imminent | 54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2022, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe
Size 394KB
Sample220725-v1chjscdcn
SHA256 54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a
MD5 acf4810fac7e2973532fe7c2828644a5
SHA1 b20d237c3a0746bebdfdb54537a085b6be0a96c9
SHA512 281432f69c915fb83bbc9277d6fd05418932abd9c0a9c475848d51719aa2acf1b5904e126a7c7049c8f9451fd4589ff8349a22789d6fbfaf52c23de0af1059f9
MD5 SHA1 SHA512

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SxkHBY.url	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4412 set thread context of 4980	4412	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe	85

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4412	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe
4412	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4980	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4412	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe
Token: SeDebugPrivilege	4980	RegAsm.exe
Token: 33	4980	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4980	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4980	RegAsm.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 3328	4412	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe	82
PID 4412 wrote to memory of 3328	4412	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe	82
PID 4412 wrote to memory of 3328	4412	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe	82
PID 3328 wrote to memory of 4992	3328	csc.exe	84
PID 3328 wrote to memory of 4992	3328	csc.exe	84
PID 3328 wrote to memory of 4992	3328	csc.exe	84
PID 4412 wrote to memory of 4980	4412	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe	85
PID 4412 wrote to memory of 4980	4412	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe	85
PID 4412 wrote to memory of 4980	4412	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe	85
PID 4412 wrote to memory of 4980	4412	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe	85
PID 4412 wrote to memory of 4980	4412	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe	85
PID 4412 wrote to memory of 4980	4412	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe	85
PID 4412 wrote to memory of 4980	4412	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe	85
PID 4412 wrote to memory of 4980	4412	54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe	85

C:\Users\Admin\AppData\Local\Temp\54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe
"C:\Users\Admin\AppData\Local\Temp\54f94da6735e929ed9df310b635ee9353be559dbe9da6e4507ba8640794f8f5a.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\idkcjjoh\idkcjjoh.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA25F.tmp" "c:\Users\Admin\AppData\Local\Temp\idkcjjoh\CSCCBC37F0D7A754933918F69E2B0597BA9.TMP"
    3⤵
    PID:4992
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4980

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RESA25F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA25F.tmp
Size 1KB
SHA256 c03949848f7346942a6d4e7f0bd610932c4351dd94a456e1019141a872b33344
MD5 e166b80cc06ca49b387f8c911ed8b061
SHA1 e89a67f8a0feb30de0644a530da4c1d0db6ffa36
SHA512 becd73ddf6bcec16232375ed547bce130e9b4a447470803ae803ef1cb76cfdfb460a6207cc00b6a8761e799d26e419ad3338e37ffc6b461e11ccbe146fc2a6a7
MD5 SHA1 SHA512

Submit Download

idkcjjoh.dll

Path C:\Users\Admin\AppData\Local\Temp\idkcjjoh\idkcjjoh.dll
Size 7KB
SHA256 e0cc61142389cac54b23b62e8e4812d55b20af3e02084bec19391b320a50c6b5
MD5 81e4076465a88dd3fb796b3f5aa0d226
SHA1 a52e431c5969e2f4ff165cdfda359047dc945401
SHA512 d6a20aa615f645c043194e3050a236066e56028ebea6015b28bd09e0f30374610c6fcfa3ccee46847050f67a136a33815fe44d90a01c7b91a6515ba7ed09fbd7
SSDEEP 96:SeEuEuswU/8FUBA/U0Z9DiJxs/EJGCiKV+Oeq3KRQzNt:SduRWAc0zDiJkEJGjKV+9k
MD5 SHA1 SHA512 SSDEEP

Submit Download

idkcjjoh.pdb

Path C:\Users\Admin\AppData\Local\Temp\idkcjjoh\idkcjjoh.pdb
Size 19KB
SHA256 bfaf633ffb32cb8ab67b35d788d40e2ce2ee1e0afb335f7c7b69397d4abe6290
MD5 1b53136f8be07cf3a3fde7410660a0ea
SHA1 d2d04eab9e77019cdf416d7f65629ebaf3a1fb97
SHA512 5cbcaa9ec0acebbdc8a84720976b9d56980fddc74cdbcaeefd5ac0fcdd5e81fb345ab9843e48e5d6cde57535eb8f272e5b934ba7e63dda4183eca34985b66533
SSDEEP 192:koA7CCPKhSiEb6bCNJwpfrGc5CMp+gRXKp9ftGxI4:6CIbdEU8q4
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSCCBC37F0D7A754933918F69E2B0597BA9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\idkcjjoh\CSCCBC37F0D7A754933918F69E2B0597BA9.TMP
Size 1KB
SHA256 b993226bb3f5169be64125fe4275ae23acf995710dc84c164cfdfd3a4924a10e
MD5 cf0c9f0691604087a65e43fc4319bdcb
SHA1 2c9be1a6112292f50833ae4a44b20378aea2e35a
SHA512 4236d118485a8c3c943287b8eb82a80a2a8c4705ea17f9e355eb3f4ca0c3507e9d42609927a77d0714a717148c054794451450985d0b8583afb28ec93ad0fbf6
MD5 SHA1 SHA512

Submit Download

idkcjjoh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\idkcjjoh\idkcjjoh.0.cs
Size 4KB
SHA256 afbbd33bf64b013211b3be505f52e77b776d4ef38ca255761f3235e067190bd2
MD5 76760a802f1b18b2e69e6801fa1c1315
SHA1 e45805bac4d3c7dce467e426dbd351aba7bec31e
SHA512 b5546a3fb1fca14b7d5c00c30a5fbe3df3ce5c324caeed5a7955c8f8c479a54bed747ce099ab74c09406144266d25542201b53edb828df78366db93c47c80e05
SSDEEP 96:JoUX1V01zFV3T6pdz+GtT/KKmUlh3xu99RciLVbrddvwvM7V4xsS/PE:N6FVDSz+GF/Xlh3Udxbz4kx42oc
MD5 SHA1 SHA512 SSDEEP

Submit Download

idkcjjoh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\idkcjjoh\idkcjjoh.cmdline
Size 312B
SHA256 8a7f97251482e1aa46fb625f6bb1987999b8bd8220f364d4c6834aa59a365778
MD5 ae569583b08e39d8e9cf612836c7ec9d
SHA1 d840ad7e4b8305a507375dd254868f8231517416
SHA512 da22ff8b4cf795b0dfbc5a9f9cb7e38cca7f6adc7a403e43f9e117a90bb0d17c902d62aace038cb3684ca2587b3c58aeb4d178cd1d0bb501f5cd787ee57d5012
MD5 SHA1 SHA512

Submit Download

memory/4412-130-0x0000000000F60000-0x0000000000FC8000-memory.dmp

Download

memory/4412-139-0x00000000059D0000-0x0000000005A62000-memory.dmp

Download

memory/4412-140-0x0000000006010000-0x00000000060AC000-memory.dmp

Download

memory/4980-142-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4980-143-0x0000000074940000-0x0000000074EF1000-memory.dmp

Download

memory/4980-144-0x0000000074940000-0x0000000074EF1000-memory.dmp

Download