imminent | 48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
14/07/2022, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe
Size 714KB
Sample220714-b39fhsbaf5
SHA256 48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded
MD5 d91988e5b8e7e3b044984188df15fd01
SHA1 933e090ad781a7208ae78937162423d2b165bd0d
SHA512 b10e8842b2a962a844f49e931fa12e7de34332885fcfb3fabfeb96eeb43aefbb8fa141adcda5acc6cd8db5329fdbc705ae63e6cd8b510210168e0dc301370ee2
MD5 SHA1 SHA512

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZikIoH.url	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2284 set thread context of 4616	2284	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe	81

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2284	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe
2284	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4616	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe
Token: SeDebugPrivilege	4616	RegAsm.exe
Token: 33	4616	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4616	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4616	RegAsm.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2992	2284	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe	78
PID 2284 wrote to memory of 2992	2284	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe	78
PID 2284 wrote to memory of 2992	2284	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe	78
PID 2992 wrote to memory of 4836	2992	csc.exe	80
PID 2992 wrote to memory of 4836	2992	csc.exe	80
PID 2992 wrote to memory of 4836	2992	csc.exe	80
PID 2284 wrote to memory of 4616	2284	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe	81
PID 2284 wrote to memory of 4616	2284	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe	81
PID 2284 wrote to memory of 4616	2284	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe	81
PID 2284 wrote to memory of 4616	2284	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe	81
PID 2284 wrote to memory of 4616	2284	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe	81
PID 2284 wrote to memory of 4616	2284	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe	81
PID 2284 wrote to memory of 4616	2284	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe	81
PID 2284 wrote to memory of 4616	2284	48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe	81

C:\Users\Admin\AppData\Local\Temp\48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe
"C:\Users\Admin\AppData\Local\Temp\48d8f2502fe8a70ad31bba1388e9db78556419b62b615254a9cb813d5bbfcded.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uad4mzaj\uad4mzaj.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES92EE.tmp" "c:\Users\Admin\AppData\Local\Temp\uad4mzaj\CSC14EBD170CC9A4C7FBB8116554660C592.TMP"
    3⤵
    PID:4836
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4616

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES92EE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES92EE.tmp
Size 1KB
SHA256 a5bd91f82f4922d82bd0067891786e7a2fe98177de0e5d11858e68f13b279c77
MD5 6d489debd40ab2cc2153bb095ec96377
SHA1 92a60875d21ed26253a73c9393f8b1ab80ca1cd6
SHA512 8d067dbba84993fdcabf3eaad9530f1ddc91fcbd959b7d01ffba782f11fbec829a8eaf7c2b5a0890c323ec6841be130c685b46eb9533aa77575e26b27e0fbd96
MD5 SHA1 SHA512

Submit Download

uad4mzaj.dll

Path C:\Users\Admin\AppData\Local\Temp\uad4mzaj\uad4mzaj.dll
Size 15KB
SHA256 af9cf6ecade9a47fc17bfb70027aac580f95f53d16b21f1a01e585e87b5816ff
MD5 296a54d51e15906c0eb15fa0bf47e396
SHA1 081bfb645125262eff117fb6c40530085e568208
SHA512 58196f6f8bc122eb5e914face6f7d5bbc4643ef1f95328ed89e4820042db768e345c15fea6864bb23e1a506503c2562014ad276b20147491b51c5fd0d0cc6d99
SSDEEP 192:XC9oGap78iPme5AuatwlzHajrJmB6RT/FsZIiMndtCN7UNE+7PfDqqmeA2:XGCwcmSJzHajr0B6RzOMdA2NjnOqw
MD5 SHA1 SHA512 SSDEEP

Submit Download

uad4mzaj.pdb

Path C:\Users\Admin\AppData\Local\Temp\uad4mzaj\uad4mzaj.pdb
Size 49KB
SHA256 c44522e6217a9881b9e63e5f145b5724bd187a934fd3de3099ffabe08555b3d3
MD5 148dabd70a468ad421fd5dd016790643
SHA1 d80b11f9a8581b1df13323832c908d6200a80bd6
SHA512 489345388a823fd07bddddf9a8adc259f0583aa435ecf7e7be447109a344dd8cd7d2bb45d51ceba8206587d516eeae4f0d017014b3a166482743c0f10d58d0fd
SSDEEP 384:MuAdA3Vx6xtD/0q7YmTUmsLtwCMpnIJ2xO50iBG29x9Wh3Bkh8gOH4E:9AdAlx6xtD/d7Yt3JA00iBn9rUxk6P
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC14EBD170CC9A4C7FBB8116554660C592.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\uad4mzaj\CSC14EBD170CC9A4C7FBB8116554660C592.TMP
Size 1KB
SHA256 1299f5ae987b123ac882a14c497c739c8fb8bb495529797344dc2847399e84b6
MD5 6a058d8be7eb44d5311bd45d0127eabc
SHA1 10fa037816ff3aa1291b48c220213c2cfaa8a545
SHA512 09b0b2279ce97e8166114987d2a228c8e83632c5a8a6d73adc2ce6bb747b43a3402893da1fad38e671000a0a6b6292172ab164e88dd81413a7c32165dbfc8dd9
MD5 SHA1 SHA512

Submit Download

uad4mzaj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\uad4mzaj\uad4mzaj.0.cs
Size 28KB
SHA256 f387b23b9fef7e4f08feaaedf47bcb8e36c863256b5c61331d5badb06f586012
MD5 c91b937a62fec89abb55efc4031414f2
SHA1 9d5ca2cb628c22fab0b5e4391537dde39b1c4b88
SHA512 f4c1907da37028915aa96571ce13e13f913b80195a3b1be543b03be12cbf0552af0327cfa50f131e338c53e497ebbe3a5a8d7fc38d370f96d8b6e6e1e3cfa267
SSDEEP 384:N6kjIjJXuAurtk/zb2ftMt1ExkSXPX2vbNn/0bK/BXBFhm5S1HPqJ:rjOiob2V/xfPXkn/04HmqiJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

uad4mzaj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\uad4mzaj\uad4mzaj.cmdline
Size 312B
SHA256 ad3df2af5acf3122d5776e040913808e9d83b1ee5598c1007f2c584c3d2945c7
MD5 e26bcc19b3e8bd1e14094d47540711df
SHA1 739ca2dc3eb6bf053b971eadea0d8106f8ddc9a3
SHA512 9bc5ccde14d968ea5c588e02cf95730c5a98b5114ea028da239d057e688a9d6e3a4cc801a175b9a58169cb8b4e76e5aabc7a1828d1de0cd6e5b0b3fcb682c2a3
MD5 SHA1 SHA512

Submit Download

memory/2284-130-0x0000000000CE0000-0x0000000000D9A000-memory.dmp

Download

memory/2284-139-0x0000000005790000-0x0000000005822000-memory.dmp

Download

memory/2284-140-0x0000000005E40000-0x0000000005EDC000-memory.dmp

Download

memory/4616-142-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4616-143-0x0000000075350000-0x0000000075901000-memory.dmp

Download

memory/4616-144-0x0000000075350000-0x0000000075901000-memory.dmp

Download