Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/12/2023, 16:50
General
-
Target
7e0c7607f378ce0cac081420d270e352.exe
-
Size
9.9MB
-
MD5
7e0c7607f378ce0cac081420d270e352
-
SHA1
7334d15139330c769dbe09cdf7968bd8dedacc56
-
SHA256
3b32b6fc5406fc754c68fb447ff307427ce7acc9a506c18429cb79dfd86a9496
-
SHA512
a50245b7c3e594083e6d738f5f736a87bcbbbd5fb66d5d5f0a4beae870a4d5efeb0d0f61f3a8cc4ca6b8efa599dbfb42458a13443937691a585ec5ec8908f587
-
SSDEEP
196608:8lZrwL3PXWwE4W+iNoLCrdwJkfSl7WDiBaiM0tfAIyazhIqdJqts/kF4u7u:8lZsTXlxW+ifB8kfxLLT6aqatVF4R
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 15 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e0c7607f378ce0cac081420d270e352.exe"C:\Users\Admin\AppData\Local\Temp\7e0c7607f378ce0cac081420d270e352.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yjCf3wdbaX4QZVTF.exe"C:\Users\Admin\AppData\Local\Temp\yjCf3wdbaX4QZVTF.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ping.exeping -n 1 -w 1000 www.piriform.com3⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD541a3c964232edd2d7d5edea53e8245cd
SHA176d7e1fbf15cc3da4dd63a063d6ab2f0868a2206
SHA2568b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5
SHA512fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1
-
Filesize
4KB
MD5c1f778a6d65178d34bde4206161a98e0
SHA129719fffef1ab6fe2df47e5ed258a5e3b3a11cfc
SHA2569caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87
SHA5129c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB