Overview

overview

10

Static

static

5f9cce7dd9...55.exe

windows7-x64

10

5f9cce7dd9...55.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f9cce7dd917c1b227ba62a252afb08e9365a236547bfa3e073e013a1f0db655

  • Size

    282KB

  • Sample

    221127-b22dhsed9z

  • MD5

    ac043974e9a4d4424f0f64484a80a024

  • SHA1

    fe38871e518ef5e8cad4634ccf1d575bf9574315

  • SHA256

    5f9cce7dd917c1b227ba62a252afb08e9365a236547bfa3e073e013a1f0db655

  • SHA512

    639edfa42065d0a106646d64f62fec6905194521800bf7e058d399dbe2925ecc1a9df9ccce4c6f618f1f10443b18686cebe4f4fa64695477269b4cbdd976b368

  • SSDEEP

    6144:W3i8duvIudDL9feU3ob3FuijpKtNKd0KS24QQipm92pFmxYPGcR:+Fuwu99W93F3KtN4rLXpkxVC

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      5f9cce7dd917c1b227ba62a252afb08e9365a236547bfa3e073e013a1f0db655

    • Size

      282KB

    • MD5

      ac043974e9a4d4424f0f64484a80a024

    • SHA1

      fe38871e518ef5e8cad4634ccf1d575bf9574315

    • SHA256

      5f9cce7dd917c1b227ba62a252afb08e9365a236547bfa3e073e013a1f0db655

    • SHA512

      639edfa42065d0a106646d64f62fec6905194521800bf7e058d399dbe2925ecc1a9df9ccce4c6f618f1f10443b18686cebe4f4fa64695477269b4cbdd976b368

    • SSDEEP

      6144:W3i8duvIudDL9feU3ob3FuijpKtNKd0KS24QQipm92pFmxYPGcR:+Fuwu99W93F3KtN4rLXpkxVC

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks