Malware Analysis Report

2025-05-05 21:53

Sample ID 220122-bkb3asgfdr
Target a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0
SHA256 a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0
Tags
imminent persistence spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0

Threat Level: Known bad

The file a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0 was found to be: Known bad.

Malicious Activity Summary

imminent persistence spyware trojan

Modifies WinLogon for persistence

Imminent RAT

Executes dropped EXE

Loads dropped DLL

Deletes itself

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-22 01:11

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-22 01:11

Reported

2022-01-22 06:00

Platform

win7-en-20211208

Max time kernel

155s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe"

Signatures

Imminent RAT

trojan spyware imminent

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\j68QmrzfeBZIXLKG\\dEx1TdOVUAJc.exe\",explorer.exe" C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\j68QmrzfeBZIXLKG\\btscqmOwyEV5.exe\",explorer.exe" C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinStartup = "C:\\Users\\Admin\\AppData\\Roaming\\WinStartup\\WinHostProcess.exe" C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1296 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe
PID 1296 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe
PID 1296 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe
PID 1296 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe
PID 1296 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe C:\Windows\SysWOW64\cmd.exe
PID 1296 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe C:\Windows\SysWOW64\cmd.exe
PID 1296 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe C:\Windows\SysWOW64\cmd.exe
PID 1296 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe C:\Windows\SysWOW64\cmd.exe
PID 1868 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1868 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1868 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1868 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe

"C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe"

C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe

"C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe"

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 1000

Network

Country Destination Domain Proto
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp

Files

memory/1296-54-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

memory/1296-55-0x00000000022E0000-0x00000000022E1000-memory.dmp

memory/1296-56-0x00000000022E5000-0x00000000022F6000-memory.dmp

memory/1296-57-0x00000000022F6000-0x00000000022F7000-memory.dmp

\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe

MD5 96aaf9d1fb5128f7bf74af569c547a71
SHA1 078621841d45a72b5db5c45bb0bc8872d051acaa
SHA256 a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0
SHA512 ab14e9cb092e5998125c3c2673c32cf1ff4b544bd56acf49d4f0763d3ccde05f72d0e7c3573ef169ed4d40dc779419fd01be4490039c0e9eac459768d80234c1

C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe

MD5 96aaf9d1fb5128f7bf74af569c547a71
SHA1 078621841d45a72b5db5c45bb0bc8872d051acaa
SHA256 a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0
SHA512 ab14e9cb092e5998125c3c2673c32cf1ff4b544bd56acf49d4f0763d3ccde05f72d0e7c3573ef169ed4d40dc779419fd01be4490039c0e9eac459768d80234c1

C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe

MD5 96aaf9d1fb5128f7bf74af569c547a71
SHA1 078621841d45a72b5db5c45bb0bc8872d051acaa
SHA256 a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0
SHA512 ab14e9cb092e5998125c3c2673c32cf1ff4b544bd56acf49d4f0763d3ccde05f72d0e7c3573ef169ed4d40dc779419fd01be4490039c0e9eac459768d80234c1

memory/1384-62-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

memory/1384-63-0x0000000000AA5000-0x0000000000AB6000-memory.dmp

memory/1384-64-0x0000000000AB6000-0x0000000000AB7000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-22 01:11

Reported

2022-01-22 06:01

Platform

win10-en-20211208

Max time kernel

185s

Max time network

202s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe"

Signatures

Imminent RAT

trojan spyware imminent

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\j68QmrzfeBZIXLKG\\xQpCQkLTQRdG.exe\",explorer.exe" C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\j68QmrzfeBZIXLKG\\wAyAKDBBAkt6.exe\",explorer.exe" C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinStartup = "C:\\Users\\Admin\\AppData\\Roaming\\WinStartup\\WinHostProcess.exe" C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1856 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe
PID 1856 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe
PID 1856 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe
PID 1856 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe C:\Windows\SysWOW64\cmd.exe
PID 1856 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe C:\Windows\SysWOW64\cmd.exe
PID 1856 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe C:\Windows\SysWOW64\cmd.exe
PID 1072 wrote to memory of 692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1072 wrote to memory of 692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1072 wrote to memory of 692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe

"C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe"

C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe

"C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe"

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 1000

Network

Country Destination Domain Proto
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
US 8.238.20.254:80 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
US 8.238.20.254:80 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp
CA 184.75.209.157:55164 tcp

Files

memory/1856-115-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

memory/1856-116-0x0000000002DB3000-0x0000000002DB5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe

MD5 96aaf9d1fb5128f7bf74af569c547a71
SHA1 078621841d45a72b5db5c45bb0bc8872d051acaa
SHA256 a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0
SHA512 ab14e9cb092e5998125c3c2673c32cf1ff4b544bd56acf49d4f0763d3ccde05f72d0e7c3573ef169ed4d40dc779419fd01be4490039c0e9eac459768d80234c1

C:\Users\Admin\AppData\Local\Temp\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0\a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0.exe

MD5 96aaf9d1fb5128f7bf74af569c547a71
SHA1 078621841d45a72b5db5c45bb0bc8872d051acaa
SHA256 a633aeabdd9695dfff9ce5c5a350a6b9af55e9fb88a5ed3c3c150b4bceeb5cc0
SHA512 ab14e9cb092e5998125c3c2673c32cf1ff4b544bd56acf49d4f0763d3ccde05f72d0e7c3573ef169ed4d40dc779419fd01be4490039c0e9eac459768d80234c1

memory/3412-119-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

memory/3412-120-0x0000000002CF3000-0x0000000002CF5000-memory.dmp