imminent | 30449bfeadea349eaf0db0fe35c8f03a2045c4e11c2f2f96b7e12eb1ac95f16f | Triage

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21/06/2022, 15:35

Sharing

Report Analysis Logs

General

Target

30449bfeadea349eaf0db0fe35c8f03a2045c4e11c2f2f96b7e12eb1ac95f16f.exe
Size

324KB
MD5

7366fd7818e4a03712721d61a3229d3c
SHA1

452f53623d0b7a1045a72fe00e8a2d6077d4c8a1
SHA256

30449bfeadea349eaf0db0fe35c8f03a2045c4e11c2f2f96b7e12eb1ac95f16f
SHA512

4994afa27896fb4304980474ff0a5d064ebfc5294bbc5f56f5c84113cbb368e31879a2e13aa23ee5a2b64b0232d33b2f84e23c9cefef436a76a3decd88207884

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	30449bfeadea349eaf0db0fe35c8f03a2045c4e11c2f2f96b7e12eb1ac95f16f.exe
File created	C:\Windows\assembly\Desktop.ini	30449bfeadea349eaf0db0fe35c8f03a2045c4e11c2f2f96b7e12eb1ac95f16f.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	30449bfeadea349eaf0db0fe35c8f03a2045c4e11c2f2f96b7e12eb1ac95f16f.exe
File created	C:\Windows\assembly\Desktop.ini	30449bfeadea349eaf0db0fe35c8f03a2045c4e11c2f2f96b7e12eb1ac95f16f.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	30449bfeadea349eaf0db0fe35c8f03a2045c4e11c2f2f96b7e12eb1ac95f16f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4624	30449bfeadea349eaf0db0fe35c8f03a2045c4e11c2f2f96b7e12eb1ac95f16f.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	30449bfeadea349eaf0db0fe35c8f03a2045c4e11c2f2f96b7e12eb1ac95f16f.exe
Token: 33	4624	30449bfeadea349eaf0db0fe35c8f03a2045c4e11c2f2f96b7e12eb1ac95f16f.exe
Token: SeIncBasePriorityPrivilege	4624	30449bfeadea349eaf0db0fe35c8f03a2045c4e11c2f2f96b7e12eb1ac95f16f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4624	30449bfeadea349eaf0db0fe35c8f03a2045c4e11c2f2f96b7e12eb1ac95f16f.exe

C:\Users\Admin\AppData\Local\Temp\30449bfeadea349eaf0db0fe35c8f03a2045c4e11c2f2f96b7e12eb1ac95f16f.exe
"C:\Users\Admin\AppData\Local\Temp\30449bfeadea349eaf0db0fe35c8f03a2045c4e11c2f2f96b7e12eb1ac95f16f.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4624

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4624-130-0x0000000074770000-0x0000000074D21000-memory.dmp

Filesize
5.7MB

Download
memory/4624-131-0x0000000074770000-0x0000000074D21000-memory.dmp

Filesize
5.7MB

Download