Overview

overview

10

Static

static

1

imcool.bat

windows10-2004-x64

imcool.bat

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    imcool.bat
  • Size 3KB
  • Sample260802-b7c8wa1wes
  • SHA256 b55a46028c28e6df6c7b9c7e47e6189b0b900907737e6f19b5cf024309542377
  • MD5 SHA1 SHA512 TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistencetrojan

Malware Config

Targets

    • Target
      imcool.bat
    • Size 3KB
    • SHA256 b55a46028c28e6df6c7b9c7e47e6189b0b900907737e6f19b5cf024309542377
    • MD5 SHA1 SHA512 TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionpersistencetrojan

    • UAC bypass

      defense_evasiontrojan

    • Disables RegEdit via registry modification

      defense_evasion

    • Disables Task Manager via registry modification

      defense_evasion

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Modifies file permissions

      discovery

    • Creates a new local user account

      Uses net.exe to create a new local user account, often for persistence or a backdoor account.

      persistence

    • Drops file in System32 directory

    • Modifies termsrv.dll

      Commonly used to allow simultaneous RDP sessions.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks