Analysis

  • max time kernel
    152s
  • max time network
    203s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    16-06-2022 03:10

General

  • Target

    27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe

  • Size

    336KB

  • MD5

    084d86609587defbde124a4fd9c49d50

  • SHA1

    5ddc40700124f0cd860eaa67dd54124ca4dfd99a

  • SHA256

    27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08

  • SHA512

    45b40a29904d8bccfbbab3eda38dfad4f4691f62cb974cfb32d6f1517e3a927d4be3b808ee26bbb39749b874c8ed71bbb49d93d55ee7ba7ec62654fe3c12a8e8

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe
    "C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1332
    • C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe
      "C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe
        "C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4760
        • C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe
          "C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe"
          4⤵
          • Executes dropped EXE
          PID:3368
        • C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe
          "C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe"
          4⤵
            PID:2032
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5036
          • C:\Windows\SysWOW64\PING.EXE
            ping 1.1.1.1 -n 1 -w 1000
            4⤵
            • Runs ping.exe
            PID:888
      • C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe
        "C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe"
        2⤵
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2396

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe.log

      Filesize

      319B

      MD5

      824ba7b7eed8b900a98dd25129c4cd83

      SHA1

      54478770b2158000ef365591d42977cb854453a1

      SHA256

      d182dd648c92e41cd62dccc65f130c07f0a96c03b32f907c3d1218e9aa5bda03

      SHA512

      ae4f3a9673711ecb6cc5d06874c587341d5094803923b53b6e982278fa64549d7acf866de165e23750facd55da556b6794c0d32f129f4087529c73acd4ffb11e

    • C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe

      Filesize

      336KB

      MD5

      084d86609587defbde124a4fd9c49d50

      SHA1

      5ddc40700124f0cd860eaa67dd54124ca4dfd99a

      SHA256

      27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08

      SHA512

      45b40a29904d8bccfbbab3eda38dfad4f4691f62cb974cfb32d6f1517e3a927d4be3b808ee26bbb39749b874c8ed71bbb49d93d55ee7ba7ec62654fe3c12a8e8

    • C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe

      Filesize

      336KB

      MD5

      084d86609587defbde124a4fd9c49d50

      SHA1

      5ddc40700124f0cd860eaa67dd54124ca4dfd99a

      SHA256

      27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08

      SHA512

      45b40a29904d8bccfbbab3eda38dfad4f4691f62cb974cfb32d6f1517e3a927d4be3b808ee26bbb39749b874c8ed71bbb49d93d55ee7ba7ec62654fe3c12a8e8

    • C:\Users\Admin\AppData\Local\Temp\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08\27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08.exe

      Filesize

      336KB

      MD5

      084d86609587defbde124a4fd9c49d50

      SHA1

      5ddc40700124f0cd860eaa67dd54124ca4dfd99a

      SHA256

      27d674ed208ec0ab0a64df20a98b76d85cab116e788e59eb6dad97279b6eff08

      SHA512

      45b40a29904d8bccfbbab3eda38dfad4f4691f62cb974cfb32d6f1517e3a927d4be3b808ee26bbb39749b874c8ed71bbb49d93d55ee7ba7ec62654fe3c12a8e8

    • C:\Users\Admin\AppData\Local\Temp\tmpC2B.tmp

      Filesize

      381B

      MD5

      1e4a89b11eae0fcf8bb5fdd5ec3b6f61

      SHA1

      4260284ce14278c397aaf6f389c1609b0ab0ce51

      SHA256

      4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df

      SHA512

      8c290919e456a80d87dd6d243e4713945432b9a2bc158bfa5b81ae9fed1a8dd693da51914fa4014c5b8596e36186a9c891741c3b9011958c7ac240b7d818f815

    • C:\Users\Admin\AppData\Roaming\Imminent\PID.dat

      Filesize

      4B

      MD5

      dcf6070a4ab7f3afbfd2809173e0824b

      SHA1

      d045236a0e03750520fa4d9cfa962fd38f11217d

      SHA256

      8b49203c3d36d3f6a4fbed148162c634b262a92a5b6442e27fef3bb62c7526fe

      SHA512

      a1ab733965c77da7c227754f8d2084c821c590568a288f4403659f8c5b6d01152b6d2e06581b9fb9ea5a8f9938842aebb6f381eb9d6bfb62e4a08719ba16389a

    • memory/888-141-0x0000000000000000-mapping.dmp

    • memory/940-134-0x00000000746B0000-0x0000000074C61000-memory.dmp

      Filesize

      5.7MB

    • memory/940-133-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/940-132-0x0000000000000000-mapping.dmp

    • memory/940-140-0x00000000746B0000-0x0000000074C61000-memory.dmp

      Filesize

      5.7MB

    • memory/1332-130-0x00000000746B0000-0x0000000074C61000-memory.dmp

      Filesize

      5.7MB

    • memory/1332-131-0x00000000746B0000-0x0000000074C61000-memory.dmp

      Filesize

      5.7MB

    • memory/2032-158-0x0000000000000000-mapping.dmp

    • memory/2396-142-0x0000000000000000-mapping.dmp

    • memory/2396-147-0x00000000746B0000-0x0000000074C61000-memory.dmp

      Filesize

      5.7MB

    • memory/2396-145-0x00000000746B0000-0x0000000074C61000-memory.dmp

      Filesize

      5.7MB

    • memory/3368-154-0x0000000000000000-mapping.dmp

    • memory/3368-157-0x00000000746B0000-0x0000000074C61000-memory.dmp

      Filesize

      5.7MB

    • memory/4760-146-0x00000000746B0000-0x0000000074C61000-memory.dmp

      Filesize

      5.7MB

    • memory/4760-149-0x0000000005480000-0x0000000005489000-memory.dmp

      Filesize

      36KB

    • memory/4760-150-0x0000000005480000-0x0000000005489000-memory.dmp

      Filesize

      36KB

    • memory/4760-151-0x0000000005480000-0x0000000005489000-memory.dmp

      Filesize

      36KB

    • memory/4760-152-0x0000000005480000-0x0000000005489000-memory.dmp

      Filesize

      36KB

    • memory/4760-139-0x00000000746B0000-0x0000000074C61000-memory.dmp

      Filesize

      5.7MB

    • memory/4760-135-0x0000000000000000-mapping.dmp

    • memory/5036-138-0x0000000000000000-mapping.dmp