Overview

overview

10

Static

static

b13da7b6b8...62.exe

windows7-x64

1

b13da7b6b8...62.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b13da7b6b8aae65cbd0e6ba90a799ca357743ebd09346bd9df08314998bad562

  • Size

    446KB

  • Sample

    221127-nlbjdadc69

  • MD5

    2ea6a450268553f679c597b90dd1040a

  • SHA1

    8e3712dd47b798d0c1b61a8d840261429a63464d

  • SHA256

    b13da7b6b8aae65cbd0e6ba90a799ca357743ebd09346bd9df08314998bad562

  • SHA512

    5f9924a73b0092a1ae36caf0e6ceff919c86ca4182a012b3d80974ce6f4fd4cdf61b49998db95487b3c0394be7772a91db47f136cafdde04342a69bec636cb1c

  • SSDEEP

    12288:38x3wCw2ihRgU7l1Z/0qLBM+7iAHO6qAMNH:38i+Vehu6Fo

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      b13da7b6b8aae65cbd0e6ba90a799ca357743ebd09346bd9df08314998bad562

    • Size

      446KB

    • MD5

      2ea6a450268553f679c597b90dd1040a

    • SHA1

      8e3712dd47b798d0c1b61a8d840261429a63464d

    • SHA256

      b13da7b6b8aae65cbd0e6ba90a799ca357743ebd09346bd9df08314998bad562

    • SHA512

      5f9924a73b0092a1ae36caf0e6ceff919c86ca4182a012b3d80974ce6f4fd4cdf61b49998db95487b3c0394be7772a91db47f136cafdde04342a69bec636cb1c

    • SSDEEP

      12288:38x3wCw2ihRgU7l1Z/0qLBM+7iAHO6qAMNH:38i+Vehu6Fo

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks