imminent | 0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9

General

Target

0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe
Size

321KB
MD5

0d32cf9f79dc145a823d56d7964829e0
SHA1

d487f0256c01dd8e5d950a6b0adf1c54e36fd934
SHA256

0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9
SHA512

8474e550702efa4d671cca9ce2c6367ab32369b1ead5dd2d08d8ef8389277b034d23e97f4bf6baa8af898784285d47ef0e58ea1ae59b33dc05c9f218c1d51553

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 1 IoCs

pid	Process
624	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe

Loads dropped DLL 2 IoCs

pid	Process
1504	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe
1504	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchosl = "\\svchosl\\svchosl.exe"	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchosl = "C:\\Users\\Admin\\AppData\\Roaming\\svchosl\\svchosl.exe"	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1800	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1504	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe
1504	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe
624	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe
624	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe
624	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
624	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe
Token: SeDebugPrivilege	624	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe
Token: 33	624	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe
Token: SeIncBasePriorityPrivilege	624	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
624	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 624	1504	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe	28
PID 1504 wrote to memory of 624	1504	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe	28
PID 1504 wrote to memory of 624	1504	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe	28
PID 1504 wrote to memory of 624	1504	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe	28
PID 1504 wrote to memory of 1728	1504	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe	29
PID 1504 wrote to memory of 1728	1504	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe	29
PID 1504 wrote to memory of 1728	1504	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe	29
PID 1504 wrote to memory of 1728	1504	0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe	29
PID 1728 wrote to memory of 1800	1728	cmd.exe	31
PID 1728 wrote to memory of 1800	1728	cmd.exe	31
PID 1728 wrote to memory of 1800	1728	cmd.exe	31
PID 1728 wrote to memory of 1800	1728	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe
"C:\Users\Admin\AppData\Local\Temp\0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9\0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe
  "C:\Users\Admin\AppData\Local\Temp\0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9\0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 1000
    3⤵
    - Runs ping.exe
    PID:1800

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9\0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe

Filesize
321KB

MD5
0d32cf9f79dc145a823d56d7964829e0

SHA1
d487f0256c01dd8e5d950a6b0adf1c54e36fd934

SHA256
0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9

SHA512
8474e550702efa4d671cca9ce2c6367ab32369b1ead5dd2d08d8ef8389277b034d23e97f4bf6baa8af898784285d47ef0e58ea1ae59b33dc05c9f218c1d51553

Download Submit
C:\Users\Admin\AppData\Local\Temp\0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9\0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe

Filesize
321KB

MD5
0d32cf9f79dc145a823d56d7964829e0

SHA1
d487f0256c01dd8e5d950a6b0adf1c54e36fd934

SHA256
0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9

SHA512
8474e550702efa4d671cca9ce2c6367ab32369b1ead5dd2d08d8ef8389277b034d23e97f4bf6baa8af898784285d47ef0e58ea1ae59b33dc05c9f218c1d51553

Download Submit
\Users\Admin\AppData\Local\Temp\0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9\0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe

Filesize
321KB

MD5
0d32cf9f79dc145a823d56d7964829e0

SHA1
d487f0256c01dd8e5d950a6b0adf1c54e36fd934

SHA256
0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9

SHA512
8474e550702efa4d671cca9ce2c6367ab32369b1ead5dd2d08d8ef8389277b034d23e97f4bf6baa8af898784285d47ef0e58ea1ae59b33dc05c9f218c1d51553

Download Submit
\Users\Admin\AppData\Local\Temp\0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9\0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9.exe

Filesize
321KB

MD5
0d32cf9f79dc145a823d56d7964829e0

SHA1
d487f0256c01dd8e5d950a6b0adf1c54e36fd934

SHA256
0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9

SHA512
8474e550702efa4d671cca9ce2c6367ab32369b1ead5dd2d08d8ef8389277b034d23e97f4bf6baa8af898784285d47ef0e58ea1ae59b33dc05c9f218c1d51553

Download Submit
memory/624-93-0x0000000072C60000-0x0000000073758000-memory.dmp

Filesize
11.0MB

Download
memory/624-92-0x0000000074500000-0x0000000074AAB000-memory.dmp

Filesize
5.7MB

Download
memory/624-91-0x0000000071D70000-0x0000000071E61000-memory.dmp

Filesize
964KB

Download
memory/624-90-0x0000000072080000-0x0000000072C5E000-memory.dmp

Filesize
11.9MB

Download
memory/624-89-0x00000000714D0000-0x000000007150A000-memory.dmp

Filesize
232KB

Download
memory/624-87-0x0000000071830000-0x0000000071D66000-memory.dmp

Filesize
5.2MB

Download
memory/624-94-0x0000000073BE0000-0x000000007437C000-memory.dmp

Filesize
7.6MB

Download
memory/624-95-0x0000000071EE0000-0x000000007207B000-memory.dmp

Filesize
1.6MB

Download
memory/624-81-0x0000000072080000-0x0000000072C5E000-memory.dmp

Filesize
11.9MB

Download
memory/624-96-0x0000000071720000-0x0000000071824000-memory.dmp

Filesize
1.0MB

Download
memory/624-97-0x00000000714D0000-0x000000007150A000-memory.dmp

Filesize
232KB

Download
memory/624-88-0x0000000071720000-0x0000000071824000-memory.dmp

Filesize
1.0MB

Download
memory/624-86-0x0000000071EE0000-0x000000007207B000-memory.dmp

Filesize
1.6MB

Download
memory/624-85-0x0000000073BE0000-0x000000007437C000-memory.dmp

Filesize
7.6MB

Download
memory/624-84-0x0000000072C60000-0x0000000073758000-memory.dmp

Filesize
11.0MB

Download
memory/624-83-0x0000000074500000-0x0000000074AAB000-memory.dmp

Filesize
5.7MB

Download
memory/624-76-0x0000000073A50000-0x0000000073BD8000-memory.dmp

Filesize
1.5MB

Download
memory/624-82-0x0000000071D70000-0x0000000071E61000-memory.dmp

Filesize
964KB

Download
memory/1504-64-0x0000000071430000-0x000000007146A000-memory.dmp

Filesize
232KB

Download
memory/1504-61-0x0000000071D70000-0x0000000071E61000-memory.dmp

Filesize
964KB

Download
memory/1504-79-0x0000000071720000-0x0000000071824000-memory.dmp

Filesize
1.0MB

Download
memory/1504-78-0x0000000071EE0000-0x000000007207B000-memory.dmp

Filesize
1.6MB

Download
memory/1504-77-0x0000000072080000-0x0000000072C5E000-memory.dmp

Filesize
11.9MB

Download
memory/1504-75-0x0000000073BE0000-0x000000007437C000-memory.dmp

Filesize
7.6MB

Download
memory/1504-74-0x0000000072C60000-0x0000000073758000-memory.dmp

Filesize
11.0MB

Download
memory/1504-73-0x0000000074500000-0x0000000074AAB000-memory.dmp

Filesize
5.7MB

Download
memory/1504-55-0x0000000074500000-0x0000000074AAB000-memory.dmp

Filesize
5.7MB

Download
memory/1504-56-0x0000000072C60000-0x0000000073758000-memory.dmp

Filesize
11.0MB

Download
memory/1504-54-0x0000000075271000-0x0000000075273000-memory.dmp

Filesize
8KB

Download
memory/1504-63-0x0000000071720000-0x0000000071824000-memory.dmp

Filesize
1.0MB

Download
memory/1504-62-0x0000000071830000-0x0000000071D66000-memory.dmp

Filesize
5.2MB

Download
memory/1504-80-0x0000000071430000-0x000000007146A000-memory.dmp

Filesize
232KB

Download
memory/1504-60-0x0000000071EE0000-0x000000007207B000-memory.dmp

Filesize
1.6MB

Download
memory/1504-59-0x0000000072080000-0x0000000072C5E000-memory.dmp

Filesize
11.9MB

Download
memory/1504-58-0x0000000073A50000-0x0000000073BD8000-memory.dmp

Filesize
1.5MB

Download
memory/1504-57-0x0000000073BE0000-0x000000007437C000-memory.dmp

Filesize
7.6MB

Download

Analysis

Sharing