Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
24-11-2022 07:20
General
-
Target
70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe
-
Size
358KB
-
MD5
622c0e2308dd0b2104beed9c3113d751
-
SHA1
81e90fb48f79cac3562c17642659df67afe4fee6
-
SHA256
70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8
-
SHA512
d5bbe7ec0750fe11e70702b2a1ba821427ee484c6bdb9bc3ece04131cf07d8a6fd6ec8b47d2634158f50166b61e6ccc9d14d66da4a1b0f483c8e761e668d5aed
-
SSDEEP
6144:GGKTSCZ6XZDos5NoKcxnisULcGkyQr4I71VU4Nhxnjd+Y9oYRstM8N7ZHBm:GGwcHoKaisULVkgIj37xjd+Eojj7ZH
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Executes dropped EXE 4 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe"C:\Users\Admin\AppData\Local\Temp\70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe"C:\Users\Admin\AppData\Local\Temp\70d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8.exe"2⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exeC:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224B
MD5c19eb8c8e7a40e6b987f9d2ee952996e
SHA16fc3049855bc9100643e162511673c6df0f28bfb
SHA256677e9e30350df17e2bc20fa9f7d730e9f7cc6e870d6520a345f5f7dc5b31f58a
SHA512860713b4a787c2189ed12a47d4b68b60ac00c7a253cae52dd4eb9276dacafeae3a81906b6d0742c8ecfdfaa255777c445beb7c2a532f3c677a9903237ac97596
-
Filesize
7KB
MD57e50c731e4fcaac9f395aa1faae07674
SHA14e347ae9b63a0d7d920e5f7a913825a2504b251c
SHA256218e599bdf886981e72de419165df2048865c3eabec6d0cbf0ea5bdb2048fe70
SHA512397142c55667d017a1a7676cd69c1233b1339b6e551e4e5b0ae8a246ee2b1e11c4c1107da0e5f484b6fefced270355adaf50eee9bd2caa071ea395df0f32b66d
-
Filesize
7KB
MD57e50c731e4fcaac9f395aa1faae07674
SHA14e347ae9b63a0d7d920e5f7a913825a2504b251c
SHA256218e599bdf886981e72de419165df2048865c3eabec6d0cbf0ea5bdb2048fe70
SHA512397142c55667d017a1a7676cd69c1233b1339b6e551e4e5b0ae8a246ee2b1e11c4c1107da0e5f484b6fefced270355adaf50eee9bd2caa071ea395df0f32b66d
-
Filesize
7KB
MD57e50c731e4fcaac9f395aa1faae07674
SHA14e347ae9b63a0d7d920e5f7a913825a2504b251c
SHA256218e599bdf886981e72de419165df2048865c3eabec6d0cbf0ea5bdb2048fe70
SHA512397142c55667d017a1a7676cd69c1233b1339b6e551e4e5b0ae8a246ee2b1e11c4c1107da0e5f484b6fefced270355adaf50eee9bd2caa071ea395df0f32b66d
-
Filesize
7KB
MD57e50c731e4fcaac9f395aa1faae07674
SHA14e347ae9b63a0d7d920e5f7a913825a2504b251c
SHA256218e599bdf886981e72de419165df2048865c3eabec6d0cbf0ea5bdb2048fe70
SHA512397142c55667d017a1a7676cd69c1233b1339b6e551e4e5b0ae8a246ee2b1e11c4c1107da0e5f484b6fefced270355adaf50eee9bd2caa071ea395df0f32b66d
-
Filesize
358KB
MD5622c0e2308dd0b2104beed9c3113d751
SHA181e90fb48f79cac3562c17642659df67afe4fee6
SHA25670d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8
SHA512d5bbe7ec0750fe11e70702b2a1ba821427ee484c6bdb9bc3ece04131cf07d8a6fd6ec8b47d2634158f50166b61e6ccc9d14d66da4a1b0f483c8e761e668d5aed
-
Filesize
358KB
MD5622c0e2308dd0b2104beed9c3113d751
SHA181e90fb48f79cac3562c17642659df67afe4fee6
SHA25670d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8
SHA512d5bbe7ec0750fe11e70702b2a1ba821427ee484c6bdb9bc3ece04131cf07d8a6fd6ec8b47d2634158f50166b61e6ccc9d14d66da4a1b0f483c8e761e668d5aed
-
Filesize
358KB
MD5622c0e2308dd0b2104beed9c3113d751
SHA181e90fb48f79cac3562c17642659df67afe4fee6
SHA25670d456dbfdb650b775d74dfccd2024863ffb80f04dfd88c9f92af337d6d3a6e8
SHA512d5bbe7ec0750fe11e70702b2a1ba821427ee484c6bdb9bc3ece04131cf07d8a6fd6ec8b47d2634158f50166b61e6ccc9d14d66da4a1b0f483c8e761e668d5aed
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
5.7MB