imminent | 11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8

General

Target

11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe
Size

272KB
MD5

df692dd54102d5fd8ade8ec6b9e6fc4e
SHA1

8f4e6256f03e398fd586296ab1cb6c91197f32e4
SHA256

11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8
SHA512

1447d8ba43e2bae92eed99e8b13fdf809fb712eac1664be92e61107b04a1ac83edc7172fe8ff6ab8d37e355ff692a0f7e7218b7268cd92ff7aa0e5130b50fbf0

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 1 IoCs

pid	Process
1304	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe

Loads dropped DLL 2 IoCs

pid	Process
2008	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe
2008	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
596	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1304	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe
Token: SeDebugPrivilege	1304	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe
Token: SeDebugPrivilege	1304	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1304	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1304	2008	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe	28
PID 2008 wrote to memory of 1304	2008	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe	28
PID 2008 wrote to memory of 1304	2008	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe	28
PID 2008 wrote to memory of 1304	2008	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe	28
PID 2008 wrote to memory of 1360	2008	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe	31
PID 2008 wrote to memory of 1360	2008	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe	31
PID 2008 wrote to memory of 1360	2008	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe	31
PID 2008 wrote to memory of 1360	2008	11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe	31
PID 1360 wrote to memory of 596	1360	cmd.exe	30
PID 1360 wrote to memory of 596	1360	cmd.exe	30
PID 1360 wrote to memory of 596	1360	cmd.exe	30
PID 1360 wrote to memory of 596	1360	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe
"C:\Users\Admin\AppData\Local\Temp\11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8\11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe
  "C:\Users\Admin\AppData\Local\Temp\11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8\11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1304
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1360

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 1000
1⤵
- Runs ping.exe
PID:596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
60KB

MD5
308336e7f515478969b24c13ded11ede

SHA1
8fb0cf42b77dbbef224a1e5fc38abc2486320775

SHA256
889b832323726a9f10ad03f85562048fdcfe20c9ff6f9d37412cf477b4e92ff9

SHA512
61ad97228cd6c3909ef3ac5e4940199971f293bdd0d5eb7916e60469573a44b6287c0fa1e0b6c1389df35eb6c9a7d2a61fdb318d4a886a3821ef5a9dab3ac24f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f86605940d39e4a1b0505e7b6f5879aa

SHA1
1848a5e71a0d840f2ef06162483fc4aa240f9d7b

SHA256
ba18260e6a6bde43ecea80c7e58b53caa1b5a818abe25a8aff0e481e4943b6ba

SHA512
efbdb5951a29c56d8725b7a2659743aef4ca33988bffa8ea1f748b5acb8ddc5b9c07a47886a996e00a75818dbbd127bb41efaaed798918d4f1cb1cbb5a124049

Download Submit
C:\Users\Admin\AppData\Local\Temp\11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8\11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe

Filesize
272KB

MD5
df692dd54102d5fd8ade8ec6b9e6fc4e

SHA1
8f4e6256f03e398fd586296ab1cb6c91197f32e4

SHA256
11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8

SHA512
1447d8ba43e2bae92eed99e8b13fdf809fb712eac1664be92e61107b04a1ac83edc7172fe8ff6ab8d37e355ff692a0f7e7218b7268cd92ff7aa0e5130b50fbf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8\11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe

Filesize
272KB

MD5
df692dd54102d5fd8ade8ec6b9e6fc4e

SHA1
8f4e6256f03e398fd586296ab1cb6c91197f32e4

SHA256
11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8

SHA512
1447d8ba43e2bae92eed99e8b13fdf809fb712eac1664be92e61107b04a1ac83edc7172fe8ff6ab8d37e355ff692a0f7e7218b7268cd92ff7aa0e5130b50fbf0

Download Submit
\Users\Admin\AppData\Local\Temp\11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8\11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe

Filesize
272KB

MD5
df692dd54102d5fd8ade8ec6b9e6fc4e

SHA1
8f4e6256f03e398fd586296ab1cb6c91197f32e4

SHA256
11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8

SHA512
1447d8ba43e2bae92eed99e8b13fdf809fb712eac1664be92e61107b04a1ac83edc7172fe8ff6ab8d37e355ff692a0f7e7218b7268cd92ff7aa0e5130b50fbf0

Download Submit
\Users\Admin\AppData\Local\Temp\11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8\11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8.exe

Filesize
272KB

MD5
df692dd54102d5fd8ade8ec6b9e6fc4e

SHA1
8f4e6256f03e398fd586296ab1cb6c91197f32e4

SHA256
11b673abcfd670bb61dfb829828acb46c991ba5419410bdc8c9023ae16969ae8

SHA512
1447d8ba43e2bae92eed99e8b13fdf809fb712eac1664be92e61107b04a1ac83edc7172fe8ff6ab8d37e355ff692a0f7e7218b7268cd92ff7aa0e5130b50fbf0

Download Submit
memory/1304-79-0x0000000072410000-0x0000000072FEE000-memory.dmp

Filesize
11.9MB

Download
memory/1304-72-0x0000000072FF0000-0x000000007378C000-memory.dmp

Filesize
7.6MB

Download
memory/1304-86-0x0000000074640000-0x0000000074731000-memory.dmp

Filesize
964KB

Download
memory/1304-85-0x0000000071ED0000-0x0000000072406000-memory.dmp

Filesize
5.2MB

Download
memory/1304-76-0x0000000074E10000-0x00000000753BB000-memory.dmp

Filesize
5.7MB

Download
memory/1304-84-0x0000000073790000-0x0000000074288000-memory.dmp

Filesize
11.0MB

Download
memory/1304-83-0x0000000074E10000-0x00000000753BB000-memory.dmp

Filesize
5.7MB

Download
memory/1304-82-0x00000000748D0000-0x0000000074A6B000-memory.dmp

Filesize
1.6MB

Download
memory/1304-81-0x0000000072FF0000-0x000000007378C000-memory.dmp

Filesize
7.6MB

Download
memory/1304-77-0x0000000073790000-0x0000000074288000-memory.dmp

Filesize
11.0MB

Download
memory/1304-73-0x00000000748D0000-0x0000000074A6B000-memory.dmp

Filesize
1.6MB

Download
memory/1304-80-0x0000000074640000-0x0000000074731000-memory.dmp

Filesize
964KB

Download
memory/1304-78-0x0000000074740000-0x00000000748C8000-memory.dmp

Filesize
1.5MB

Download
memory/2008-69-0x0000000072FF0000-0x000000007378C000-memory.dmp

Filesize
7.6MB

Download
memory/2008-75-0x0000000072410000-0x0000000072FEE000-memory.dmp

Filesize
11.9MB

Download
memory/2008-54-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

Filesize
8KB

Download
memory/2008-74-0x0000000074740000-0x00000000748C8000-memory.dmp

Filesize
1.5MB

Download
memory/2008-71-0x0000000073790000-0x0000000074288000-memory.dmp

Filesize
11.0MB

Download
memory/2008-70-0x00000000748D0000-0x0000000074A6B000-memory.dmp

Filesize
1.6MB

Download
memory/2008-55-0x0000000074E10000-0x00000000753BB000-memory.dmp

Filesize
5.7MB

Download
memory/2008-68-0x0000000074E10000-0x00000000753BB000-memory.dmp

Filesize
5.7MB

Download
memory/2008-56-0x0000000073790000-0x0000000074288000-memory.dmp

Filesize
11.0MB

Download
memory/2008-57-0x00000000748D0000-0x0000000074A6B000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing