imminent | 495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8

General

Target

495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe
Size

480KB
MD5

64584e3e6a53cf2b078f363575826c8b
SHA1

e85449f08c53e6bd5742eb8edb4d559692dce617
SHA256

495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8
SHA512

dbd8483ac6f4b99a3ad29c32b944246c1d43d00f99fd4a5a2c01146145f923505d002c1b92755da273fbad5f8f880de33a1e1d5a50f952f1d8d59ee3479f9e8f

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2184 set thread context of 4304	2184	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe	83

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe
File created	C:\Windows\assembly\Desktop.ini	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4336	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4304	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4304	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe
Token: 33	4304	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe
Token: SeIncBasePriorityPrivilege	4304	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4304	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 4336	2184	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe	81
PID 2184 wrote to memory of 4336	2184	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe	81
PID 2184 wrote to memory of 4336	2184	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe	81
PID 2184 wrote to memory of 4304	2184	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe	83
PID 2184 wrote to memory of 4304	2184	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe	83
PID 2184 wrote to memory of 4304	2184	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe	83
PID 2184 wrote to memory of 4304	2184	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe	83
PID 2184 wrote to memory of 4304	2184	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe	83
PID 2184 wrote to memory of 4304	2184	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe	83
PID 2184 wrote to memory of 4304	2184	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe	83
PID 2184 wrote to memory of 4304	2184	495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe	83

C:\Users\Admin\AppData\Local\Temp\495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe
"C:\Users\Admin\AppData\Local\Temp\495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Update\oconor" /XML "C:\Users\Admin\AppData\Local\Temp\z201"
  2⤵
  - Creates scheduled task(s)
  PID:4336
- C:\Users\Admin\AppData\Local\Temp\495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe
  "C:\Users\Admin\AppData\Local\Temp\495665943729e5e1b5f20ffb2352188fecea6e6d44f4c45479f74c8a931cbca8.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\z201

Filesize
1KB

MD5
647c87c5edea152d5a8885157b2c171d

SHA1
abbd8a854d9261bb3ff850417f2c7e206862ed08

SHA256
54fb23af164c5e512b71099d3cf52b243b8ee5a75c8bab0752d61a9418cb4bac

SHA512
be9b489ffb939dc0e3eb4d8ea0aa1252cf25f77696e49caaf855fd093ab824d8c1bfd217ab0eedc67931d21ba175cbc3b1198db939557188aa7069c65f01d8de

Download Submit
memory/2184-130-0x0000000074660000-0x0000000074C11000-memory.dmp

Filesize
5.7MB

Download
memory/2184-131-0x0000000074660000-0x0000000074C11000-memory.dmp

Filesize
5.7MB

Download
memory/4304-135-0x0000000000700000-0x000000000075A000-memory.dmp

Filesize
360KB

Download
memory/4304-136-0x0000000000700000-0x000000000075A000-memory.dmp

Filesize
360KB

Download
memory/4304-137-0x0000000000700000-0x000000000075A000-memory.dmp

Filesize
360KB

Download
memory/4304-139-0x0000000074660000-0x0000000074C11000-memory.dmp

Filesize
5.7MB

Download
memory/4304-140-0x0000000074660000-0x0000000074C11000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads