imminent | 5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b

General

Target

5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe
Size

321KB
MD5

b3dfddeb4e98e313447abeba696138a9
SHA1

e896f357b169a6fcab180aa5c7ed2ef05b21fd0c
SHA256

5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b
SHA512

7a2db2991c2fd31c40b1c4406532a8eefae777525e3a4cb28815bf29b5f3a0f3fbe17cc433c065c7b31a8f7f74d55c592841e48bc8e81999a3ada18a17e8c76d

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 1 IoCs

pid	Process
4552	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe
File created	C:\Windows\assembly\Desktop.ini	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1300	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4552	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe
Token: SeDebugPrivilege	4552	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe
Token: 33	4552	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe
Token: SeIncBasePriorityPrivilege	4552	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4552	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 4552	4692	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe	82
PID 4692 wrote to memory of 4552	4692	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe	82
PID 4692 wrote to memory of 4552	4692	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe	82
PID 4692 wrote to memory of 816	4692	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe	83
PID 4692 wrote to memory of 816	4692	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe	83
PID 4692 wrote to memory of 816	4692	5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe	83
PID 816 wrote to memory of 1300	816	cmd.exe	85
PID 816 wrote to memory of 1300	816	cmd.exe	85
PID 816 wrote to memory of 1300	816	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe
"C:\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe
  "C:\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 1000
    3⤵
    - Runs ping.exe
    PID:1300

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Filesize
321KB

MD5
b3dfddeb4e98e313447abeba696138a9

SHA1
e896f357b169a6fcab180aa5c7ed2ef05b21fd0c

SHA256
5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b

SHA512
7a2db2991c2fd31c40b1c4406532a8eefae777525e3a4cb28815bf29b5f3a0f3fbe17cc433c065c7b31a8f7f74d55c592841e48bc8e81999a3ada18a17e8c76d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b\5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b.exe

Filesize
321KB

MD5
b3dfddeb4e98e313447abeba696138a9

SHA1
e896f357b169a6fcab180aa5c7ed2ef05b21fd0c

SHA256
5a8fc9009eb0736d835ee5223ea98cb964d4798147aee07dc60b9bffd1ed710b

SHA512
7a2db2991c2fd31c40b1c4406532a8eefae777525e3a4cb28815bf29b5f3a0f3fbe17cc433c065c7b31a8f7f74d55c592841e48bc8e81999a3ada18a17e8c76d

Download Submit
memory/4552-135-0x00000000751D0000-0x0000000075781000-memory.dmp

Filesize
5.7MB

Download
memory/4552-138-0x00000000751D0000-0x0000000075781000-memory.dmp

Filesize
5.7MB

Download
memory/4692-130-0x00000000751D0000-0x0000000075781000-memory.dmp

Filesize
5.7MB

Download
memory/4692-137-0x00000000751D0000-0x0000000075781000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing