Malware Analysis Report

2024-11-30 15:58

Sample ID 220724-zr9h5sgchk
Target 5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e
SHA256 5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e
Tags
imminent spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e

Threat Level: Known bad

The file 5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e was found to be: Known bad.

Malicious Activity Summary

imminent spyware trojan

Imminent RAT

Executes dropped EXE

Checks computer location settings

Drops startup file

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

NTFS ADS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-24 20:58

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-24 20:58

Reported

2022-07-24 21:00

Platform

win7-20220718-en

Max time kernel

142s

Max time network

46s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe"

Signatures

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe

"C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe:Zone.Identifier"

Network

N/A

Files

memory/884-54-0x0000000000FE0000-0x00000000010C8000-memory.dmp

memory/884-55-0x00000000004A0000-0x00000000004C6000-memory.dmp

memory/884-56-0x0000000075C41000-0x0000000075C43000-memory.dmp

memory/2036-57-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-24 20:58

Reported

2022-07-24 21:00

Platform

win10v2004-20220721-en

Max time kernel

151s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe"

Signatures

Imminent RAT

trojan spyware imminent

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MsoHtmEd.lnk C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1452 set thread context of 2752 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe\:Zone.Identifier:$DATA C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe:Zone.Identifier C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2480 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe C:\Windows\SysWOW64\cmd.exe
PID 4856 wrote to memory of 1452 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe
PID 4856 wrote to memory of 1452 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe
PID 4856 wrote to memory of 1452 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe
PID 1452 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe C:\Windows\SysWOW64\cmd.exe
PID 1452 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe C:\Windows\SysWOW64\cmd.exe
PID 1452 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe C:\Windows\SysWOW64\cmd.exe
PID 1452 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe
PID 1452 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe
PID 1452 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe
PID 1452 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe
PID 1452 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe
PID 1452 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe
PID 1452 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe
PID 1452 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe

Processes

C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe

"C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe:Zone.Identifier"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe:Zone.Identifier"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
US 20.189.173.11:443 tcp
BE 8.238.110.126:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
BE 8.238.110.126:80 tcp
US 131.253.33.200:443 tcp
US 8.8.8.8:53 linkadrum.nl udp
DE 185.140.53.144:9630 linkadrum.nl tcp
DE 185.140.53.144:9630 linkadrum.nl tcp
DE 185.140.53.144:9630 linkadrum.nl tcp
DE 185.140.53.144:9630 linkadrum.nl tcp
DE 185.140.53.144:9630 linkadrum.nl tcp
DE 185.140.53.144:9630 linkadrum.nl tcp
DE 185.140.53.144:9630 linkadrum.nl tcp

Files

memory/2480-130-0x0000000000520000-0x0000000000608000-memory.dmp

memory/2480-131-0x0000000004EF0000-0x0000000004F12000-memory.dmp

memory/2480-132-0x0000000004F90000-0x0000000004FF6000-memory.dmp

memory/2480-133-0x00000000050A0000-0x0000000005132000-memory.dmp

memory/2480-134-0x0000000004F50000-0x0000000004F72000-memory.dmp

memory/2480-135-0x0000000005310000-0x00000000054D2000-memory.dmp

memory/1708-136-0x0000000000000000-mapping.dmp

memory/2480-137-0x0000000006260000-0x0000000006804000-memory.dmp

memory/4440-138-0x0000000000000000-mapping.dmp

memory/4856-139-0x0000000000000000-mapping.dmp

memory/1452-140-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe

MD5 88494e93da17c74c2857881b8313507c
SHA1 2a35eee7686193af76e9d2e103c2c4a95d7f6de0
SHA256 5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e
SHA512 4cc65b70760072b498e3eb3eef292b2e5c47baecf92d102331708dff19d6d152d0a262114135f6eeec4e77105ab55bdd92af56ccca4bbb3154ac4fbb71ac42b5

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe

MD5 88494e93da17c74c2857881b8313507c
SHA1 2a35eee7686193af76e9d2e103c2c4a95d7f6de0
SHA256 5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e
SHA512 4cc65b70760072b498e3eb3eef292b2e5c47baecf92d102331708dff19d6d152d0a262114135f6eeec4e77105ab55bdd92af56ccca4bbb3154ac4fbb71ac42b5

memory/3952-143-0x0000000000000000-mapping.dmp

memory/1452-144-0x0000000006D10000-0x0000000006DAC000-memory.dmp

memory/2752-145-0x0000000000000000-mapping.dmp

memory/2752-146-0x0000000000400000-0x0000000000456000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsoHtmEd.Exe

MD5 88494e93da17c74c2857881b8313507c
SHA1 2a35eee7686193af76e9d2e103c2c4a95d7f6de0
SHA256 5951cd18ad1dc3b712826bbce265819abb332cb093b066c4a9ce562ffeabd87e
SHA512 4cc65b70760072b498e3eb3eef292b2e5c47baecf92d102331708dff19d6d152d0a262114135f6eeec4e77105ab55bdd92af56ccca4bbb3154ac4fbb71ac42b5

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MsoHtmEd.Exe.log

MD5 51bf8bf8613f9137624f592c20a96aba
SHA1 643c3a00ea78ec4f95fc0b06e23c2be0fcd9f3c7
SHA256 5e7f66ef51c6f7c1764fabfa5ad6de78a03b0e8db95c35fc4902d66b20759ae5
SHA512 b0aeb08775757582fb0cde8dcb73b0922196fab16cae5cc86381b9a7dca8e43ac135450d1114e9b8db50a54437eafa6986e9283d2f19c4c29ba81f62a1f3fb3a

memory/2752-149-0x0000000008020000-0x000000000802A000-memory.dmp