imminent | 4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0

General

Target

4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe
Size

544KB
MD5

125d0ee48394e7537a2ea07208b34a9c
SHA1

c5c6667f234154773f0007271250e347230764ce
SHA256

4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0
SHA512

61c6ef824cafe949e5abd180d9c4a8ba5f50e6c6ea40f1b3d6fec93230fea8496ac45de46bd0ea34ff62967c9f0fda5fa0fe72c30aa982d59eed014f5c8bb7e6

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\AuoJc5W0488j6wZ3\\Syo2B3jb4lVH.exe\",explorer.exe"	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 868 set thread context of 996	868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe	29

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe
868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe
868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
996	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe
Token: SeDebugPrivilege	996	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe
Token: 33	996	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe
Token: SeIncBasePriorityPrivilege	996	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
996	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 1724	868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe	28
PID 868 wrote to memory of 1724	868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe	28
PID 868 wrote to memory of 1724	868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe	28
PID 868 wrote to memory of 1724	868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe	28
PID 868 wrote to memory of 996	868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe	29
PID 868 wrote to memory of 996	868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe	29
PID 868 wrote to memory of 996	868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe	29
PID 868 wrote to memory of 996	868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe	29
PID 868 wrote to memory of 996	868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe	29
PID 868 wrote to memory of 996	868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe	29
PID 868 wrote to memory of 996	868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe	29
PID 868 wrote to memory of 996	868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe	29
PID 868 wrote to memory of 996	868	4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe	29

C:\Users\Admin\AppData\Local\Temp\4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe
"C:\Users\Admin\AppData\Local\Temp\4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868
- C:\Users\Admin\AppData\Local\Temp\4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe
  "C:\Users\Admin\AppData\Local\Temp\4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe"
  2⤵
  PID:1724
- C:\Users\Admin\AppData\Local\Temp\4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe
  "C:\Users\Admin\AppData\Local\Temp\4c67fecabd8eaf45609cc8e63b4b256834c407bdf012ad1ce1ac0625b6844bd0.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:996

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-54-0x0000000076421000-0x0000000076423000-memory.dmp

Filesize
8KB

Download
memory/868-55-0x0000000074640000-0x0000000074BEB000-memory.dmp

Filesize
5.7MB

Download
memory/868-68-0x0000000074640000-0x0000000074BEB000-memory.dmp

Filesize
5.7MB

Download
memory/996-61-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/996-59-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/996-60-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/996-57-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/996-64-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/996-66-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/996-56-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/996-69-0x0000000074640000-0x0000000074BEB000-memory.dmp

Filesize
5.7MB

Download
memory/996-70-0x0000000074640000-0x0000000074BEB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing