imminent | 4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35.exe
Size 760KB
Sample220720-t5jxrabdc4
SHA256 4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35
MD5 233e376e4bff30753bf04ad6b7f3a1c5
SHA1 3957ea6d99d93b5d7d4457a900ae1a63ab62fbe9
SHA512 f2c7e89c3bd9d4433bfe20d9ad7a86aab9ffba78efe03544246a90cbb9cc77c19b2aa57ce59bbb1517dae6dabff4a7afe8d358cb7927154883fd0f0ce5575077
MD5 SHA1 SHA512

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 2 IoCs

pid	Process
2284	moniter.exe
4176	moniter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\Control Panel\International\Geo\Nation	4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Moniter = "C:\\Users\\Admin\\AppData\\Roaming\\moniter.exe -boot"	moniter.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2284 set thread context of 4176	2284	moniter.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4176	moniter.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35.exe
Token: 33	1964	4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35.exe
Token: SeIncBasePriorityPrivilege	1964	4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35.exe
Token: SeDebugPrivilege	2284	moniter.exe
Token: 33	2284	moniter.exe
Token: SeIncBasePriorityPrivilege	2284	moniter.exe
Token: SeDebugPrivilege	4176	moniter.exe
Token: 33	4176	moniter.exe
Token: SeIncBasePriorityPrivilege	4176	moniter.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4176	moniter.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 4988	1964	4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35.exe	77
PID 1964 wrote to memory of 4988	1964	4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35.exe	77
PID 1964 wrote to memory of 4988	1964	4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35.exe	77
PID 1964 wrote to memory of 1856	1964	4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35.exe	79
PID 1964 wrote to memory of 1856	1964	4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35.exe	79
PID 1964 wrote to memory of 1856	1964	4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35.exe	79
PID 1856 wrote to memory of 2284	1856	cmd.exe	81
PID 1856 wrote to memory of 2284	1856	cmd.exe	81
PID 1856 wrote to memory of 2284	1856	cmd.exe	81
PID 2284 wrote to memory of 4176	2284	moniter.exe	82
PID 2284 wrote to memory of 4176	2284	moniter.exe	82
PID 2284 wrote to memory of 4176	2284	moniter.exe	82
PID 2284 wrote to memory of 4176	2284	moniter.exe	82
PID 2284 wrote to memory of 4176	2284	moniter.exe	82
PID 2284 wrote to memory of 4176	2284	moniter.exe	82
PID 2284 wrote to memory of 4176	2284	moniter.exe	82
PID 2284 wrote to memory of 4176	2284	moniter.exe	82

C:\Users\Admin\AppData\Local\Temp\4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35.exe
"C:\Users\Admin\AppData\Local\Temp\4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35.exe" "C:\Users\Admin\AppData\Roaming\moniter.exe"
  2⤵
  PID:4988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\moniter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Users\Admin\AppData\Roaming\moniter.exe
    "C:\Users\Admin\AppData\Roaming\moniter.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Users\Admin\AppData\Roaming\moniter.exe
      "C:\Users\Admin\AppData\Roaming\moniter.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4176

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

moniter.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\moniter.exe.log
Size 706B
SHA256 363502eb2a4e53ba02d2d85412b901fcf8e06de221736bdffa949799ef3d21e3
MD5 2ef5ef69dadb8865b3d5b58c956077b8
SHA1 af2d869bac00685c745652bbd8b3fe82829a8998
SHA512 66d4db5dd17d88e1d54ea0df3a7211a503dc4355de701259cefccc9f2e4e3ced9534b700099ffbb089a5a3acb082011c80b61801aa14aff76b379ce8f90d4fd3
MD5 SHA1 SHA512

Submit Download

moniter.exe

Path C:\Users\Admin\AppData\Roaming\moniter.exe
Size 760KB
SHA256 4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35
MD5 233e376e4bff30753bf04ad6b7f3a1c5
SHA1 3957ea6d99d93b5d7d4457a900ae1a63ab62fbe9
SHA512 f2c7e89c3bd9d4433bfe20d9ad7a86aab9ffba78efe03544246a90cbb9cc77c19b2aa57ce59bbb1517dae6dabff4a7afe8d358cb7927154883fd0f0ce5575077
SSDEEP 12288:evgL/TdPXQNGwzaepBObPh65+K8uGDsg6TSRwZUbUKkVBJZ:e4L71hegPM5tAT6TGwZUlkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

moniter.exe

Path C:\Users\Admin\AppData\Roaming\moniter.exe
Size 760KB
SHA256 4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35
MD5 233e376e4bff30753bf04ad6b7f3a1c5
SHA1 3957ea6d99d93b5d7d4457a900ae1a63ab62fbe9
SHA512 f2c7e89c3bd9d4433bfe20d9ad7a86aab9ffba78efe03544246a90cbb9cc77c19b2aa57ce59bbb1517dae6dabff4a7afe8d358cb7927154883fd0f0ce5575077
SSDEEP 12288:evgL/TdPXQNGwzaepBObPh65+K8uGDsg6TSRwZUbUKkVBJZ:e4L71hegPM5tAT6TGwZUlkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

moniter.exe

Path C:\Users\Admin\AppData\Roaming\moniter.exe
Size 760KB
SHA256 4ebffc7b4ed1ecd0dc8c68048c13d32a513c42e109ad50ed7171d77686e65e35
MD5 233e376e4bff30753bf04ad6b7f3a1c5
SHA1 3957ea6d99d93b5d7d4457a900ae1a63ab62fbe9
SHA512 f2c7e89c3bd9d4433bfe20d9ad7a86aab9ffba78efe03544246a90cbb9cc77c19b2aa57ce59bbb1517dae6dabff4a7afe8d358cb7927154883fd0f0ce5575077
SSDEEP 12288:evgL/TdPXQNGwzaepBObPh65+K8uGDsg6TSRwZUbUKkVBJZ:e4L71hegPM5tAT6TGwZUlkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1964-131-0x0000000005590000-0x0000000005B34000-memory.dmp

Download

memory/1964-132-0x0000000005110000-0x00000000051A2000-memory.dmp

Download

memory/1964-130-0x00000000005F0000-0x00000000006B4000-memory.dmp

Download

memory/2284-138-0x0000000006270000-0x000000000630C000-memory.dmp

Download

memory/4176-140-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/4176-143-0x0000000007620000-0x0000000007686000-memory.dmp

Download

memory/4176-144-0x0000000007E50000-0x0000000007E5A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads