Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24-11-2022 03:23
General
-
Target
222db4e1916a04cd6b5e11a65fd4f5e08bf7453edf4d361b6a09de41f5f76908.exe
-
Size
477KB
-
MD5
aa7f88ac6b39b9b9f7d0373a368eb437
-
SHA1
6603e6e54f9eba65a4e1c913af35292e58ea5084
-
SHA256
222db4e1916a04cd6b5e11a65fd4f5e08bf7453edf4d361b6a09de41f5f76908
-
SHA512
0ab9373cac82ceaf6787ef5f99c40cdd604b6f3abd27e5b97485985498b249e9d36be6a2b62ffe943487b70d7896edaa97c07e1c40e651b6ec58cfaf962550b6
-
SSDEEP
12288:X35rxs/Cl9lPP0uaQ5SGvLNuBEgcFfKwZNdEm0g3I:X3vs/Cl9dFvSaLSEgRwZQmq
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\222db4e1916a04cd6b5e11a65fd4f5e08bf7453edf4d361b6a09de41f5f76908.exe"C:\Users\Admin\AppData\Local\Temp\222db4e1916a04cd6b5e11a65fd4f5e08bf7453edf4d361b6a09de41f5f76908.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe" -keyhide -prochide 2832 -reg C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe -proc 2832 C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
477KB
MD5aa7f88ac6b39b9b9f7d0373a368eb437
SHA16603e6e54f9eba65a4e1c913af35292e58ea5084
SHA256222db4e1916a04cd6b5e11a65fd4f5e08bf7453edf4d361b6a09de41f5f76908
SHA5120ab9373cac82ceaf6787ef5f99c40cdd604b6f3abd27e5b97485985498b249e9d36be6a2b62ffe943487b70d7896edaa97c07e1c40e651b6ec58cfaf962550b6
-
Filesize
477KB
MD5aa7f88ac6b39b9b9f7d0373a368eb437
SHA16603e6e54f9eba65a4e1c913af35292e58ea5084
SHA256222db4e1916a04cd6b5e11a65fd4f5e08bf7453edf4d361b6a09de41f5f76908
SHA5120ab9373cac82ceaf6787ef5f99c40cdd604b6f3abd27e5b97485985498b249e9d36be6a2b62ffe943487b70d7896edaa97c07e1c40e651b6ec58cfaf962550b6
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB