imminent | 53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9

Analysis

max time kernel
161s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2022, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe
Size 473KB
Sample220727-a2g47sbff9
SHA256 53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9
MD5 0239df7d47b8002859f89f32d57a1192
SHA1 fb32675eb631aaee30a0c64df192e3230451409e
SHA512 c67138045eec71164f5f79f3244a7576963ef1b19270870d7a98a2c9342165f65670a17327c6a1754b6665765950a75a9c1ebf708af3eed09ddf8e47b4fbba8c
MD5 SHA1 SHA512

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qYbNJF.url	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4412 set thread context of 3836	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe	85

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	RegAsm.exe
File opened for modification	C:\Windows\assembly	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe
4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe
4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe
4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3836	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe
Token: SeDebugPrivilege	3836	RegAsm.exe
Token: 33	3836	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3836	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3836	RegAsm.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 2344	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe	81
PID 4412 wrote to memory of 2344	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe	81
PID 4412 wrote to memory of 2344	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe	81
PID 2344 wrote to memory of 2012	2344	csc.exe	83
PID 2344 wrote to memory of 2012	2344	csc.exe	83
PID 2344 wrote to memory of 2012	2344	csc.exe	83
PID 4412 wrote to memory of 3880	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe	84
PID 4412 wrote to memory of 3880	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe	84
PID 4412 wrote to memory of 3880	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe	84
PID 4412 wrote to memory of 3836	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe	85
PID 4412 wrote to memory of 3836	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe	85
PID 4412 wrote to memory of 3836	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe	85
PID 4412 wrote to memory of 3836	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe	85
PID 4412 wrote to memory of 3836	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe	85
PID 4412 wrote to memory of 3836	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe	85
PID 4412 wrote to memory of 3836	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe	85
PID 4412 wrote to memory of 3836	4412	53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe	85

C:\Users\Admin\AppData\Local\Temp\53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe
"C:\Users\Admin\AppData\Local\Temp\53a96e66d55b55c3da544f192de6ab47d3194ad878d75c9d820b83566703c8d9.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2e42dq00\2e42dq00.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD67.tmp" "c:\Users\Admin\AppData\Local\Temp\2e42dq00\CSC1589B70E1AE44EBC8A673A523495C4.TMP"
    3⤵
    PID:2012
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:3880
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3836

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

2e42dq00.dll

Path C:\Users\Admin\AppData\Local\Temp\2e42dq00\2e42dq00.dll
Size 7KB
SHA256 b813b3bf445023b78820109fe1968d777bad7585f17407cd8c73993372e13fdd
MD5 c1e400a79cc5df1c210eddc91399bd06
SHA1 9dfcb5ff54423b36de4830c3b986f3f0db121f56
SHA512 607bf40970b64bd84da8212230fd3be37b0815e5dc6c1d985c5bcde08aca5055608e6a30db8525844b9deb2d52a295f0e880d2e6a271bbe07d23ecd7ba074ff7
SSDEEP 96:4np0POEn1R2EFu0PdH9egdzyrKvAhsdv09e+s/E892IqkAqKozNt:a006JesC9CE892N7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

2e42dq00.pdb

Path C:\Users\Admin\AppData\Local\Temp\2e42dq00\2e42dq00.pdb
Size 23KB
SHA256 72e8130f2d32916e42f75f4738396740d09bd0fa1590c095372e4de930dd250d
MD5 f2baba0193893e0677b99a44090f029e
SHA1 06ea596a970376d60f4c2e6fce6e342a7510cdbb
SHA512 1403421d32a66a7ee3d8ca40d5db7603699b6b6e09aefb66673ab936d18c4d5bf603fa40c82408047c2deaf0cecb99bdc8424733a57ddad2b872fedd2eb4f6ec
SSDEEP 192:sAaxft2QdFZ5nOiqzfsXCq4a5BNVjtz9q7TRlpF26nCI6nrnTznKq25yZfthwH:EBFZ5nIzfcCqLFJbZfthw
MD5 SHA1 SHA512 SSDEEP

Submit Download

RESCD67.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCD67.tmp
Size 1KB
SHA256 949af7a0c66f7ca95d1750b2afcbb4f0d4b6004b335060defe16727e5eb30465
MD5 205ea7253687164c3aadb24f55b7be19
SHA1 f3792af92c92c9560397ebca7f04184e72c7f87e
SHA512 850800796828f97dd1ac50b4b2087dd0d61c809abf68a6c5357718f841347095b0745c5ef042f6c5e7daa60ad30fa0333d7602bf9c2699b6de7acd862fceff94
MD5 SHA1 SHA512

Submit Download

2e42dq00.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2e42dq00\2e42dq00.0.cs
Size 6KB
SHA256 338b90c57cf1268e4185bd0ee81dd98ecdfb22fed317492fdf520715ff5c8e81
MD5 465c7d9dd71280862c11b8b0081d62f7
SHA1 f0deed8bf011cb9ba2048ce751eea6007c6d0791
SHA512 f683762cf4d18cfc95eaffcd40d3d06514b4c6d6b29605dceb99a2ba4bf28e70b3d24634ba428e466ff84b6aed371b6b58d1df40d3fd41f5e58407e617eebc24
SSDEEP 96:JoUX1V01zAiQs/1f2xyucNoqGtT/KKmUlhou999h7Vbc+o7BbMk:N6AZU2/cmqGF/Xlhhrhb9iBr
MD5 SHA1 SHA512 SSDEEP

Submit Download

2e42dq00.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2e42dq00\2e42dq00.cmdline
Size 312B
SHA256 a96cf98e8958f0c7b9f0d6682c05c0447aedbaf154bf09e1adcc7d69d600e915
MD5 731b51f64a672dc9ef55b4e6eb6e05c3
SHA1 b3f31cc6f5847cf582820c1e46dfdc02d25bf9ee
SHA512 304d17ee7fdd208a10c33e467d16c17d43d4e02ed7d938950f1fe138d9d7b3947451e50204b72e8b661f75feb18e20b2681602f8d7839919c997bb19732b006a
MD5 SHA1 SHA512

Submit Download

CSC1589B70E1AE44EBC8A673A523495C4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2e42dq00\CSC1589B70E1AE44EBC8A673A523495C4.TMP
Size 1KB
SHA256 3d1f7a304c963bb35663b1ef58506827a94b5d0c156829657f9d181eb7f3cbb1
MD5 02b495d1e01d697637cdaa29c9b94ea8
SHA1 c788dda63b7727cc3d01f1953d2e0e2a4e69475a
SHA512 61bffadedbc5ff9e921626f335f92697990f9158bd837010020de2508bb21f08840f51e9319512ccf7df15634e1e2452f8bcec0a3ba9f4ae8ae6277c4be8c352
MD5 SHA1 SHA512

Submit Download

memory/3836-143-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/3836-144-0x0000000074810000-0x0000000074DC1000-memory.dmp

Download

memory/3836-145-0x0000000074810000-0x0000000074DC1000-memory.dmp

Download

memory/4412-130-0x00000000005C0000-0x000000000063C000-memory.dmp

Download

memory/4412-139-0x0000000004FB0000-0x0000000005042000-memory.dmp

Download

memory/4412-140-0x00000000056C0000-0x000000000575C000-memory.dmp

Download