Overview

overview

10

Static

static

4d323f4ec3...0b.exe

windows7-x64

10

4d323f4ec3...0b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4d323f4ec3880f6cbb6433e058cb73caf457f536f9c94c8c3e69eb2b5917780b

  • Size

    1.5MB

  • Sample

    221128-n9vl6agc2y

  • MD5

    776849df995af2da444c2a6bd2e0e26c

  • SHA1

    fd34715a18c64255f251ee719de24d52ecbd05eb

  • SHA256

    4d323f4ec3880f6cbb6433e058cb73caf457f536f9c94c8c3e69eb2b5917780b

  • SHA512

    6350f90df1ed840734dba2c0b5811cd9981062c2debe38c1a119869ad3bee20614592b6d6ec3f7e9253e3ddc6c1bbb83e4204f53a79f97e9fe9d2787bf7141e3

  • SSDEEP

    24576:on0Rx12kuM4KOn1TDMc3FoYoGgnTuiVaUxw7VazA0hakPm8TRa:Aku7KOnRZoxnyiAUx4VaJaga

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      4d323f4ec3880f6cbb6433e058cb73caf457f536f9c94c8c3e69eb2b5917780b

    • Size

      1.5MB

    • MD5

      776849df995af2da444c2a6bd2e0e26c

    • SHA1

      fd34715a18c64255f251ee719de24d52ecbd05eb

    • SHA256

      4d323f4ec3880f6cbb6433e058cb73caf457f536f9c94c8c3e69eb2b5917780b

    • SHA512

      6350f90df1ed840734dba2c0b5811cd9981062c2debe38c1a119869ad3bee20614592b6d6ec3f7e9253e3ddc6c1bbb83e4204f53a79f97e9fe9d2787bf7141e3

    • SSDEEP

      24576:on0Rx12kuM4KOn1TDMc3FoYoGgnTuiVaUxw7VazA0hakPm8TRa:Aku7KOnRZoxnyiAUx4VaJaga

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks