imminent | 2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1

General

Target

2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
Size

1.2MB
MD5

eb125a1ea2711eb97c56351201daac4e
SHA1

43b99ea1bf5cdff58b1e7386f915bcb8813b679b
SHA256

2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1
SHA512

c35f23a4cd836dfad77d0ff58cd7c4c0f34eb1857daf4f1542e7257a8ca06ea6d610c72948c1a24e225d25bb8cc762e127a75a35bae30b5fabddcd393d4ac4ad

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5028 set thread context of 3736	5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe	81

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3736	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3736	RegSvcs.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3736	RegSvcs.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 3736	5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe	81
PID 5028 wrote to memory of 3736	5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe	81
PID 5028 wrote to memory of 3736	5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe	81
PID 5028 wrote to memory of 3736	5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe	81
PID 5028 wrote to memory of 3736	5028	2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe	81

C:\Users\Admin\AppData\Local\Temp\2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe
"C:\Users\Admin\AppData\Local\Temp\2522de66809256ee6b0b2662561ebb99c28da2866518cf07f3f1074438d243a1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3736-131-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3736-136-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3736-137-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3736-139-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3736-138-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3736-141-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3736-147-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3736-144-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3736-150-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3736-149-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3736-143-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3736-152-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3736-153-0x0000000005190000-0x000000000522C000-memory.dmp

Filesize
624KB

Download
memory/3736-154-0x0000000009EB0000-0x000000000A454000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing