imminent | 48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569

Analysis

max time kernel
151s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
14/07/2022, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe
Size 533KB
Sample220714-cmtksshbfm
SHA256 48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569
MD5 2dbab90649ad99523bf40cf950fbf882
SHA1 1e379bf85d6d12a85ac0e929f438013f0944c602
SHA512 2f4b76c589a0071ab1b8d848249a9389365f914c15900dd3a30062182ba6906dade8d7ad1b0863c1ddfb3c37c8c2e34495011bf453fefb9c0ba28841dd4b0d80
MD5 SHA1 SHA512

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PpPFpK.url	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1384 set thread context of 2936	1384	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe	82

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	RegAsm.exe
File created	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1384	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe
1384	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2936	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe
Token: SeDebugPrivilege	2936	RegAsm.exe
Token: 33	2936	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2936	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2936	RegAsm.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 3636	1384	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe	79
PID 1384 wrote to memory of 3636	1384	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe	79
PID 1384 wrote to memory of 3636	1384	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe	79
PID 3636 wrote to memory of 2896	3636	csc.exe	81
PID 3636 wrote to memory of 2896	3636	csc.exe	81
PID 3636 wrote to memory of 2896	3636	csc.exe	81
PID 1384 wrote to memory of 2936	1384	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe	82
PID 1384 wrote to memory of 2936	1384	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe	82
PID 1384 wrote to memory of 2936	1384	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe	82
PID 1384 wrote to memory of 2936	1384	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe	82
PID 1384 wrote to memory of 2936	1384	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe	82
PID 1384 wrote to memory of 2936	1384	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe	82
PID 1384 wrote to memory of 2936	1384	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe	82
PID 1384 wrote to memory of 2936	1384	48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe	82

C:\Users\Admin\AppData\Local\Temp\48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe
"C:\Users\Admin\AppData\Local\Temp\48b094fa423ecf15ff29fcdde2410551eb851d969249ed624545935363043569.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uorrxlom\uorrxlom.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD343.tmp" "c:\Users\Admin\AppData\Local\Temp\uorrxlom\CSC17EAC503955C43699AD87B15684CE022.TMP"
    3⤵
    PID:2896
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2936

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RESD343.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD343.tmp
Size 1KB
SHA256 c1ac33e2f45c33445e889bfaa2ce5ad981300cc69d9ce11f31c54acca23819cd
MD5 ce07825d6c0e07a257fdfb7438f0a072
SHA1 3cca242e922f93e3d00d5a7256d2e8a9355656bd
SHA512 c55f6784c188511938cfdeaef3f38b1ed2ef61ec97eaaab658130d2733e689d692bb7c1e7c5b1637ca01d7b66a5740309c60039052539803d17fd63e487275cc
MD5 SHA1 SHA512

Submit Download

uorrxlom.dll

Path C:\Users\Admin\AppData\Local\Temp\uorrxlom\uorrxlom.dll
Size 6KB
SHA256 5598dbbe060b5e1d6f4f59c8408f2da4e9674277233834b8c19f3defa97af5be
MD5 843d8cf1cd190081cf0fa5bf2200cf9e
SHA1 f9d09c9b28ca2a933e89593a5038b6e78d5ae6ae
SHA512 8d08ed0d78304a828edf3e4af43ef2fd940c4f0badc81689aa1ba66163f3b1a31d795a1d547a325028bf98e34f6d8320a6d2a34c3d4228b878313de0af8703f4
SSDEEP 96:NsvvtWI9Ias0Ya/1YDPyVqos/ElBuhLiKQzNt:NsvoaZsAqREHKy
MD5 SHA1 SHA512 SSDEEP

Submit Download

uorrxlom.pdb

Path C:\Users\Admin\AppData\Local\Temp\uorrxlom\uorrxlom.pdb
Size 17KB
SHA256 5659d4c02b47a3f0e9c5a4da11e6e05ee918d45e2e29fa818ce94848f61eabd2
MD5 f58cae4d30e5bc72e63c2f1498887ff1
SHA1 9bd11aa2fe480de85746bef21b4ed7b4495d2ed5
SHA512 685dc01dcf61faea657a37b635a40bd8ab18603e013379ea02a998759e59bbbb9f4819030abe3c85b5345d209fdca9528689b38ec0332bcdace91a21212a2bb2
SSDEEP 192:KAyly9xE3gjQ+6CkBs3KOYjEMQ+gRp5qzbOs:dGgU1CkB1Os
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC17EAC503955C43699AD87B15684CE022.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\uorrxlom\CSC17EAC503955C43699AD87B15684CE022.TMP
Size 1KB
SHA256 56d1ada3d36b2c2686a1af9cc515c3ecb1e4b1df011595fbb1b69bcaf5332605
MD5 cf02099b8ac07504bfef34a9bcaabee8
SHA1 4cbb3d16f063d142a036d843f96ce7dc1963411e
SHA512 64aa16ed99273e4e7385b57d8f402ca7e50f3776536a3ddda6ddd732286558c757743ae4a88dfd7706d762cd7282d11f9dfd0abff30d44e552b8ef7002b02b9c
MD5 SHA1 SHA512

Submit Download

uorrxlom.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\uorrxlom\uorrxlom.0.cs
Size 3KB
SHA256 70aee6f255b9ecf6e68734917abff0a467c989a6949f6674deec216dbfbca47f
MD5 06e0c54c4ee5455999610dd062b869ac
SHA1 4793ba65530204e123a937e94fa03c6d57d7194a
SHA512 428bb3bdfeba1dd37ef8479d0630f6e4fd20c48da8540451a791af6be4e246d58d06be45a80c4b62114b137cfc84e3d63d582f0b6047b5fd32725394f37f3598
MD5 SHA1 SHA512

Submit Download

uorrxlom.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\uorrxlom\uorrxlom.cmdline
Size 312B
SHA256 2efd1e88feaf8e7bbf4cbd76f4eee888bf84e275906fc4541d6deb32a1e6769d
MD5 9d8053275e72dc0443cde1a2d68c5a0f
SHA1 b869ff33d3261871fb7d32cb9dd3e4ffd8ebe0cd
SHA512 e185495234d0360510665a5bd9fbe2f703c9557abef8a4e351a3bd7e35a3ba749cc5f92633372f1f906d1befad6202574c66336c2561280a61e4497819cf7cde
MD5 SHA1 SHA512

Submit Download

memory/1384-130-0x00000000002A0000-0x000000000032A000-memory.dmp

Download

memory/1384-139-0x0000000004D10000-0x0000000004DA2000-memory.dmp

Download

memory/1384-140-0x0000000005380000-0x000000000541C000-memory.dmp

Download

memory/2936-142-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2936-143-0x0000000074E50000-0x0000000075401000-memory.dmp

Download

memory/2936-144-0x0000000074E50000-0x0000000075401000-memory.dmp

Download