Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    19-10-2022 22:30

General

  • Target

    78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe

  • Size

    293KB

  • MD5

    5090efbff6669644e61b70a6614e53b0

  • SHA1

    eac8dc59f54f265fa2e71a265c42299f34378034

  • SHA256

    78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157

  • SHA512

    ed8dc4df183e89fadaf2691a74822ee225893891a413164a9539c50da1fbcfdfd3b3b3fe497d31830d09e8eaa3bad1ef21d275ab56fa47a374a1a784c4d8ae49

  • SSDEEP

    6144:bpJXZO9tcfeMV8vOOrrN051yp2p6FEgN/hVvJy44ALvremUYDQctl:bP1feGIN054b5/vJyF0remUTI

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe
    "C:\Users\Admin\AppData\Local\Temp\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Users\Admin\AppData\Local\Temp\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe
      "C:\Users\Admin\AppData\Local\Temp\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:668
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Windows\SysWOW64\PING.EXE
        ping 1.1.1.1 -n 1 -w 1000
        3⤵
        • Runs ping.exe
        PID:1224

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe

    Filesize

    293KB

    MD5

    5090efbff6669644e61b70a6614e53b0

    SHA1

    eac8dc59f54f265fa2e71a265c42299f34378034

    SHA256

    78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157

    SHA512

    ed8dc4df183e89fadaf2691a74822ee225893891a413164a9539c50da1fbcfdfd3b3b3fe497d31830d09e8eaa3bad1ef21d275ab56fa47a374a1a784c4d8ae49

  • C:\Users\Admin\AppData\Local\Temp\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe

    Filesize

    293KB

    MD5

    5090efbff6669644e61b70a6614e53b0

    SHA1

    eac8dc59f54f265fa2e71a265c42299f34378034

    SHA256

    78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157

    SHA512

    ed8dc4df183e89fadaf2691a74822ee225893891a413164a9539c50da1fbcfdfd3b3b3fe497d31830d09e8eaa3bad1ef21d275ab56fa47a374a1a784c4d8ae49

  • \Users\Admin\AppData\Local\Temp\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe

    Filesize

    293KB

    MD5

    5090efbff6669644e61b70a6614e53b0

    SHA1

    eac8dc59f54f265fa2e71a265c42299f34378034

    SHA256

    78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157

    SHA512

    ed8dc4df183e89fadaf2691a74822ee225893891a413164a9539c50da1fbcfdfd3b3b3fe497d31830d09e8eaa3bad1ef21d275ab56fa47a374a1a784c4d8ae49

  • \Users\Admin\AppData\Local\Temp\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157\78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157.exe

    Filesize

    293KB

    MD5

    5090efbff6669644e61b70a6614e53b0

    SHA1

    eac8dc59f54f265fa2e71a265c42299f34378034

    SHA256

    78258cd30bee8c94d94b4835d991c04c5a86b991eb6b25e38fb2835874010157

    SHA512

    ed8dc4df183e89fadaf2691a74822ee225893891a413164a9539c50da1fbcfdfd3b3b3fe497d31830d09e8eaa3bad1ef21d275ab56fa47a374a1a784c4d8ae49

  • memory/668-57-0x0000000000000000-mapping.dmp

  • memory/668-64-0x00000000748F0000-0x0000000074E9B000-memory.dmp

    Filesize

    5.7MB

  • memory/668-65-0x00000000748F0000-0x0000000074E9B000-memory.dmp

    Filesize

    5.7MB

  • memory/1224-62-0x0000000000000000-mapping.dmp

  • memory/1324-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

    Filesize

    8KB

  • memory/1324-63-0x00000000748F0000-0x0000000074E9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2040-61-0x0000000000000000-mapping.dmp