Analysis

  • max time kernel
    152s
  • max time network
    191s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    31-07-2022 23:57

General

  • Target

    5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638.exe

  • Size

    321KB

  • MD5

    4766270285f7bb69b2a93214c650f152

  • SHA1

    8a9ddce8c3ca9674adb69af3930a7424cfde9553

  • SHA256

    5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638

  • SHA512

    80b4d81c45c07b96226109a52c476ba4370377dc20609a274baae75659f72fc962df0b451d1e838a0b13df34a32c62f051225e77a79695055831a0e02148900d

Score
10/10

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638.exe
    "C:\Users\Admin\AppData\Local\Temp\5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1540
    • C:\Users\Admin\AppData\Local\Temp\5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638\5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638.exe
      "C:\Users\Admin\AppData\Local\Temp\5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638\5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1228
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:548
      • C:\Windows\SysWOW64\PING.EXE
        ping 1.1.1.1 -n 1 -w 1000
        3⤵
        • Runs ping.exe
        PID:1660
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:2032

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638\5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638.exe

      Filesize

      321KB

      MD5

      4766270285f7bb69b2a93214c650f152

      SHA1

      8a9ddce8c3ca9674adb69af3930a7424cfde9553

      SHA256

      5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638

      SHA512

      80b4d81c45c07b96226109a52c476ba4370377dc20609a274baae75659f72fc962df0b451d1e838a0b13df34a32c62f051225e77a79695055831a0e02148900d

    • C:\Users\Admin\AppData\Local\Temp\5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638\5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638.exe

      Filesize

      321KB

      MD5

      4766270285f7bb69b2a93214c650f152

      SHA1

      8a9ddce8c3ca9674adb69af3930a7424cfde9553

      SHA256

      5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638

      SHA512

      80b4d81c45c07b96226109a52c476ba4370377dc20609a274baae75659f72fc962df0b451d1e838a0b13df34a32c62f051225e77a79695055831a0e02148900d

    • \Users\Admin\AppData\Local\Temp\5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638\5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638.exe

      Filesize

      321KB

      MD5

      4766270285f7bb69b2a93214c650f152

      SHA1

      8a9ddce8c3ca9674adb69af3930a7424cfde9553

      SHA256

      5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638

      SHA512

      80b4d81c45c07b96226109a52c476ba4370377dc20609a274baae75659f72fc962df0b451d1e838a0b13df34a32c62f051225e77a79695055831a0e02148900d

    • \Users\Admin\AppData\Local\Temp\5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638\5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638.exe

      Filesize

      321KB

      MD5

      4766270285f7bb69b2a93214c650f152

      SHA1

      8a9ddce8c3ca9674adb69af3930a7424cfde9553

      SHA256

      5d4d3f7daf91ec1aa660497ee91bbd5a2c363f613b7d965189dace271a244638

      SHA512

      80b4d81c45c07b96226109a52c476ba4370377dc20609a274baae75659f72fc962df0b451d1e838a0b13df34a32c62f051225e77a79695055831a0e02148900d

    • memory/548-63-0x0000000000000000-mapping.dmp

    • memory/1228-59-0x0000000000000000-mapping.dmp

    • memory/1228-66-0x0000000074C30000-0x00000000751DB000-memory.dmp

      Filesize

      5.7MB

    • memory/1228-67-0x0000000074C30000-0x00000000751DB000-memory.dmp

      Filesize

      5.7MB

    • memory/1540-54-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

      Filesize

      8KB

    • memory/1540-56-0x0000000074C30000-0x00000000751DB000-memory.dmp

      Filesize

      5.7MB

    • memory/1540-55-0x0000000074C30000-0x00000000751DB000-memory.dmp

      Filesize

      5.7MB

    • memory/1540-65-0x0000000074C30000-0x00000000751DB000-memory.dmp

      Filesize

      5.7MB

    • memory/1660-64-0x0000000000000000-mapping.dmp