Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    16-06-2022 08:56

General

  • Target

    264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe

  • Size

    1.0MB

  • MD5

    c0b375a5c4bcfc0a08699ad368de0b67

  • SHA1

    644ec97218b4b0b41e560a1e8f57221de1b3fbf5

  • SHA256

    264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

  • SHA512

    bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

Score
10/10

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Executes dropped EXE 2 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NTFS ADS 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe
    "C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe:Zone.Identifier"
      2⤵
      • NTFS ADS
      PID:1728
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe"
      2⤵
      • NTFS ADS
      PID:2028
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe"
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:852
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe:Zone.Identifier"
          4⤵
          • NTFS ADS
          PID:1072
        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe
          "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1884
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:1728

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe

      Filesize

      1.0MB

      MD5

      c0b375a5c4bcfc0a08699ad368de0b67

      SHA1

      644ec97218b4b0b41e560a1e8f57221de1b3fbf5

      SHA256

      264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

      SHA512

      bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe

      Filesize

      1.0MB

      MD5

      c0b375a5c4bcfc0a08699ad368de0b67

      SHA1

      644ec97218b4b0b41e560a1e8f57221de1b3fbf5

      SHA256

      264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

      SHA512

      bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe

      Filesize

      1.0MB

      MD5

      c0b375a5c4bcfc0a08699ad368de0b67

      SHA1

      644ec97218b4b0b41e560a1e8f57221de1b3fbf5

      SHA256

      264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

      SHA512

      bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

    • \Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe

      Filesize

      1.0MB

      MD5

      c0b375a5c4bcfc0a08699ad368de0b67

      SHA1

      644ec97218b4b0b41e560a1e8f57221de1b3fbf5

      SHA256

      264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

      SHA512

      bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

    • \Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe

      Filesize

      1.0MB

      MD5

      c0b375a5c4bcfc0a08699ad368de0b67

      SHA1

      644ec97218b4b0b41e560a1e8f57221de1b3fbf5

      SHA256

      264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

      SHA512

      bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

    • \Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\ScreenRotate.exe

      Filesize

      1.0MB

      MD5

      c0b375a5c4bcfc0a08699ad368de0b67

      SHA1

      644ec97218b4b0b41e560a1e8f57221de1b3fbf5

      SHA256

      264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

      SHA512

      bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

    • memory/852-62-0x0000000000000000-mapping.dmp

    • memory/852-64-0x00000000003D0000-0x00000000004E2000-memory.dmp

      Filesize

      1.1MB

    • memory/1072-66-0x0000000000000000-mapping.dmp

    • memory/1096-59-0x0000000000000000-mapping.dmp

    • memory/1728-57-0x0000000000000000-mapping.dmp

    • memory/1884-69-0x0000000000080000-0x00000000000D6000-memory.dmp

      Filesize

      344KB

    • memory/1884-75-0x0000000000451D1E-mapping.dmp

    • memory/1884-90-0x0000000001F40000-0x0000000001F56000-memory.dmp

      Filesize

      88KB

    • memory/1884-88-0x0000000000700000-0x0000000000728000-memory.dmp

      Filesize

      160KB

    • memory/1884-70-0x0000000000080000-0x00000000000D6000-memory.dmp

      Filesize

      344KB

    • memory/1884-72-0x0000000000080000-0x00000000000D6000-memory.dmp

      Filesize

      344KB

    • memory/1884-73-0x0000000000080000-0x00000000000D6000-memory.dmp

      Filesize

      344KB

    • memory/1884-74-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1884-87-0x0000000004880000-0x000000000492E000-memory.dmp

      Filesize

      696KB

    • memory/1884-86-0x00000000004F0000-0x0000000000500000-memory.dmp

      Filesize

      64KB

    • memory/1884-78-0x0000000000080000-0x00000000000D6000-memory.dmp

      Filesize

      344KB

    • memory/1884-77-0x0000000000080000-0x00000000000D6000-memory.dmp

      Filesize

      344KB

    • memory/1884-82-0x0000000000080000-0x00000000000D6000-memory.dmp

      Filesize

      344KB

    • memory/1884-85-0x0000000000080000-0x00000000000D6000-memory.dmp

      Filesize

      344KB

    • memory/1944-55-0x00000000003A0000-0x00000000003C2000-memory.dmp

      Filesize

      136KB

    • memory/1944-54-0x0000000000E20000-0x0000000000F32000-memory.dmp

      Filesize

      1.1MB

    • memory/1944-56-0x00000000753C1000-0x00000000753C3000-memory.dmp

      Filesize

      8KB

    • memory/2028-58-0x0000000000000000-mapping.dmp