Analysis

  • max time kernel
    152s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-09-2022 13:43

General

  • Target

    35a37aefffbaae09847f3e823969e8d7ecd55a5fc8a9d3a078119ef07695a1f2.exe

  • Size

    354KB

  • MD5

    e141967a41334d6dd1d7c7adac5ca003

  • SHA1

    6f6200ad4360b17ee575b4a761dadc213d34e1b5

  • SHA256

    35a37aefffbaae09847f3e823969e8d7ecd55a5fc8a9d3a078119ef07695a1f2

  • SHA512

    53cad1f2170ec291b2088ac290a8d47c868d2e53d5276d9cf9efe5d917461f98bbe28c03eee7bf5e354e546b420f60c2f9ec31901566b5e27817a558392324d9

  • SSDEEP

    6144:copjgUqY88VzWVa9zTRf7pbyvDROyEcZ:cJUDpyg5da

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35a37aefffbaae09847f3e823969e8d7ecd55a5fc8a9d3a078119ef07695a1f2.exe
    "C:\Users\Admin\AppData\Local\Temp\35a37aefffbaae09847f3e823969e8d7ecd55a5fc8a9d3a078119ef07695a1f2.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Users\Admin\AppData\Local\Temp\35a37aefffbaae09847f3e823969e8d7ecd55a5fc8a9d3a078119ef07695a1f2\35a37aefffbaae09847f3e823969e8d7ecd55a5fc8a9d3a078119ef07695a1f2.exe
      "C:\Users\Admin\AppData\Local\Temp\35a37aefffbaae09847f3e823969e8d7ecd55a5fc8a9d3a078119ef07695a1f2\35a37aefffbaae09847f3e823969e8d7ecd55a5fc8a9d3a078119ef07695a1f2.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Windows\SysWOW64\Taskmgr.exe
        "C:\Windows\System32\Taskmgr.exe"
        3⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4044
      • C:\Users\Admin\AppData\Local\Temp\57080.exe
        "C:\Users\Admin\AppData\Local\Temp\57080.exe"
        3⤵
        • Executes dropped EXE
        PID:2464
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\35a37aefffbaae09847f3e823969e8d7ecd55a5fc8a9d3a078119ef07695a1f2.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4864
      • C:\Windows\SysWOW64\PING.EXE
        ping 1.1.1.1 -n 1 -w 1000
        3⤵
        • Runs ping.exe
        PID:1392

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\35a37aefffbaae09847f3e823969e8d7ecd55a5fc8a9d3a078119ef07695a1f2\35a37aefffbaae09847f3e823969e8d7ecd55a5fc8a9d3a078119ef07695a1f2.exe

    Filesize

    354KB

    MD5

    e141967a41334d6dd1d7c7adac5ca003

    SHA1

    6f6200ad4360b17ee575b4a761dadc213d34e1b5

    SHA256

    35a37aefffbaae09847f3e823969e8d7ecd55a5fc8a9d3a078119ef07695a1f2

    SHA512

    53cad1f2170ec291b2088ac290a8d47c868d2e53d5276d9cf9efe5d917461f98bbe28c03eee7bf5e354e546b420f60c2f9ec31901566b5e27817a558392324d9

  • C:\Users\Admin\AppData\Local\Temp\35a37aefffbaae09847f3e823969e8d7ecd55a5fc8a9d3a078119ef07695a1f2\35a37aefffbaae09847f3e823969e8d7ecd55a5fc8a9d3a078119ef07695a1f2.exe

    Filesize

    354KB

    MD5

    e141967a41334d6dd1d7c7adac5ca003

    SHA1

    6f6200ad4360b17ee575b4a761dadc213d34e1b5

    SHA256

    35a37aefffbaae09847f3e823969e8d7ecd55a5fc8a9d3a078119ef07695a1f2

    SHA512

    53cad1f2170ec291b2088ac290a8d47c868d2e53d5276d9cf9efe5d917461f98bbe28c03eee7bf5e354e546b420f60c2f9ec31901566b5e27817a558392324d9

  • C:\Users\Admin\AppData\Local\Temp\57080.exe

    Filesize

    43KB

    MD5

    fec701bbc6a35f9089309f34afbed29c

    SHA1

    64a546ef3d03c7af30cd5624db0ad2fd6f611e8f

    SHA256

    d69c8a09657c966ff51f3451fc762c8a1519cda2dff109de24aab2e33aaa4409

    SHA512

    b6b466df455cb80e91c5748f4f8847ca0a67e8bb07c70f40c5a548490739d2501093e8343474fcbdf6d3c03dc3e9c0019d87b2283315ae1e63c6bda4a97c807b

  • \??\c:\users\admin\appdata\local\temp\57080.exe

    Filesize

    43KB

    MD5

    fec701bbc6a35f9089309f34afbed29c

    SHA1

    64a546ef3d03c7af30cd5624db0ad2fd6f611e8f

    SHA256

    d69c8a09657c966ff51f3451fc762c8a1519cda2dff109de24aab2e33aaa4409

    SHA512

    b6b466df455cb80e91c5748f4f8847ca0a67e8bb07c70f40c5a548490739d2501093e8343474fcbdf6d3c03dc3e9c0019d87b2283315ae1e63c6bda4a97c807b

  • memory/1392-140-0x0000000000000000-mapping.dmp

  • memory/2464-146-0x0000000000050000-0x0000000000060000-memory.dmp

    Filesize

    64KB

  • memory/2464-143-0x0000000000000000-mapping.dmp

  • memory/4044-141-0x0000000000000000-mapping.dmp

  • memory/4648-132-0x0000000074F70000-0x0000000075521000-memory.dmp

    Filesize

    5.7MB

  • memory/4648-138-0x0000000074F70000-0x0000000075521000-memory.dmp

    Filesize

    5.7MB

  • memory/4648-133-0x0000000074F70000-0x0000000075521000-memory.dmp

    Filesize

    5.7MB

  • memory/4864-137-0x0000000000000000-mapping.dmp

  • memory/4972-139-0x0000000074F70000-0x0000000075521000-memory.dmp

    Filesize

    5.7MB

  • memory/4972-142-0x0000000074F70000-0x0000000075521000-memory.dmp

    Filesize

    5.7MB

  • memory/4972-134-0x0000000000000000-mapping.dmp