imminent | 6805b3c7c5234bd7f0fdc6355fddbb53152f605865d96deb5ed115b67baff445

Target
251028-vkjxpaxrap_pw_infected.zip
Size 45.4MB
Sample251122-vsrmhabm4v
SHA256 6805b3c7c5234bd7f0fdc6355fddbb53152f605865d96deb5ed115b67baff445
MD5 1fcf428d37f7ae7b425fba9668098b14
SHA1 34f4131bd058cca977147eaf957464837b5d7ada
SHA512 3d96349fd73e3ba35060419d8401df78550d21e203a6b7e30a10345cc0622342a6ba64dc9a12cf7a94f58c9c649fed27870f0cdafee302516d41f89cc2691518
SSDEEP 786432:a5sC4IUx4TDGguUu80jqUg69lYBjKYRDm6kWB/Q+7uOZ+c1WfMQVZr/EapS621oP:a5tHHYz80jLJYIYsKXT/1/Qj5wX4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Malware-1-master/Download.exe
- Size 247KB
- SHA256 de2274da8cf00dfc6e6e52db43f82210a1fb7fd30016ebdc81347fb2d1f248fa
- MD5 6a97f4f16e7879967a5c02d143d0bd46
- SHA1 0898ccf65770813f69bf339462a05a8c6e17be69
- SHA512 0bc14103518a2e234f4e3f4ddc46e91a1ed21c2885fd4eb27d3cf8cd088e4fa4fffcc221ddb404f52794c57d6693b2ce080e797bf33f2322490030e0fce0ac27
- SSDEEP 3072:ZV3bDzHY2weWeFoyUWfMRBsfpVZynzK4ChhO2IGmXf3Ur3CvZJnodCKJYsUH+Iun:ZBbDzHY0UsfPwUIvOd1
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral1
- Target
  Malware-1-master/MEMZ-Clean.bat
- Size 9KB
- SHA256 5c3fde60c178ed0306dd3e396032acdc9bc55c690e27a926923dd18238bbd64c
- MD5 bbae81b88416d8fba76dd3145a831d19
- SHA1 42fa0e1b90ad49f66d4ab96c8cca02f81248da8b
- SHA512 f03ac63bbb504cb53dc896c2bec8666257034b1c4a5827a4ad75c434af05f1cd631a814cc8689e60210e4ca757e61390db8d222f05bf9f3a0fa7026bdf8c4368
- SSDEEP 192:XBOTDzoOgdlf7MAdTyQuHq2b1vXei2SLca5icrLJlz3:ss/tDyQuHZddL5Jlz3
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery execution
- Executes dropped EXE
- Drops desktop.ini file(s)
behavioral2
- Target
  Malware-1-master/MEMZ-Clean.exe
- Size 12KB
- SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
- MD5 9c642c5b111ee85a6bccffc7af896a51
- SHA1 eca8571b994fd40e2018f48c214fab6472a98bab
- SHA512 23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
- SSDEEP 192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3
- Target
  Malware-1-master/MEMZ-Destructive.bat
- Size 13KB
- SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
- MD5 4e2a7f369378a76d1df4d8c448f712af
- SHA1 1192b4d01254a8704e6d6ae17dc2ec28a7ad5a49
- SHA512 90e6eedca424e2ee37c78e0c0380db490c049b0378541812734c134510c40c6e4c48c4e213f395339ed99ff337ef087b6056ac5aafb246c1789ca6082dcabd2e
- SSDEEP 192:AOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:AVODaDSHMql3yqlxy5L1xcjwrlz3
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery execution
- Executes dropped EXE
behavioral4
- Target
  Malware-1-master/MEMZ-Destructive.exe
- Size 14KB
- SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
- MD5 19dbec50735b5f2a72d4199c4e184960
- SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
- SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
- SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware bootkit discovery persistence spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral5
- Target
  Malware-1-master/Software.exe
- Size 1.6MB
- SHA256 e7f04e85236f0caafe518bd96369313021969077dba1c4a6d42e694498dab04f
- MD5 db056b8fa628b67e11bd626192939d6b
- SHA1 248ca50f39de6b6180265d19fb6eedc68bf25afc
- SHA512 bca1856b4bb8342c0f6d5ee19edcb420c70e6b272f087d3f8f73daa00842fa00037840a5eb5655e1445af8d578d304874323b2889f75b27136df9366df596336
- SSDEEP 24576:ytb20pkaCqT5TBWgNQ7ayEYyM63uUOyok0ceJZwd/w9mML9eu4MaMUp46A:/Vg5tQ7ayExZO9k0waPLR4Ma25
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery imminent spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Imminent family
  imminent
- Drops startup file
- Suspicious use of SetThreadContext
behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Executes dropped EXE

Drops desktop.ini file(s)

Checks computer location settings

Executes dropped EXE

Checks computer location settings

Writes to the Master Boot Record (MBR)

Imminent RAT

Imminent family

Drops startup file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6