imminent | 2e66e23d1ae80b56efc2c38bf5adbb31dab91b811eaadce68f544e06323d52ef

Analysis

max time kernel
169s
max time network
167s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-07-2022 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8abebde631005ae15aba91eb8f36fbe7.exe
Size

983KB
MD5

8abebde631005ae15aba91eb8f36fbe7
SHA1

d4ac00d9aee072b6d1499e730cf9bcb27ad957ad
SHA256

2e66e23d1ae80b56efc2c38bf5adbb31dab91b811eaadce68f544e06323d52ef
SHA512

7091584d35154b0711e4a8b6c788cc5db5ad0e6444e5cda5a16ad41a00cf333413fc8ac5b93e84b9b2e5e9350ca89837c6f69b5838ade967b403bd24322ab3fc

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1556 set thread context of 1436	1556	8abebde631005ae15aba91eb8f36fbe7.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
848	1556	WerFault.exe	22

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2008	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	8abebde631005ae15aba91eb8f36fbe7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	8abebde631005ae15aba91eb8f36fbe7.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2020	powershell.exe
1436	8abebde631005ae15aba91eb8f36fbe7.exe
1436	8abebde631005ae15aba91eb8f36fbe7.exe
980	taskmgr.exe
980	taskmgr.exe
1436	8abebde631005ae15aba91eb8f36fbe7.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	1436	8abebde631005ae15aba91eb8f36fbe7.exe
Token: SeDebugPrivilege	980	taskmgr.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe
980	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1436	8abebde631005ae15aba91eb8f36fbe7.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2020	1556	8abebde631005ae15aba91eb8f36fbe7.exe	28
PID 1556 wrote to memory of 2020	1556	8abebde631005ae15aba91eb8f36fbe7.exe	28
PID 1556 wrote to memory of 2020	1556	8abebde631005ae15aba91eb8f36fbe7.exe	28
PID 1556 wrote to memory of 2020	1556	8abebde631005ae15aba91eb8f36fbe7.exe	28
PID 1556 wrote to memory of 2008	1556	8abebde631005ae15aba91eb8f36fbe7.exe	30
PID 1556 wrote to memory of 2008	1556	8abebde631005ae15aba91eb8f36fbe7.exe	30
PID 1556 wrote to memory of 2008	1556	8abebde631005ae15aba91eb8f36fbe7.exe	30
PID 1556 wrote to memory of 2008	1556	8abebde631005ae15aba91eb8f36fbe7.exe	30
PID 1556 wrote to memory of 1436	1556	8abebde631005ae15aba91eb8f36fbe7.exe	32
PID 1556 wrote to memory of 1436	1556	8abebde631005ae15aba91eb8f36fbe7.exe	32
PID 1556 wrote to memory of 1436	1556	8abebde631005ae15aba91eb8f36fbe7.exe	32
PID 1556 wrote to memory of 1436	1556	8abebde631005ae15aba91eb8f36fbe7.exe	32
PID 1556 wrote to memory of 1436	1556	8abebde631005ae15aba91eb8f36fbe7.exe	32
PID 1556 wrote to memory of 1436	1556	8abebde631005ae15aba91eb8f36fbe7.exe	32
PID 1556 wrote to memory of 1436	1556	8abebde631005ae15aba91eb8f36fbe7.exe	32
PID 1556 wrote to memory of 1436	1556	8abebde631005ae15aba91eb8f36fbe7.exe	32
PID 1556 wrote to memory of 1436	1556	8abebde631005ae15aba91eb8f36fbe7.exe	32
PID 1556 wrote to memory of 848	1556	8abebde631005ae15aba91eb8f36fbe7.exe	33
PID 1556 wrote to memory of 848	1556	8abebde631005ae15aba91eb8f36fbe7.exe	33
PID 1556 wrote to memory of 848	1556	8abebde631005ae15aba91eb8f36fbe7.exe	33
PID 1556 wrote to memory of 848	1556	8abebde631005ae15aba91eb8f36fbe7.exe	33
PID 1436 wrote to memory of 980	1436	8abebde631005ae15aba91eb8f36fbe7.exe	34
PID 1436 wrote to memory of 980	1436	8abebde631005ae15aba91eb8f36fbe7.exe	34
PID 1436 wrote to memory of 980	1436	8abebde631005ae15aba91eb8f36fbe7.exe	34
PID 1436 wrote to memory of 980	1436	8abebde631005ae15aba91eb8f36fbe7.exe	34

C:\Users\Admin\AppData\Local\Temp\8abebde631005ae15aba91eb8f36fbe7.exe
"C:\Users\Admin\AppData\Local\Temp\8abebde631005ae15aba91eb8f36fbe7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uppEqmN.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uppEqmN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp59A5.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2008
- C:\Users\Admin\AppData\Local\Temp\8abebde631005ae15aba91eb8f36fbe7.exe
  "C:\Users\Admin\AppData\Local\Temp\8abebde631005ae15aba91eb8f36fbe7.exe"
  2⤵
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\SysWOW64\taskmgr.exe
    "C:\Windows\System32\taskmgr.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 1048
  2⤵
  - Program crash
  PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp59A5.tmp

Filesize
1KB

MD5
8529617cce28946b3f862ed976335daa

SHA1
8430da30d2ae21128b57380d5e1000624a2f2178

SHA256
e71acf98fe039d73a3360bed91a805317de81b134a6f7ca5e03967e9272956fa

SHA512
04e1207ac3772400967c3be57adffd4bdd8e89f84ad581e6cbfaea328c3474854b781fa494f8bba348aab09ec162d873632530ef69a05dcf8b5632443f9219bd

Download Submit
memory/1436-81-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-76-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-107-0x0000000000770000-0x000000000077C000-memory.dmp

Filesize
48KB

Download
memory/1436-83-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-109-0x0000000000F10000-0x0000000000F1E000-memory.dmp

Filesize
56KB

Download
memory/1436-84-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-110-0x0000000001330000-0x000000000133C000-memory.dmp

Filesize
48KB

Download
memory/1436-82-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-66-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-67-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-69-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-70-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-71-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-74-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-98-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-77-0x00000000003A0000-0x00000000003C8000-memory.dmp

Filesize
160KB

Download
memory/1436-79-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-80-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-108-0x0000000000CA0000-0x0000000000CAA000-memory.dmp

Filesize
40KB

Download
memory/1436-106-0x0000000004AD5000-0x0000000004AE6000-memory.dmp

Filesize
68KB

Download
memory/1436-104-0x0000000000760000-0x0000000000776000-memory.dmp

Filesize
88KB

Download
memory/1436-103-0x0000000000670000-0x000000000067E000-memory.dmp

Filesize
56KB

Download
memory/1436-85-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-87-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-89-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-90-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-93-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-95-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1436-96-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1556-56-0x0000000000780000-0x000000000079A000-memory.dmp

Filesize
104KB

Download
memory/1556-58-0x0000000005280000-0x0000000005324000-memory.dmp

Filesize
656KB

Download
memory/1556-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1556-57-0x00000000007A0000-0x00000000007AE000-memory.dmp

Filesize
56KB

Download
memory/1556-54-0x0000000001380000-0x000000000147C000-memory.dmp

Filesize
1008KB

Download
memory/1556-64-0x0000000005FF0000-0x0000000006050000-memory.dmp

Filesize
384KB

Download
memory/1556-61-0x0000000004BF5000-0x0000000004C06000-memory.dmp

Filesize
68KB

Download
memory/2020-65-0x000000006EC90000-0x000000006F23B000-memory.dmp

Filesize
5.7MB

Download
memory/2020-105-0x000000006EC90000-0x000000006F23B000-memory.dmp

Filesize
5.7MB

Download