Overview

overview

10

Static

static

3

d8875655ae...e1.exe

windows7-x64

10

d8875655ae...e1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d8875655ae77407bbf0797e2efd8cde1

  • Size

    810KB

  • Sample

    240320-l4ktnaeg9z

  • MD5

    d8875655ae77407bbf0797e2efd8cde1

  • SHA1

    42a4d00c076042306258b59d63f7126a019c6b0b

  • SHA256

    ea23a2b167613a7342dc12fcd07b219f74dc616e84140ca6c20746171b5b0697

  • SHA512

    5ce2b4b9642a6397da5f511d3b96a23951827a6f4e06ee015b69ff23ebc857495ede583f27e093abb0511ee5e22d3b644e80b22cf28e302b513350b27272dd3e

  • SSDEEP

    24576:9/C7lDKaskRIyVOhlpjH4f0eBzMw29YUg6Htj:9gDKa7rOhl5YfhMR99Htj

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      d8875655ae77407bbf0797e2efd8cde1

    • Size

      810KB

    • MD5

      d8875655ae77407bbf0797e2efd8cde1

    • SHA1

      42a4d00c076042306258b59d63f7126a019c6b0b

    • SHA256

      ea23a2b167613a7342dc12fcd07b219f74dc616e84140ca6c20746171b5b0697

    • SHA512

      5ce2b4b9642a6397da5f511d3b96a23951827a6f4e06ee015b69ff23ebc857495ede583f27e093abb0511ee5e22d3b644e80b22cf28e302b513350b27272dd3e

    • SSDEEP

      24576:9/C7lDKaskRIyVOhlpjH4f0eBzMw29YUg6Htj:9gDKa7rOhl5YfhMR99Htj

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks