imminent | 4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe
Size 3.0MB
Sample220720-wt1ggaecd9
SHA256 4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3
MD5 e5a53ff7a92df0d1c2fc27dee397085b
SHA1 5e65e731a08d0d43243fa3160e65dea04021f3ee
SHA512 bef1f223939a5278a1dca90e2a46a0ba0422109207c2501df8f5949cc9ea36af8ff3821173cb4c4bb795f0cae1cb9ef197d905a0396212169f6946eda289effd
MD5 SHA1 SHA512

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 2 IoCs

pid	Process
3412	File.exe
4620	svhost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1178428168-2939480073-3055857545-1000\Control Panel\International\Geo\Nation	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Disk.exe.lnk	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2640 set thread context of 4620	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	79

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe
File created	C:\Windows\assembly\Desktop.ini	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4104	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\FolderN\Disk.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe
2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe
2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe
2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4620	svhost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe
Token: SeDebugPrivilege	4620	svhost.exe
Token: 33	4620	svhost.exe
Token: SeIncBasePriorityPrivilege	4620	svhost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3412	File.exe
4620	svhost.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 3412	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	75
PID 2640 wrote to memory of 3412	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	75
PID 2640 wrote to memory of 3656	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	76
PID 2640 wrote to memory of 3656	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	76
PID 2640 wrote to memory of 3656	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	76
PID 3656 wrote to memory of 4952	3656	cmd.exe	78
PID 3656 wrote to memory of 4952	3656	cmd.exe	78
PID 3656 wrote to memory of 4952	3656	cmd.exe	78
PID 2640 wrote to memory of 4620	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	79
PID 2640 wrote to memory of 4620	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	79
PID 2640 wrote to memory of 4620	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	79
PID 2640 wrote to memory of 4620	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	79
PID 2640 wrote to memory of 4620	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	79
PID 2640 wrote to memory of 4620	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	79
PID 2640 wrote to memory of 4620	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	79
PID 2640 wrote to memory of 4620	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	79
PID 2640 wrote to memory of 4632	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	81
PID 2640 wrote to memory of 4632	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	81
PID 2640 wrote to memory of 4632	2640	4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe	81
PID 4632 wrote to memory of 4104	4632	cmd.exe	82
PID 4632 wrote to memory of 4104	4632	cmd.exe	82
PID 4632 wrote to memory of 4104	4632	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe
"C:\Users\Admin\AppData\Local\Temp\4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\File.exe
  "C:\Users\Admin\AppData\Local\Temp\File.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3412
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe"
  2⤵
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderN\Disk.exe.lnk" /f
    3⤵
    PID:4952
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\FolderN\Disk.exe.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 300
    3⤵
    - Delays execution with timeout.exe
    PID:4104

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

File.exe

Path C:\Users\Admin\AppData\Local\Temp\File.exe
Size 2.8MB
SHA256 f52a1e9ccd364f3761c064db4e0eb23941742b6d9bd9f57eb14bbcb41e52f5f8
MD5 ca5a97c5173a403d47a538a193feb323
SHA1 f857ce6bc5f931b472596eb201d5207cfea8dce3
SHA512 7ca62c128c8332a165ad36246adb1b011d39089ed151736ab7c3f6ab994d02de2a7ee5234a8ddab9d62b2df5dece9000a8f1dc57d4910c0cc902ff61467f7e3f
SSDEEP 49152:pU4jr6bO7mFOCPtdl9H1WXsrsE9E1h0FdN5mDtIiGE:m9o1h0jN5mu1E
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 89KB
SHA256 331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3
MD5 84c42d0f2c1ae761bef884638bc1eacd
SHA1 4353881e7f4e9c7610f4e0489183b55bb58bb574
SHA512 43c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87
SSDEEP 1536:H96ZJwk1oO+huJs4HN0Auo7G+DKSOanlgVO3GGLJ:IMFCHV1G+DKSOanlEud
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 89KB
SHA256 331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3
MD5 84c42d0f2c1ae761bef884638bc1eacd
SHA1 4353881e7f4e9c7610f4e0489183b55bb58bb574
SHA512 43c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87
SSDEEP 1536:H96ZJwk1oO+huJs4HN0Auo7G+DKSOanlgVO3GGLJ:IMFCHV1G+DKSOanlEud
MD5 SHA1 SHA512 SSDEEP

Submit Download

Disk.exe

Path C:\Users\Admin\AppData\Roaming\FolderN\Disk.exe
Size 3.0MB
SHA256 4e3fdd0ae1a9f3d87cc4823084f514a8fd324b4972ebcc9ac01e9b89643f60f3
MD5 e5a53ff7a92df0d1c2fc27dee397085b
SHA1 5e65e731a08d0d43243fa3160e65dea04021f3ee
SHA512 bef1f223939a5278a1dca90e2a46a0ba0422109207c2501df8f5949cc9ea36af8ff3821173cb4c4bb795f0cae1cb9ef197d905a0396212169f6946eda289effd
SSDEEP 49152:MzXOW1dfIMduCPld2NwKXqVuURsi/NeI+aBI8Z/GmhiUdUmG3pP8m5XO16yKp/Gg:wXDOSH2AIURsAeI+AIw/G5xO1AJGg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Disk.exe.bat

Path C:\Users\Admin\AppData\Roaming\FolderN\Disk.exe.bat
Size 201B
SHA256 76f2105ea4c3b9dec72762a3cb891aa3b1b8197c2e019359b51ae4347b110aba
MD5 5dba8b59916f3fa96a2c9cb28703cc6c
SHA1 e3532dc407fe6959d8eba5f31548b2242c449001
SHA512 6a14740964415a1949e78a654f0f9959de5f396dbcf1adedbc013dcd3e45ab082b6685082f1ada28c378781f692b77fbbfa694f1a09d64019c33015608b5845f
MD5 SHA1 SHA512

Submit Download

memory/2640-131-0x00000000745E0000-0x0000000074B91000-memory.dmp

Download

memory/2640-130-0x00000000745E0000-0x0000000074B91000-memory.dmp

Download

memory/2640-145-0x00000000745E0000-0x0000000074B91000-memory.dmp

Download

memory/4620-138-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4620-144-0x00000000745E0000-0x0000000074B91000-memory.dmp

Download

memory/4620-146-0x00000000745E0000-0x0000000074B91000-memory.dmp

Download