Analysis

  • max time kernel
    153s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    22/01/2022, 01:10

General

  • Target

    a7dcdee5d981c3b94283137554445c6a32081a3ea4b9a32e70467d0bb36cc814.exe

  • Size

    1.4MB

  • MD5

    a87401f7224a349d9e93ffb98ba77f14

  • SHA1

    9b72bb09f33e4f58329bbd30289615f73283ca41

  • SHA256

    a7dcdee5d981c3b94283137554445c6a32081a3ea4b9a32e70467d0bb36cc814

  • SHA512

    dd0c898d77366ad0bc26e75486874c1987e6a21ec655c1a5d71b693b46c1ea8ade5143cc1637217bdd826f2d2fbd4e952fbbd8a830ab493b7e1b9f3c8d652290

Score
10/10

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Executes dropped EXE 2 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7dcdee5d981c3b94283137554445c6a32081a3ea4b9a32e70467d0bb36cc814.exe
    "C:\Users\Admin\AppData\Local\Temp\a7dcdee5d981c3b94283137554445c6a32081a3ea4b9a32e70467d0bb36cc814.exe"
    1⤵
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /TN "Update\60887b4d-0a73-4b81-9ce8-a6c9d424b9cc" /F
      2⤵
        PID:580
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Update\60887b4d-0a73-4b81-9ce8-a6c9d424b9cc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp409242927.tmp"
        2⤵
        • Creates scheduled task(s)
        PID:856
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /K "C:\Users\Admin\AppData\Roaming\Wfantaw.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1212
        • C:\Users\Admin\AppData\Roaming\Wfantaw.exe
          C:\Users\Admin\AppData\Roaming\Wfantaw.exe
          3⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1448
          • C:\Users\Admin\AppData\Roaming\Wfantaw.exe
            C:\Users\Admin\AppData\Roaming\Wfantaw.exe
            4⤵
            • Executes dropped EXE
            • Drops desktop.ini file(s)
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2196

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1016-115-0x0000000002540000-0x0000000002541000-memory.dmp

      Filesize

      4KB

    • memory/1016-117-0x0000000002544000-0x0000000002546000-memory.dmp

      Filesize

      8KB

    • memory/1016-116-0x0000000002541000-0x0000000002542000-memory.dmp

      Filesize

      4KB

    • memory/1212-128-0x0000000000D50000-0x0000000000D66000-memory.dmp

      Filesize

      88KB

    • memory/1212-133-0x0000000000B50000-0x0000000000B51000-memory.dmp

      Filesize

      4KB

    • memory/1212-132-0x0000000000B50000-0x0000000000B51000-memory.dmp

      Filesize

      4KB

    • memory/1212-131-0x0000000000D50000-0x0000000000D66000-memory.dmp

      Filesize

      88KB

    • memory/1212-130-0x0000000000D50000-0x0000000000D66000-memory.dmp

      Filesize

      88KB

    • memory/1212-129-0x0000000000D50000-0x0000000000D66000-memory.dmp

      Filesize

      88KB

    • memory/1448-122-0x0000000000DE0000-0x0000000000E8E000-memory.dmp

      Filesize

      696KB

    • memory/1448-124-0x000000000AAE0000-0x000000000AAE3000-memory.dmp

      Filesize

      12KB

    • memory/1448-123-0x0000000000DE0000-0x0000000000E8E000-memory.dmp

      Filesize

      696KB

    • memory/1448-121-0x0000000000DE0000-0x0000000000E8E000-memory.dmp

      Filesize

      696KB

    • memory/2196-126-0x0000000000D00000-0x0000000000E4A000-memory.dmp

      Filesize

      1.3MB