imminent | 747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f

General

Target

747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
Size

1.2MB
MD5

3ce836c2db353abb0ede78c90ca4b956
SHA1

97875f5cb348b28e952789a82fba3905322c4f16
SHA256

747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f
SHA512

224c13dba564710cc88cd565e59e21d816f1154c95f4482927ab883b57b4385842a87a5398305dad12cd717eb800266c425b6253e1affde5bae29b998d2ac066
SSDEEP

24576:Mtb20pksCqT5TBWgNQ7awQVRIPHIHOYlqkLyUZ2CSKd6A:1Pg5tQ7awdPHXUryC55

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe"	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 5108	2416	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
2416	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5108	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5108	vbc.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5108	vbc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 2416	4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe	84
PID 4756 wrote to memory of 2416	4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe	84
PID 4756 wrote to memory of 2416	4756	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe	84
PID 2416 wrote to memory of 5108	2416	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe	86
PID 2416 wrote to memory of 5108	2416	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe	86
PID 2416 wrote to memory of 5108	2416	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe	86
PID 2416 wrote to memory of 5108	2416	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe	86
PID 2416 wrote to memory of 5108	2416	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe	86

C:\Users\Admin\AppData\Local\Temp\747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
"C:\Users\Admin\AppData\Local\Temp\747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Users\Admin\AppData\Local\Temp\747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
  "C:\Users\Admin\AppData\Local\Temp\747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\431745" "C:\Users\Admin\AppData\Local\Temp\747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\431745

Filesize
18KB

MD5
4f05ae9813ba8650fb68dfa80fd648c8

SHA1
91d715de6f2a937c810497acf8a647815c7d40ca

SHA256
1ed1cd3d17b48dd1549d7441575eddffbfddb2a0a72894fda9330edae155b216

SHA512
978b5b587cdb9cefb154c8a4c3cd16b40d7cc01d0a33060982ffdf452f2b94f5a0ee880818b0855bec7e926e5a96753db5fe46fe85e1e6d7774dd6f9144c4ff3

Download Submit
C:\Users\Admin\AppData\Local\Temp\incl1

Filesize
18KB

MD5
f1aea9efe24e452d8a9eb0a4842544f7

SHA1
164b9432f979a9cb4d0201e5e0a81b3d495227fe

SHA256
5da7e85eb26c186bfb9c958d7ba60927505d10b98a0085a0ea40ee2bfe4c2805

SHA512
6e6ff192b325ab4504f3048720d612050f9787bc2ed481bdc8440213e68fd1e5b7b2743a216bb46a4e6041d12dca94c439459f6ac5123738e194c59eabbc4c58

Download Submit
C:\Users\Admin\AppData\Local\Temp\incl2

Filesize
355KB

MD5
46d4e1a1da425165cfc29d9524cb3b16

SHA1
e91c7c45d633355a071a09a6a6b9b03ee792653e

SHA256
1112a86e6766836537f01ee0bf64aa0856805b65eabd873805046af130dbe176

SHA512
c67069eda617221a3fc6733d61bfa54b8774b84567a5ec075042704ae08affdde39369d0287f1bba6b2b386daa3c4ca5c7319cc0d95bd4197932ec6c91bbb7b9

Download Submit
memory/5108-143-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/5108-147-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/5108-139-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/5108-140-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/5108-141-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/5108-142-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/5108-144-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/5108-145-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/5108-137-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/5108-149-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/5108-150-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/5108-153-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/5108-155-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/5108-156-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/5108-158-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/5108-159-0x00000000094A0000-0x000000000953C000-memory.dmp

Filesize
624KB

Download
memory/5108-160-0x0000000009AF0000-0x000000000A094000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing