Malware Analysis Report

2024-11-30 15:58

Sample ID 220708-e1vfcsbdd4
Target 41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5
SHA256 41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5
Tags
imminent spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5

Threat Level: Known bad

The file 41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5 was found to be: Known bad.

Malicious Activity Summary

imminent spyware trojan

Imminent RAT

Executes dropped EXE

Drops startup file

Loads dropped DLL

Checks computer location settings

Suspicious use of SetThreadContext

Enumerates physical storage devices

NTFS ADS

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-08 04:24

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-08 04:24

Reported

2022-07-08 09:24

Platform

win7-20220414-en

Max time kernel

79s

Max time network

47s

Command Line

"C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\UtilityBeats.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\UtilityBeats.exe\:Zone.Identifier:$DATA C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1900 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1900 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1768 wrote to memory of 664 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\UtilityBeats.exe
PID 1768 wrote to memory of 664 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\UtilityBeats.exe
PID 1768 wrote to memory of 664 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\UtilityBeats.exe
PID 1768 wrote to memory of 664 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\UtilityBeats.exe

Processes

C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe

"C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe:Zone.Identifier"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\UtilityBeats.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\UtilityBeats.exe"

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\UtilityBeats.exe

"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\UtilityBeats.exe"

Network

N/A

Files

memory/1900-54-0x0000000000B00000-0x0000000000C56000-memory.dmp

memory/1900-55-0x00000000001F0000-0x0000000000214000-memory.dmp

memory/1900-56-0x0000000076011000-0x0000000076013000-memory.dmp

memory/1208-57-0x0000000000000000-mapping.dmp

memory/1108-58-0x0000000000000000-mapping.dmp

memory/1768-59-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\UtilityBeats.exe

MD5 46f3cb1f7ebc3a9713e726d9506afa5f
SHA1 e60ebfa3d159df9f6fd1e0bc7842bf6204477d00
SHA256 41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5
SHA512 2cc74852fc1a58a360d7f8dbce7e369fe6924e4738234eec4c1b81b8ca494234c1fb7afa32f9825cddda04d8757da1ac02fc4b32325528bca858e266873495f8

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\UtilityBeats.exe

MD5 46f3cb1f7ebc3a9713e726d9506afa5f
SHA1 e60ebfa3d159df9f6fd1e0bc7842bf6204477d00
SHA256 41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5
SHA512 2cc74852fc1a58a360d7f8dbce7e369fe6924e4738234eec4c1b81b8ca494234c1fb7afa32f9825cddda04d8757da1ac02fc4b32325528bca858e266873495f8

memory/664-62-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\UtilityBeats.exe

MD5 46f3cb1f7ebc3a9713e726d9506afa5f
SHA1 e60ebfa3d159df9f6fd1e0bc7842bf6204477d00
SHA256 41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5
SHA512 2cc74852fc1a58a360d7f8dbce7e369fe6924e4738234eec4c1b81b8ca494234c1fb7afa32f9825cddda04d8757da1ac02fc4b32325528bca858e266873495f8

memory/664-64-0x00000000011A0000-0x00000000012F6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-08 04:24

Reported

2022-07-08 09:26

Platform

win10v2004-20220414-en

Max time kernel

189s

Max time network

192s

Command Line

"C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe"

Signatures

Imminent RAT

trojan spyware imminent

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UtilityBeats.lnk C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2576 set thread context of 1776 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe\:Zone.Identifier:$DATA C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1648 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe
PID 2124 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe
PID 2124 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe
PID 2576 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe
PID 2576 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe
PID 2576 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe
PID 2576 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe
PID 2576 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe
PID 2576 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe
PID 2576 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe
PID 2576 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe

Processes

C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe

"C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe:Zone.Identifier"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe"

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe

"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe:Zone.Identifier"

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe

Network

Country Destination Domain Proto
GB 92.123.143.240:80 tcp
GB 92.123.143.240:80 tcp
GB 92.123.143.240:80 tcp
US 20.189.173.10:443 tcp
US 8.8.8.8:53 linkadrum.nl udp
DE 185.140.53.144:9630 linkadrum.nl tcp

Files

memory/1648-130-0x0000000000930000-0x0000000000A86000-memory.dmp

memory/1648-131-0x00000000054D0000-0x00000000054F2000-memory.dmp

memory/1648-132-0x0000000005580000-0x00000000055E6000-memory.dmp

memory/1648-133-0x0000000005500000-0x0000000005522000-memory.dmp

memory/1648-134-0x00000000057C0000-0x0000000005982000-memory.dmp

memory/1648-135-0x0000000005690000-0x0000000005722000-memory.dmp

memory/1776-136-0x0000000000000000-mapping.dmp

memory/1648-137-0x0000000006820000-0x0000000006DC4000-memory.dmp

memory/3640-138-0x0000000000000000-mapping.dmp

memory/2124-139-0x0000000000000000-mapping.dmp

memory/2576-140-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe

MD5 46f3cb1f7ebc3a9713e726d9506afa5f
SHA1 e60ebfa3d159df9f6fd1e0bc7842bf6204477d00
SHA256 41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5
SHA512 2cc74852fc1a58a360d7f8dbce7e369fe6924e4738234eec4c1b81b8ca494234c1fb7afa32f9825cddda04d8757da1ac02fc4b32325528bca858e266873495f8

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe

MD5 46f3cb1f7ebc3a9713e726d9506afa5f
SHA1 e60ebfa3d159df9f6fd1e0bc7842bf6204477d00
SHA256 41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5
SHA512 2cc74852fc1a58a360d7f8dbce7e369fe6924e4738234eec4c1b81b8ca494234c1fb7afa32f9825cddda04d8757da1ac02fc4b32325528bca858e266873495f8

memory/3988-143-0x0000000000000000-mapping.dmp

memory/2576-144-0x00000000092A0000-0x000000000933C000-memory.dmp

memory/1776-145-0x0000000000000000-mapping.dmp

memory/1776-146-0x0000000000400000-0x0000000000456000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\UtilityBeats.exe

MD5 46f3cb1f7ebc3a9713e726d9506afa5f
SHA1 e60ebfa3d159df9f6fd1e0bc7842bf6204477d00
SHA256 41da47a170f485b14f61b095ea488d54f33a11de60afaa845c4f146c06704dd5
SHA512 2cc74852fc1a58a360d7f8dbce7e369fe6924e4738234eec4c1b81b8ca494234c1fb7afa32f9825cddda04d8757da1ac02fc4b32325528bca858e266873495f8

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UtilityBeats.exe.log

MD5 0a43bd90f8a57f03ce392e0949893904
SHA1 bb2c8381d647820c4f71da28bf67689879f10ba7
SHA256 6d4d919739f292f816ad2db990437d9dd0c904b17d4b474fb7125039280bd8d3
SHA512 fcb3070ba070260f224e9dc00481998423534bd6bc9480b86d2bacbbe0614a3f998b757484632c472120e25df354b80ec94aee0c3dcde9a56e86e8ce45f5f70a

memory/1776-149-0x0000000007BF0000-0x0000000007BFA000-memory.dmp