2568465f3fcbccce3ea12495edbb0bd09c3b066e3df891613ce3180f9bb38b37b01
SHA5125a26af395a03397aadab13a53cac320f1d8bbe77046a61ae12e1f72f93df7afb360f52ef52f979f7b946a814365a298c3a3a536add6cdd7165896fb82abc4afd
-
Filesize
912KB
MD56a93a4071cc7c22628af40a4d872f49b
SHA1ba916e686aa0cae19ab907bdab94924ada92b5f4
SHA2568465f3fcbccce3ea12495edbb0bd09c3b066e3df891613ce3180f9bb38b37b01
SHA5125a26af395a03397aadab13a53cac320f1d8bbe77046a61ae12e1f72f93df7afb360f52ef52f979f7b946a814365a298c3a3a536add6cdd7165896fb82abc4afd
-
Filesize
343.0MB
MD5c4c466d9d6fde9943b0e639df2778ab0
SHA12c12d9e41d743216ca569122fba7758eeed67969
SHA2561a78693a43535ff5e326d58853d15b4ccb84218b5fb888eb650c04728640b6f7
SHA51288ae6d4bb03145774122a1183909122c7b4b9094ac2facab092e76b85df332eca8bdbfeebf30b60afeb8d0c5c9a7eaffd48e639530a3965a14aee22a2c506524
-
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-