Analysis
-
max time kernel
151s -
max time network
82s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
24-11-2022 07:20
General
-
Target
70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe
-
Size
358KB
-
MD5
622c0e2308dd0b2104beed9c3113d751
-
SHA1
81e90fb48f79cac3562c17642659df67afe4fee6
-
SHA256
70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8
-
SHA512
d5bbe7ec0750fe11e70702b2a1ba821427ee484c6bdb9bc3ece04131cf07d8a6fd6ec8b47d2634158f50166b61e6ccc9d14d66da4a1b0f483c8e761e668d5aed
-
SSDEEP
6144:GGKTSCZ6XZDos5NoKcxnisULcGkyQr4I71VU4Nhxnjd+Y9oYRstM8N7ZHBm:GGwcHoKaisULVkgIj37xjd+Eojj7ZH
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe"C:\Users\Admin\AppData\Local\Temp\70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe"C:\Users\Admin\AppData\Local\Temp\70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exeC:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD57e50c731e4fcaac9f395aa1faae07674
SHA14e347ae9b63a0d7d920e5f7a913825a2504b251c
SHA256218e599bdf886981e72de419165df2048865c3eabec6d0cbf0ea5bdb2048fe70
SHA512397142c55667d017a1a7676cd69c1233b1339b6e551e4e5b0ae8a246ee2b1e11c4c1107da0e5f484b6fefced270355adaf50eee9bd2caa071ea395df0f32b66d
-
Filesize
7KB
MD57e50c731e4fcaac9f395aa1faae07674
SHA14e347ae9b63a0d7d920e5f7a913825a2504b251c
SHA256218e599bdf886981e72de419165df2048865c3eabec6d0cbf0ea5bdb2048fe70
SHA512397142c55667d017a1a7676cd69c1233b1339b6e551e4e5b0ae8a246ee2b1e11c4c1107da0e5f484b6fefced270355adaf50eee9bd2caa071ea395df0f32b66d
-
Filesize
7KB
MD57e50c731e4fcaac9f395aa1faae07674
SHA14e347ae9b63a0d7d920e5f7a913825a2504b251c
SHA256218e599bdf886981e72de419165df2048865c3eabec6d0cbf0ea5bdb2048fe70
SHA512397142c55667d017a1a7676cd69c1233b1339b6e551e4e5b0ae8a246ee2b1e11c4c1107da0e5f484b6fefced270355adaf50eee9bd2caa071ea395df0f32b66d
-
Filesize
358KB
MD5622c0e2308dd0b2104beed9c3113d751
SHA181e90fb48f79cac3562c17642659df67afe4fee6
SHA25670d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8
SHA512d5bbe7ec0750fe11e70702b2a1ba821427ee484c6bdb9bc3ece04131cf07d8a6fd6ec8b47d2634158f50166b61e6ccc9d14d66da4a1b0f483c8e761e668d5aed
-
Filesize
358KB
MD5622c0e2308dd0b2104beed9c3113d751
SHA181e90fb48f79cac3562c17642659df67afe4fee6
SHA25670d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8
SHA512d5bbe7ec0750fe11e70702b2a1ba821427ee484c6bdb9bc3ece04131cf07d8a6fd6ec8b47d2634158f50166b61e6ccc9d14d66da4a1b0f483c8e761e668d5aed
-
Filesize
358KB
MD5622c0e2308dd0b2104beed9c3113d751
SHA181e90fb48f79cac3562c17642659df67afe4fee6
SHA25670d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8
SHA512d5bbe7ec0750fe11e70702b2a1ba821427ee484c6bdb9bc3ece04131cf07d8a6fd6ec8b47d2634158f50166b61e6ccc9d14d66da4a1b0f483c8e761e668d5aed
-
Filesize
7KB
MD57e50c731e4fcaac9f395aa1faae07674
SHA14e347ae9b63a0d7d920e5f7a913825a2504b251c
SHA256218e599bdf886981e72de419165df2048865c3eabec6d0cbf0ea5bdb2048fe70
SHA512397142c55667d017a1a7676cd69c1233b1339b6e551e4e5b0ae8a246ee2b1e11c4c1107da0e5f484b6fefced270355adaf50eee9bd2caa071ea395df0f32b66d
-
Filesize
358KB
MD5622c0e2308dd0b2104beed9c3113d751
SHA181e90fb48f79cac3562c17642659df67afe4fee6
SHA25670d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8
SHA512d5bbe7ec0750fe11e70702b2a1ba821427ee484c6bdb9bc3ece04131cf07d8a6fd6ec8b47d2634158f50166b61e6ccc9d14d66da4a1b0f483c8e761e668d5aed
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB