imminent | 5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57

General

Target

5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe
Size

723KB
MD5

e9e6541b43dcab620ddd1f9e4103e941
SHA1

cadbddde45f268fca1b6523d21d7e07c85e225ab
SHA256

5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57
SHA512

c9b9bfcc86c87246774ae6c84a34e3c5b9ba885827c06de186d883dfd94433a5c9fa2c6c97396d30d94bb3298e322a80ad18468cb95480a093b6abe6379ab93d

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 1 IoCs

pid	Process
4512	svhost.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1472 set thread context of 4512	1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe	87

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe
File created	C:\Windows\assembly\Desktop.ini	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\clearlink\clearlink.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe
1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4512	svhost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe
Token: 33	1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe
Token: SeIncBasePriorityPrivilege	1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe
Token: SeDebugPrivilege	4512	svhost.exe
Token: 33	4512	svhost.exe
Token: SeIncBasePriorityPrivilege	4512	svhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4512	svhost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 2332	1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe	84
PID 1472 wrote to memory of 2332	1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe	84
PID 1472 wrote to memory of 2332	1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe	84
PID 2332 wrote to memory of 4448	2332	cmd.exe	86
PID 2332 wrote to memory of 4448	2332	cmd.exe	86
PID 2332 wrote to memory of 4448	2332	cmd.exe	86
PID 1472 wrote to memory of 4512	1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe	87
PID 1472 wrote to memory of 4512	1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe	87
PID 1472 wrote to memory of 4512	1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe	87
PID 1472 wrote to memory of 4512	1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe	87
PID 1472 wrote to memory of 4512	1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe	87
PID 1472 wrote to memory of 4512	1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe	87
PID 1472 wrote to memory of 4512	1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe	87
PID 1472 wrote to memory of 4512	1472	5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe	87

C:\Users\Admin\AppData\Local\Temp\5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe
"C:\Users\Admin\AppData\Local\Temp\5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe"
  2⤵
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\clearlink\clearlink.exe.lnk" /f
    3⤵
    PID:4448
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4512

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
89KB

MD5
84c42d0f2c1ae761bef884638bc1eacd

SHA1
4353881e7f4e9c7610f4e0489183b55bb58bb574

SHA256
331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3

SHA512
43c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
89KB

MD5
84c42d0f2c1ae761bef884638bc1eacd

SHA1
4353881e7f4e9c7610f4e0489183b55bb58bb574

SHA256
331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3

SHA512
43c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87

Download Submit
C:\Users\Admin\AppData\Roaming\clearlink\clearlink.exe

Filesize
723KB

MD5
e9e6541b43dcab620ddd1f9e4103e941

SHA1
cadbddde45f268fca1b6523d21d7e07c85e225ab

SHA256
5ef049d767e1e38d1ff7dc339b8f962d880ab684396aac8e5e7797a2b6939c57

SHA512
c9b9bfcc86c87246774ae6c84a34e3c5b9ba885827c06de186d883dfd94433a5c9fa2c6c97396d30d94bb3298e322a80ad18468cb95480a093b6abe6379ab93d

Download Submit
memory/1472-130-0x00000000751D0000-0x0000000075781000-memory.dmp

Filesize
5.7MB

Download
memory/1472-133-0x00000000751D0000-0x0000000075781000-memory.dmp

Filesize
5.7MB

Download
memory/1472-140-0x00000000751D0000-0x0000000075781000-memory.dmp

Filesize
5.7MB

Download
memory/4512-139-0x00000000751D0000-0x0000000075781000-memory.dmp

Filesize
5.7MB

Download
memory/4512-141-0x00000000751D0000-0x0000000075781000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing