Analysis
- max time kernel
162s - max time network
188s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
- submitted
25/07/2022, 03:57
General
- Target 74cb29b319e8a6c8c3df8afb9c373e2a35466342cf8edf115e455409d635d1d0.docm
- Size 681KB
- Sample220725-eh1vesdfe9
- SHA256 74cb29b319e8a6c8c3df8afb9c373e2a35466342cf8edf115e455409d635d1d0
Malware Config
Signatures
- Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\74cb29b319e8a6c8c3df8afb9c373e2a35466342cf8edf115e455409d635d1d0.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Memsys\ms.exeC:\ProgramData\Memsys\ms.exe2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
ms.exe
ms.exe
memory/1076-141-0x00000000747A0000-0x0000000074D51000-memory.dmp
memory/1076-140-0x00000000747A0000-0x0000000074D51000-memory.dmp
memory/3460-134-0x00007FFE23150000-0x00007FFE23160000-memory.dmp
memory/3460-136-0x00007FFE209A0000-0x00007FFE209B0000-memory.dmp
memory/3460-135-0x00007FFE209A0000-0x00007FFE209B0000-memory.dmp
memory/3460-130-0x00007FFE23150000-0x00007FFE23160000-memory.dmp
memory/3460-133-0x00007FFE23150000-0x00007FFE23160000-memory.dmp
memory/3460-132-0x00007FFE23150000-0x00007FFE23160000-memory.dmp
memory/3460-131-0x00007FFE23150000-0x00007FFE23160000-memory.dmp
memory/3460-143-0x00007FFE23150000-0x00007FFE23160000-memory.dmp
memory/3460-145-0x00007FFE23150000-0x00007FFE23160000-memory.dmp
memory/3460-144-0x00007FFE23150000-0x00007FFE23160000-memory.dmp
memory/3460-146-0x00007FFE23150000-0x00007FFE23160000-memory.dmp