Overview

overview

10

Static

static

c499097434...69.exe

windows7-x64

10

c499097434...69.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c4990974348a62b4bb101370e45f09bf287d2905bcf966d7b16323e27cf1a869

  • Size

    272KB

  • Sample

    221127-bp95wsaa33

  • MD5

    4dc446acf5024d1a9d7fecef7b3ae3ec

  • SHA1

    b3f8c11066e0c45c8f0891b6d5cf12cec99960fb

  • SHA256

    c4990974348a62b4bb101370e45f09bf287d2905bcf966d7b16323e27cf1a869

  • SHA512

    b0eed0c7e717b5cfd93cd9afcf0ede14db6bbdcd8c87095fcad52250f6187a71f5104ece2e0fc8aca3720306b9005e18f4d6ec36756eddec622d40edbb0448fa

  • SSDEEP

    6144:aZwpzEorS0559utLB4xJ86a/IeFctlth:XpworS0lutLB4H5aQeFIz

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      c4990974348a62b4bb101370e45f09bf287d2905bcf966d7b16323e27cf1a869

    • Size

      272KB

    • MD5

      4dc446acf5024d1a9d7fecef7b3ae3ec

    • SHA1

      b3f8c11066e0c45c8f0891b6d5cf12cec99960fb

    • SHA256

      c4990974348a62b4bb101370e45f09bf287d2905bcf966d7b16323e27cf1a869

    • SHA512

      b0eed0c7e717b5cfd93cd9afcf0ede14db6bbdcd8c87095fcad52250f6187a71f5104ece2e0fc8aca3720306b9005e18f4d6ec36756eddec622d40edbb0448fa

    • SSDEEP

      6144:aZwpzEorS0559utLB4xJ86a/IeFctlth:XpworS0lutLB4H5aQeFIz

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks