Overview

overview

10

Static

static

5

391239c707...a7.exe

windows7_x64

10

391239c707...a7.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25-06-2022 17:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    391239c70724940871a1257de67bdd596f62457a0059395198dda22f6da542a7.exe

  • Size

    1.5MB

  • MD5

    b56c15d84914a2f6531fa7644f0843a4

  • SHA1

    a293b6868a0b82621e94be1266d09c49f1ff7e0b

  • SHA256

    391239c70724940871a1257de67bdd596f62457a0059395198dda22f6da542a7

  • SHA512

    0a97f8db4c61312def019c51605f330c027df1a100c09e16c668e5a3bc4bca82dfbf080e6509a284bebcdb1a6cfc20c7bd7315eb44a66af90bc7028c6f9137b7

Score
10/10
imminentspywaretrojan

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

    trojanspywareimminent
  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 2 IoCs
  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\391239c70724940871a1257de67bdd596f62457a0059395198dda22f6da542a7.exe
    "C:\Users\Admin\AppData\Local\Temp\391239c70724940871a1257de67bdd596f62457a0059395198dda22f6da542a7.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4264
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4608
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn 6874746268786F7677796467 /tr "C:\Users\Admin\AppData\Local\Temp\hznmfkfyjpbc\iqjsjzvckmye.exe" /sc minute /mo 1 /F
      2⤵
      • Creates scheduled task(s)
      PID:4980
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:3416
    • C:\Users\Admin\AppData\Local\Temp\hznmfkfyjpbc\iqjsjzvckmye.exe
      C:\Users\Admin\AppData\Local\Temp\hznmfkfyjpbc\iqjsjzvckmye.exe
      1⤵
      • Executes dropped EXE
      PID:1580
    • C:\Users\Admin\AppData\Local\Temp\hznmfkfyjpbc\iqjsjzvckmye.exe
      C:\Users\Admin\AppData\Local\Temp\hznmfkfyjpbc\iqjsjzvckmye.exe
      1⤵
      • Executes dropped EXE
      PID:2072
    • C:\Users\Admin\AppData\Local\Temp\hznmfkfyjpbc\iqjsjzvckmye.exe
      C:\Users\Admin\AppData\Local\Temp\hznmfkfyjpbc\iqjsjzvckmye.exe
      1⤵
      • Executes dropped EXE
      PID:1872

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\hznmfkfyjpbc\iqjsjzvckmye.exe
      Filesize

      1.5MB

      MD5

      b56c15d84914a2f6531fa7644f0843a4

      SHA1

      a293b6868a0b82621e94be1266d09c49f1ff7e0b

      SHA256

      391239c70724940871a1257de67bdd596f62457a0059395198dda22f6da542a7

      SHA512

      0a97f8db4c61312def019c51605f330c027df1a100c09e16c668e5a3bc4bca82dfbf080e6509a284bebcdb1a6cfc20c7bd7315eb44a66af90bc7028c6f9137b7

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\hznmfkfyjpbc\iqjsjzvckmye.exe
      Filesize

      1.5MB

      MD5

      b56c15d84914a2f6531fa7644f0843a4

      SHA1

      a293b6868a0b82621e94be1266d09c49f1ff7e0b

      SHA256

      391239c70724940871a1257de67bdd596f62457a0059395198dda22f6da542a7

      SHA512

      0a97f8db4c61312def019c51605f330c027df1a100c09e16c668e5a3bc4bca82dfbf080e6509a284bebcdb1a6cfc20c7bd7315eb44a66af90bc7028c6f9137b7

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\hznmfkfyjpbc\iqjsjzvckmye.exe
      Filesize

      1.5MB

      MD5

      b56c15d84914a2f6531fa7644f0843a4

      SHA1

      a293b6868a0b82621e94be1266d09c49f1ff7e0b

      SHA256

      391239c70724940871a1257de67bdd596f62457a0059395198dda22f6da542a7

      SHA512

      0a97f8db4c61312def019c51605f330c027df1a100c09e16c668e5a3bc4bca82dfbf080e6509a284bebcdb1a6cfc20c7bd7315eb44a66af90bc7028c6f9137b7

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\hznmfkfyjpbc\iqjsjzvckmye.exe
      Filesize

      1.5MB

      MD5

      b56c15d84914a2f6531fa7644f0843a4

      SHA1

      a293b6868a0b82621e94be1266d09c49f1ff7e0b

      SHA256

      391239c70724940871a1257de67bdd596f62457a0059395198dda22f6da542a7

      SHA512

      0a97f8db4c61312def019c51605f330c027df1a100c09e16c668e5a3bc4bca82dfbf080e6509a284bebcdb1a6cfc20c7bd7315eb44a66af90bc7028c6f9137b7

      Download Submit

    • memory/4608-134-0x0000000000400000-0x000000000045A000-memory.dmp

      Filesize

      360KB

      Download

    • memory/4608-140-0x00000000734B0000-0x0000000073A61000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/4608-141-0x00000000734B0000-0x0000000073A61000-memory.dmp

      Filesize

      5.7MB

      Download