imminent | 42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a

General

Target

42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a.exe
Size

805KB
MD5

8b683771c162d0f751ec0eed59ab8471
SHA1

749e230bfaaab4e79aeab3ba5ca8e6cdc7bde183
SHA256

42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a
SHA512

bec4cf42857a7a217ec4f4e4cc99905eb9e69a560f6945869fa421b5cfcb7b4b4442385ff3ab758bced5db53f5472d1984a8e23a85cc28e54c8d8cdcfdfe78d2

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 1 IoCs

pid	Process
4980	llswni.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\llswni.exe	42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\llswni.exe	42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\llswni.exe -boot"	llswni.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	InstallUtil.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	InstallUtil.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4980 set thread context of 4488	4980	llswni.exe	93

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	llswni.exe
File opened for modification	C:\Windows\assembly	InstallUtil.exe
File created	C:\Windows\assembly\Desktop.ini	InstallUtil.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	InstallUtil.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	llswni.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2184	42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a.exe
Token: SeDebugPrivilege	4980	llswni.exe
Token: SeDebugPrivilege	4488	InstallUtil.exe
Token: 33	4488	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	4488	InstallUtil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4488	InstallUtil.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1004	2184	42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a.exe	89
PID 2184 wrote to memory of 1004	2184	42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a.exe	89
PID 2184 wrote to memory of 1004	2184	42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a.exe	89
PID 4696 wrote to memory of 4980	4696	explorer.exe	91
PID 4696 wrote to memory of 4980	4696	explorer.exe	91
PID 4696 wrote to memory of 4980	4696	explorer.exe	91
PID 4980 wrote to memory of 4488	4980	llswni.exe	93
PID 4980 wrote to memory of 4488	4980	llswni.exe	93
PID 4980 wrote to memory of 4488	4980	llswni.exe	93
PID 4980 wrote to memory of 4488	4980	llswni.exe	93
PID 4980 wrote to memory of 4488	4980	llswni.exe	93
PID 4980 wrote to memory of 4488	4980	llswni.exe	93
PID 4980 wrote to memory of 4488	4980	llswni.exe	93
PID 4980 wrote to memory of 4488	4980	llswni.exe	93

C:\Users\Admin\AppData\Local\Temp\42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a.exe
"C:\Users\Admin\AppData\Local\Temp\42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" /c select, C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\llswni.exe
  2⤵
  PID:1004

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\llswni.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\llswni.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"
    3⤵
    - Drops desktop.ini file(s)
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4488

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\llswni.exe

Filesize
805KB

MD5
8b683771c162d0f751ec0eed59ab8471

SHA1
749e230bfaaab4e79aeab3ba5ca8e6cdc7bde183

SHA256
42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a

SHA512
bec4cf42857a7a217ec4f4e4cc99905eb9e69a560f6945869fa421b5cfcb7b4b4442385ff3ab758bced5db53f5472d1984a8e23a85cc28e54c8d8cdcfdfe78d2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\llswni.exe

Filesize
805KB

MD5
8b683771c162d0f751ec0eed59ab8471

SHA1
749e230bfaaab4e79aeab3ba5ca8e6cdc7bde183

SHA256
42aa8ecf0677adfb5dcdbcb7a19485dcbe7a2c2749fc5dda541d2157cdd2be3a

SHA512
bec4cf42857a7a217ec4f4e4cc99905eb9e69a560f6945869fa421b5cfcb7b4b4442385ff3ab758bced5db53f5472d1984a8e23a85cc28e54c8d8cdcfdfe78d2

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch

Filesize
514B

MD5
7036eb16911c2cec76f7edfbe4c59d67

SHA1
ed3aa528de2da2e8844c028d38d17624f4da917f

SHA256
5653cfc26cb99bbf9b0ee8ef4ab6ec18da9f5a2492e257cf0ae6215ecd7e3593

SHA512
fe969ac05997ca9d1697fa02bbf5022ce7a41a6a8ce4f0b440f9bf8287162095d405f21df1941173858cd0591de97504ec6de312a941ec5106714bbf28fb782e

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch

Filesize
514B

MD5
7036eb16911c2cec76f7edfbe4c59d67

SHA1
ed3aa528de2da2e8844c028d38d17624f4da917f

SHA256
5653cfc26cb99bbf9b0ee8ef4ab6ec18da9f5a2492e257cf0ae6215ecd7e3593

SHA512
fe969ac05997ca9d1697fa02bbf5022ce7a41a6a8ce4f0b440f9bf8287162095d405f21df1941173858cd0591de97504ec6de312a941ec5106714bbf28fb782e

Download Submit
memory/2184-133-0x0000000074660000-0x0000000074C11000-memory.dmp

Filesize
5.7MB

Download
memory/2184-131-0x0000000074660000-0x0000000074C11000-memory.dmp

Filesize
5.7MB

Download
memory/2184-130-0x0000000074660000-0x0000000074C11000-memory.dmp

Filesize
5.7MB

Download
memory/4488-142-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4488-144-0x00000000745E0000-0x0000000074B91000-memory.dmp

Filesize
5.7MB

Download
memory/4488-145-0x00000000745E0000-0x0000000074B91000-memory.dmp

Filesize
5.7MB

Download
memory/4980-139-0x00000000745E0000-0x0000000074B91000-memory.dmp

Filesize
5.7MB

Download
memory/4980-140-0x00000000745E0000-0x0000000074B91000-memory.dmp

Filesize
5.7MB

Download
memory/4980-143-0x00000000745E0000-0x0000000074B91000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing