Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
27-11-2022 16:53
General
-
Target
d4f7648705a2c55cdd007dcf41a86160443223c16f160ed7c0cb743856107b8a.exe
-
Size
1.0MB
-
MD5
9a68a6df1c835f8c37a8099af3641609
-
SHA1
c0a06fd9f3b01b64d9062ad0153b479b3e355f9a
-
SHA256
d4f7648705a2c55cdd007dcf41a86160443223c16f160ed7c0cb743856107b8a
-
SHA512
1f1148e01ded112724ab2cfd19467190788849863caa5b48a962395bc6476e75416f3291b462d7338170fa121960a2e7568117844443b5779d87c926bf65d77b
-
SSDEEP
24576:Nt24Q2YvaKR9uVbK7YmxPSKocXFreTloXqWwcmSpQAwFvOx7Ei:p7Yv5aSYKZOmcSR267p
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4f7648705a2c55cdd007dcf41a86160443223c16f160ed7c0cb743856107b8a.exe"C:\Users\Admin\AppData\Local\Temp\d4f7648705a2c55cdd007dcf41a86160443223c16f160ed7c0cb743856107b8a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\mvc973976p99\IliJIkfCXZJ.com"C:\Users\Admin\mvc973976p99\IliJIkfCXZJ.com" TJgFQHi.UNF2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
268KB
MD568dd91e201d7d6fd5fc37cfc93bb5036
SHA1a36c5f972fd05bd5c9a10fc5028dc9709f9f1147
SHA256cdca46ee294da49918ac092be804540fff171f9dc12a671588a9461d868fc7c4
SHA5123a59a80929d95aa9d2ca5fa609f82c43e640da7a7b6b54ed1f91ce2332ca9ab861128f73323cfb188a8716ece6c60233b3aba31af29885d16c2f22740cd424e7
-
Filesize
201B
MD55581292b58ee75bb100ea9e7b9d23d58
SHA1323b891f7cd89cb39cde6b837b604d6dcf3a2d89
SHA2560e93d8e26af39d5f2c6570a4c8dc5d06c31504c3acfbd06cef34274fba254833
SHA512d94a4a0cb1a4d85fb6bd2819fe1d0b2029f363d338152bdaf828d0327e513c9b16a9c9c7a684288b461a46d299354e7033a20656bb34472e4e451b32c01c9af1
-
Filesize
46KB
MD5eabffdd0ac0696a47ee087e7e572c341
SHA1f323321dda4ff0d6688784659ea77b3eec96643e
SHA2561accc46a8a20df3c06b6508371e926492ca5a33dd873cfaef4ff8ebe96ac04e6
SHA512634cfafb8a7ddae214c6413213c287d06bc643a9aad03998801bb5b3dbc79f598fbb449b3f990e5d40cb2910899934642bd21565e40973e3b9943cf2022591f7
-
Filesize
912KB
MD56a93a4071cc7c22628af40a4d872f49b
SHA1ba916e686aa0cae19ab907bdab94924ada92b5f4
SHA2568465f3fcbccce3ea12495edbb0bd09c3b066e3df891613ce3180f9bb38b37b01
SHA5125a26af395a03397aadab13a53cac320f1d8bbe77046a61ae12e1f72f93df7afb360f52ef52f979f7b946a814365a298c3a3a536add6cdd7165896fb82abc4afd
-
Filesize
28.5MB
MD59a94fe5ba128e6125f91d34669e05257
SHA13ebfbd4b7cc08a8a131166d9f7138f97d9b7f1e9
SHA256262bd66f3ad856dccfa728ce810756881748902a0d39046b4ebd18e0f55ac756
SHA5128b0783dee8770ca64f3fc877269b6d7f9e1f7a933d97c6106125f20f76308908376439f400928046c7d9bd2362b4e914088f7bc3bffd7e7a19ec3b56c1536ad1
-
Filesize
912KB
MD56a93a4071cc7c22628af40a4d872f49b
SHA1ba916e686aa0cae19ab907bdab94924ada92b5f4
SHA2568465f3fcbccce3ea12495edbb0bd09c3b066e3df891613ce3180f9bb38b37b01
SHA5125a26af395a03397aadab13a53cac320f1d8bbe77046a61ae12e1f72f93df7afb360f52ef52f979f7b946a814365a298c3a3a536add6cdd7165896fb82abc4afd
-
Filesize
912KB
MD56a93a4071cc7c22628af40a4d872f49b
SHA1ba916e686aa0cae19ab907bdab94924ada92b5f4
SHA2568465f3fcbccce3ea12495edbb0bd09c3b066e3df891613ce3180f9bb38b37b01
SHA5125a26af395a03397aadab13a53cac320f1d8bbe77046a61ae12e1f72f93df7afb360f52ef52f979f7b946a814365a298c3a3a536add6cdd7165896fb82abc4afd
-
Filesize
912KB
MD56a93a4071cc7c22628af40a4d872f49b
SHA1ba916e686aa0cae19ab907bdab94924ada92b5f4
SHA2568465f3fcbccce3ea12495edbb0bd09c3b066e3df891613ce3180f9bb38b37b01
SHA5125a26af395a03397aadab13a53cac320f1d8bbe77046a61ae12e1f72f93df7afb360f52ef52f979f7b946a814365a298c3a3a536add6cdd7165896fb82abc4afd
-
Filesize
912KB
MD56a93a4071cc7c22628af40a4d872f49b
SHA1ba916e686aa0cae19ab907bdab94924ada92b5f4
SHA2568465f3fcbccce3ea12495edbb0bd09c3b066e3df891613ce3180f9bb38b37b01
SHA5125a26af395a03397aadab13a53cac320f1d8bbe77046a61ae12e1f72f93df7afb360f52ef52f979f7b946a814365a298c3a3a536add6cdd7165896fb82abc4afd
-
-
Filesize
296KB
-
Filesize
296KB
-
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
68KB
-
Filesize
5.7MB
-
Filesize
68KB
-
Filesize
8KB
