Analysis

  • max time kernel
    169s
  • max time network
    116s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-06-2022 17:34

General

  • Target

    3009ba30b32ee1b30b5c1ff5545da20237bacb418b74578ae6cfaffaa786522b.exe

  • Size

    861KB

  • MD5

    4b95fa4786f5830cb7f0027f9d15adef

  • SHA1

    feca329eaf6fabae376a15cf6908c2171fb86393

  • SHA256

    3009ba30b32ee1b30b5c1ff5545da20237bacb418b74578ae6cfaffaa786522b

  • SHA512

    a712857ea1a0db3267644c07395662fe39ca0e519ca402e9c63dc1fa28c36f59b994700908cb3ea7d63437d7cc25bd0a8bfeffbb13364397eb570e94e4217a5a

Score
10/10

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3009ba30b32ee1b30b5c1ff5545da20237bacb418b74578ae6cfaffaa786522b.exe
    "C:\Users\Admin\AppData\Local\Temp\3009ba30b32ee1b30b5c1ff5545da20237bacb418b74578ae6cfaffaa786522b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\3009ba30b32ee1b30b5c1ff5545da20237bacb418b74578ae6cfaffaa786522b.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:632
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SzXipsZcwgn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8AA4.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:1792
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:932
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:548

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp8AA4.tmp

      Filesize

      1KB

      MD5

      a9338171b45140f38858428d30278082

      SHA1

      1f33a6dbeb2cb60a1d47f116492e890ec366ca36

      SHA256

      016876ac4eda3813361eb2808cabc5119cbfb93fb55766c064f24820f80456d3

      SHA512

      ea19b4b01d6b6d5fb2a162fc00521dfbd0585393f24117d3d361a38cc5e0c815a49b877d11624a65cc03f87522f7209d4544f0aab69fd22061bd9bafa6f54a4c

    • memory/632-60-0x0000000073FB0000-0x000000007455B000-memory.dmp

      Filesize

      5.7MB

    • memory/632-71-0x0000000073FB0000-0x000000007455B000-memory.dmp

      Filesize

      5.7MB

    • memory/632-56-0x0000000000000000-mapping.dmp

    • memory/632-59-0x0000000073FB0000-0x000000007455B000-memory.dmp

      Filesize

      5.7MB

    • memory/932-63-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/932-69-0x0000000000451E9E-mapping.dmp

    • memory/932-77-0x0000000073A00000-0x0000000073FAB000-memory.dmp

      Filesize

      5.7MB

    • memory/932-76-0x0000000073A00000-0x0000000073FAB000-memory.dmp

      Filesize

      5.7MB

    • memory/932-66-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/932-68-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/932-67-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/932-74-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/932-64-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/932-72-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1792-61-0x0000000000000000-mapping.dmp

    • memory/1832-55-0x0000000073FB0000-0x000000007455B000-memory.dmp

      Filesize

      5.7MB

    • memory/1832-54-0x0000000074F91000-0x0000000074F93000-memory.dmp

      Filesize

      8KB

    • memory/1832-58-0x0000000073FB0000-0x000000007455B000-memory.dmp

      Filesize

      5.7MB