Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 13:46
General
-
Target
1a7bd3bb85833f8ed51f478e024af1b7.exe
-
Size
322KB
-
MD5
1a7bd3bb85833f8ed51f478e024af1b7
-
SHA1
a3003e285ce0f7c04ea142351d581235e75e52aa
-
SHA256
5851bf0214f12c68579c9b333ee5ed37b6ec5a9afebd519bd37aac0c3a25ea40
-
SHA512
994117914190c32a71af59be095ab24569c1896b6dd7768f8247af4831ceb42dacc62e0ee90b09da2412c455f05973ef9d9efcc01cd631596e728d17ef7d583c
-
SSDEEP
6144:Z/FjEVIUAbAoeKqv5ScGaBD00Daf6E36SfVFZDedW7J/h8O7o1r:ZREVI7bk/FVlDaf336SnZDj7php0
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a7bd3bb85833f8ed51f478e024af1b7.exe"C:\Users\Admin\AppData\Local\Temp\1a7bd3bb85833f8ed51f478e024af1b7.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\1a7bd3bb85833f8ed51f478e024af1b7.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\1a7bd3bb85833f8ed51f478e024af1b7\1a7bd3bb85833f8ed51f478e024af1b7.exe"C:\Users\Admin\AppData\Local\Temp\1a7bd3bb85833f8ed51f478e024af1b7\1a7bd3bb85833f8ed51f478e024af1b7.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB