imminent | 4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c

General

Target

4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
Size

669KB
MD5

10349a36cbd8aa3a5f13b3a591432218
SHA1

236083b08295a9ecfbc43f5c603d752f6b9ed868
SHA256

4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c
SHA512

cc0a78ff92497f9546fa13ca509135d874c23f3843efa5050345c8f691062184bfb7931fda958731d675a77c96f271f2b25d0a603547decef403f987f673d4b3

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 1 IoCs

pid	Process
920	svhost.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe.lnk	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	svhost.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	svhost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1256 set thread context of 920	1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe	93

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	svhost.exe
File created	C:\Windows\assembly\Desktop.ini	svhost.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	svhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Windows\svchost.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
920	svhost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
Token: SeDebugPrivilege	920	svhost.exe
Token: 33	920	svhost.exe
Token: SeIncBasePriorityPrivilege	920	svhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
920	svhost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 4976	1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe	90
PID 1256 wrote to memory of 4976	1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe	90
PID 1256 wrote to memory of 4976	1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe	90
PID 4976 wrote to memory of 4304	4976	cmd.exe	92
PID 4976 wrote to memory of 4304	4976	cmd.exe	92
PID 4976 wrote to memory of 4304	4976	cmd.exe	92
PID 1256 wrote to memory of 920	1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe	93
PID 1256 wrote to memory of 920	1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe	93
PID 1256 wrote to memory of 920	1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe	93
PID 1256 wrote to memory of 920	1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe	93
PID 1256 wrote to memory of 920	1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe	93
PID 1256 wrote to memory of 920	1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe	93
PID 1256 wrote to memory of 920	1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe	93
PID 1256 wrote to memory of 920	1256	4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe	93

C:\Users\Admin\AppData\Local\Temp\4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe
"C:\Users\Admin\AppData\Local\Temp\4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe"
  2⤵
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Windows\svchost.exe.lnk" /f
    3⤵
    PID:4304
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:920

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Windows\svchost.exe

Filesize
669KB

MD5
10349a36cbd8aa3a5f13b3a591432218

SHA1
236083b08295a9ecfbc43f5c603d752f6b9ed868

SHA256
4584d37d138cbd2a0909c36485aa0ccd3b513a169aee5a486d7210a84f62f36c

SHA512
cc0a78ff92497f9546fa13ca509135d874c23f3843efa5050345c8f691062184bfb7931fda958731d675a77c96f271f2b25d0a603547decef403f987f673d4b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
89KB

MD5
84c42d0f2c1ae761bef884638bc1eacd

SHA1
4353881e7f4e9c7610f4e0489183b55bb58bb574

SHA256
331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3

SHA512
43c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
89KB

MD5
84c42d0f2c1ae761bef884638bc1eacd

SHA1
4353881e7f4e9c7610f4e0489183b55bb58bb574

SHA256
331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3

SHA512
43c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87

Download Submit
memory/920-139-0x0000000075520000-0x0000000075AD1000-memory.dmp

Filesize
5.7MB

Download
memory/920-140-0x0000000075520000-0x0000000075AD1000-memory.dmp

Filesize
5.7MB

Download
memory/1256-130-0x0000000075520000-0x0000000075AD1000-memory.dmp

Filesize
5.7MB

Download
memory/1256-131-0x0000000075520000-0x0000000075AD1000-memory.dmp

Filesize
5.7MB

Download
memory/1256-141-0x0000000075520000-0x0000000075AD1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing