imminent | 51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2022, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe
Size 613KB
Sample220718-q8ewesdfa6
SHA256 51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341
MD5 d8f06a97f2251808d092441dc3e8841f
SHA1 ac4e464d147156249e101b9c300e174b36f54764
SHA512 2f0b864b060506b911cdffe46111c9d78cf9c42664e1a09b078bc0633a8f981bd4362e254296e4c4efe976d13f823647a39863c102b4189a32940b3a8de9a587
MD5 SHA1 SHA512

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MNvfYs.url	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3144 set thread context of 5012	3144	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe	82

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	RegAsm.exe
File created	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3144	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe
3144	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5012	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3144	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe
Token: SeDebugPrivilege	5012	RegAsm.exe
Token: 33	5012	RegAsm.exe
Token: SeIncBasePriorityPrivilege	5012	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5012	RegAsm.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 2524	3144	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe	79
PID 3144 wrote to memory of 2524	3144	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe	79
PID 3144 wrote to memory of 2524	3144	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe	79
PID 2524 wrote to memory of 2160	2524	csc.exe	81
PID 2524 wrote to memory of 2160	2524	csc.exe	81
PID 2524 wrote to memory of 2160	2524	csc.exe	81
PID 3144 wrote to memory of 5012	3144	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe	82
PID 3144 wrote to memory of 5012	3144	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe	82
PID 3144 wrote to memory of 5012	3144	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe	82
PID 3144 wrote to memory of 5012	3144	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe	82
PID 3144 wrote to memory of 5012	3144	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe	82
PID 3144 wrote to memory of 5012	3144	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe	82
PID 3144 wrote to memory of 5012	3144	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe	82
PID 3144 wrote to memory of 5012	3144	51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe	82

C:\Users\Admin\AppData\Local\Temp\51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe
"C:\Users\Admin\AppData\Local\Temp\51a04a0fcfd0d530224bb4286ee66863fa36a7ef21d91b6174f8fe99802e0341.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\as4zofco\as4zofco.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5643.tmp" "c:\Users\Admin\AppData\Local\Temp\as4zofco\CSC51DD688B3866445085D0F6EDD8C7D6F.TMP"
    3⤵
    PID:2160
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5012

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES5643.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5643.tmp
Size 1KB
SHA256 38e5685267a10e5b2f93c7e94f5c7666c40707a2b7f7d37aca6c2e8aa6d8ba71
MD5 8cd7129688abda27354d332a534371d0
SHA1 ed2599c07a7d45f573d06086583ae1de5f2d6750
SHA512 a9ad26ebce5e5509cfe4fa795ba49f825215fd32e30c79961c225ee0050ae0a0223c5793158b77c95dfadeef831dbd607d9a2e0e65701e677a23d57bddfa4c7d
MD5 SHA1 SHA512

Submit Download

as4zofco.dll

Path C:\Users\Admin\AppData\Local\Temp\as4zofco\as4zofco.dll
Size 6KB
SHA256 533b0f3ed5b461bfa3f7297d320b57aa3ee476599106eaddd61c0d695e6abe38
MD5 5fa973b56d2442672acdae372c3ab0e2
SHA1 f71c9085d967760ab55181e074c835b245f61497
SHA512 6d84695dc4c83b7c31888a3f90608a3e717213dda6dee644fd5fc061a42778b4fab03aa8ebe42e239d56fea75df4c8c38c07b3f3330c9da936f6793ad794cddf
SSDEEP 96:zT7UqOf6Yz7a9afojreU5j9skEwQ7iWNElBKBzNt:zIbSzy6PE9tD
MD5 SHA1 SHA512 SSDEEP

Submit Download

as4zofco.pdb

Path C:\Users\Admin\AppData\Local\Temp\as4zofco\as4zofco.pdb
Size 19KB
SHA256 60b7c9acc9ceb18d18354b46a72591565c6fb2931891c36332798cc86fb41766
MD5 0afe07419b044d384edf306dbf23eba5
SHA1 fce5d09397c4e7a2494aa18df22cab0ae5567fc3
SHA512 d24fabfa9a1a66ade535a1704bdb9f51e83689220c5b5ae3041305882311ca5899549507b6d4315dcee52312eca8074e3bc84253f627c6c151506fd252a73181
SSDEEP 192:yAS91mOCO9qq686FWKzXeidhvJMG+gRgp6X0B:0TmOCOXW7L0B
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC51DD688B3866445085D0F6EDD8C7D6F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\as4zofco\CSC51DD688B3866445085D0F6EDD8C7D6F.TMP
Size 1KB
SHA256 b3ae38c8fe5a3847000787fb6c1f9675c30c4696c0f5c7a1d33fc1a0f4984085
MD5 4bf28e39e639050cca095559135861de
SHA1 a35f3e75472965d7f38ca47ed245e5756ae04f28
SHA512 14a7564cbd013dfb922ca94631aa66ad62d7f3ca91c0604a8d82c707f6778548729e9b160d2a5fc43fe920932577d7bad09a28d686a09590fa95a6c149c7b185
MD5 SHA1 SHA512

Submit Download

as4zofco.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\as4zofco\as4zofco.0.cs
Size 3KB
SHA256 3d754afa81c22f344c92c738af61f9d49cae630a7702858011176801c5280625
MD5 a394cd7e3ac6375e471f5edf0e0f43ad
SHA1 3672ea8e6da522ef76af1d6bbec93c16bee1c010
SHA512 69733c0008fd3853d75071a36b56b3e4a2f2d8daeb33fcb725de762b44d88adbb18848a57648ff609d267a5a27b29476b5290335b47868fa37324583f68fc215
MD5 SHA1 SHA512

Submit Download

as4zofco.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\as4zofco\as4zofco.cmdline
Size 312B
SHA256 79d446b7f96b3860d0f67885496d1ec089fece4fb71f86077852afb1f678309c
MD5 70e6b65eafc7547fa340bacd8448cf19
SHA1 3acdb0a23087b467c0243bdb0d5ea9be98975e70
SHA512 7a70bdd6c2f5fe13b8cf0da4f226e9499911e637f65f1a2c2ddafb45921a21c1f1a1ccc87fa50b6084ad28896f4fd1dc8336d56a287f49296475408df503fab1
MD5 SHA1 SHA512

Submit Download

memory/3144-130-0x0000000000440000-0x00000000004E0000-memory.dmp

Download

memory/3144-139-0x0000000004D40000-0x0000000004DD2000-memory.dmp

Download

memory/3144-140-0x00000000053E0000-0x000000000547C000-memory.dmp

Download

memory/5012-142-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/5012-143-0x0000000074840000-0x0000000074DF1000-memory.dmp

Download

memory/5012-144-0x0000000074840000-0x0000000074DF1000-memory.dmp

Download