imminent | 4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa

General

Target

4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe
Size

599KB
MD5

065f6aab9510d8bfe684e12747c4d1ec
SHA1

ca2709e6ad302f1d2d0adc24b961146cc96eadf7
SHA256

4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa
SHA512

db7180393dddd89b4c3310235ffaccbda92356fc0598673804a3a5301a53ec175ca18d96017c5d9a7652a15f95ea6c6e20994eba2e339a3ae653a4c70b36dc97

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Update = "C:\\Users\\Admin\\AppData\\Roaming\\Win Update\\Win Update.exe"	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{468FED89-629B-465C-A4F4-DAC88BA1B8FB}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{2C9FC92F-2089-41AD-935B-1E1FB1A41F18}.catalogItem	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4680 set thread context of 3012	4680	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe	80

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe
File created	C:\Windows\assembly\Desktop.ini	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3012	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3012	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 3012	4680	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe	80
PID 4680 wrote to memory of 3012	4680	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe	80
PID 4680 wrote to memory of 3012	4680	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe	80
PID 4680 wrote to memory of 3012	4680	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe	80
PID 4680 wrote to memory of 3012	4680	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe	80
PID 4680 wrote to memory of 3012	4680	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe	80
PID 4680 wrote to memory of 3012	4680	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe	80
PID 4680 wrote to memory of 3012	4680	4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe	80

C:\Users\Admin\AppData\Local\Temp\4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe
"C:\Users\Admin\AppData\Local\Temp\4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Local\Temp\4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe
  "C:\Users\Admin\AppData\Local\Temp\4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-133-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3012-134-0x0000000074CC0000-0x0000000075271000-memory.dmp

Filesize
5.7MB

Download
memory/3012-135-0x0000000074CC0000-0x0000000075271000-memory.dmp

Filesize
5.7MB

Download
memory/4680-130-0x0000000074CC0000-0x0000000075271000-memory.dmp

Filesize
5.7MB

Download
memory/4680-131-0x0000000074CC0000-0x0000000075271000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads