Analysis

  • max time kernel
    160s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    15-06-2022 07:02

General

  • Target

    2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe

  • Size

    905KB

  • MD5

    aaee5f473ed1f17be96f642f9e4058bc

  • SHA1

    6a59a9dc5e92e9cfeb5e93f71410fe2a146640a8

  • SHA256

    2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723

  • SHA512

    6902e5b160dea23257eca5fa10e407fc436a3f181922c76023d09803c55efa74e77484a39f2e083da716616da35f85ed2090073867eba53bcbe53e2bfcab1da7

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops startup file 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe
    "C:\Users\Admin\AppData\Local\Temp\2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1796
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:3904

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1796-132-0x0000000000000000-mapping.dmp

    • memory/1796-133-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/1796-139-0x00000000069B0000-0x0000000006A4C000-memory.dmp

      Filesize

      624KB

    • memory/1796-140-0x0000000007000000-0x00000000075A4000-memory.dmp

      Filesize

      5.6MB

    • memory/1796-141-0x0000000006C30000-0x0000000006CC2000-memory.dmp

      Filesize

      584KB

    • memory/1796-142-0x0000000007620000-0x0000000007686000-memory.dmp

      Filesize

      408KB

    • memory/1796-143-0x0000000007D10000-0x0000000007D1A000-memory.dmp

      Filesize

      40KB

    • memory/3444-130-0x0000000000030000-0x0000000000221000-memory.dmp

      Filesize

      1.9MB

    • memory/3444-131-0x0000000000030000-0x0000000000221000-memory.dmp

      Filesize

      1.9MB

    • memory/3444-138-0x0000000000030000-0x0000000000221000-memory.dmp

      Filesize

      1.9MB