Analysis
-
max time kernel
187s -
max time network
189s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
24-11-2022 03:23
General
-
Target
fcd25a11ef8ebc61519d66fbf7a0edfcbb4bd9a6b0723993bff99462050011a8.exe
-
Size
645KB
-
MD5
398a75ee8a26f0ef0a9cfad14291c3af
-
SHA1
6c515db9557f3256e681fda198cb45c034d01658
-
SHA256
fcd25a11ef8ebc61519d66fbf7a0edfcbb4bd9a6b0723993bff99462050011a8
-
SHA512
e3beddb7435300d413ea11edaad14359ea6e262e8cdc201d260a832cf6b4f0c62259a996248337f15b57ca76a19a7ef2a984683461dd6620deb64998a3c246b6
-
SSDEEP
12288:dXrWlNSpKL/HaQ/82Q3E4RSDnDiLs4C4a7rHNEu34RC2bjpZJYD:duSgLCQ/8H3E4RSbme7rF34RC2FYD
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcd25a11ef8ebc61519d66fbf7a0edfcbb4bd9a6b0723993bff99462050011a8.exe"C:\Users\Admin\AppData\Local\Temp\fcd25a11ef8ebc61519d66fbf7a0edfcbb4bd9a6b0723993bff99462050011a8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe" -reg C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe -proc 1228 C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
645KB
MD5398a75ee8a26f0ef0a9cfad14291c3af
SHA16c515db9557f3256e681fda198cb45c034d01658
SHA256fcd25a11ef8ebc61519d66fbf7a0edfcbb4bd9a6b0723993bff99462050011a8
SHA512e3beddb7435300d413ea11edaad14359ea6e262e8cdc201d260a832cf6b4f0c62259a996248337f15b57ca76a19a7ef2a984683461dd6620deb64998a3c246b6
-
Filesize
645KB
MD5398a75ee8a26f0ef0a9cfad14291c3af
SHA16c515db9557f3256e681fda198cb45c034d01658
SHA256fcd25a11ef8ebc61519d66fbf7a0edfcbb4bd9a6b0723993bff99462050011a8
SHA512e3beddb7435300d413ea11edaad14359ea6e262e8cdc201d260a832cf6b4f0c62259a996248337f15b57ca76a19a7ef2a984683461dd6620deb64998a3c246b6
-
Filesize
16.6MB
-
Filesize
124KB
-
Filesize
8KB
-
Filesize
124KB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
16.6MB
-
Filesize
10.1MB
-
Filesize
16.6MB