Analysis

  • max time kernel
    151s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-10-2022 10:02

General

  • Target

    1285e6795ba5bfce053f06ef0294d905b8232a49949f6d5e0f54767b0aa3c7df.exe

  • Size

    1.8MB

  • MD5

    ea782275c1bb27082a299dc3cf210dde

  • SHA1

    3e1237d9965a5fce404154cd3a8583da6a3312a4

  • SHA256

    1285e6795ba5bfce053f06ef0294d905b8232a49949f6d5e0f54767b0aa3c7df

  • SHA512

    4a19dd7de63fd17df99a7552d206d5eb4a0d3a12ebe79cf24c580ca88ed4e9c18e3fdb795154899becba4e87ac85b9952493d6326e6ef66f86004f0c0883c244

  • SSDEEP

    49152:PKxsFoq3ZDUcvA0YzmPfndN4HKcw0aUBT2N:P8sRJJYzm3f4HQEBT

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1285e6795ba5bfce053f06ef0294d905b8232a49949f6d5e0f54767b0aa3c7df.exe
    "C:\Users\Admin\AppData\Local\Temp\1285e6795ba5bfce053f06ef0294d905b8232a49949f6d5e0f54767b0aa3c7df.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:376
    • C:\Users\Admin\AppData\Local\Temp\ZLQJVWNeqg20OMaX.exe
      "C:\Users\Admin\AppData\Local\Temp\ZLQJVWNeqg20OMaX.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3424
      • C:\Users\Admin\AppData\Local\Temp\3OcpUoMxERayVv5a.exe
        "C:\Users\Admin\AppData\Local\Temp\3OcpUoMxERayVv5a.exe"
        3⤵
        • Executes dropped EXE
        PID:3756
      • C:\Users\Admin\AppData\Local\Temp\ZLQJVWNeqg20OMaX.exe
        "C:\Users\Admin\AppData\Local\Temp\ZLQJVWNeqg20OMaX.exe" Microsoft
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4572
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 1688
        3⤵
        • Program crash
        PID:1208
    • C:\Users\Admin\AppData\Local\Temp\1285e6795ba5bfce053f06ef0294d905b8232a49949f6d5e0f54767b0aa3c7df.exe
      "C:\Users\Admin\AppData\Local\Temp\1285e6795ba5bfce053f06ef0294d905b8232a49949f6d5e0f54767b0aa3c7df.exe" Windows
      2⤵
        PID:1764
      • C:\Users\Admin\AppData\Local\Temp\1285e6795ba5bfce053f06ef0294d905b8232a49949f6d5e0f54767b0aa3c7df.exe
        "C:\Users\Admin\AppData\Local\Temp\1285e6795ba5bfce053f06ef0294d905b8232a49949f6d5e0f54767b0aa3c7df.exe" Windows
        2⤵
          PID:2792
        • C:\Users\Admin\AppData\Local\Temp\1285e6795ba5bfce053f06ef0294d905b8232a49949f6d5e0f54767b0aa3c7df.exe
          "C:\Users\Admin\AppData\Local\Temp\1285e6795ba5bfce053f06ef0294d905b8232a49949f6d5e0f54767b0aa3c7df.exe" Windows
          2⤵
          • Adds Run key to start application
          • Drops desktop.ini file(s)
          • Drops file in Windows directory
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4356
        • C:\Users\Admin\AppData\Local\Temp\1285e6795ba5bfce053f06ef0294d905b8232a49949f6d5e0f54767b0aa3c7df.exe
          "C:\Users\Admin\AppData\Local\Temp\1285e6795ba5bfce053f06ef0294d905b8232a49949f6d5e0f54767b0aa3c7df.exe" Windows
          2⤵
            PID:1836
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 1696
            2⤵
            • Program crash
            PID:220
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 376 -ip 376
          1⤵
            PID:1028
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3424 -ip 3424
            1⤵
              PID:4824

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\3OcpUoMxERayVv5a.exe

              Filesize

              131KB

              MD5

              af9e24849dec91baa236d309b6fc54df

              SHA1

              6effffed3f777e7fe33396430cde07752b50bae6

              SHA256

              82c13bcdcf40d251835cf5792b75f919c8c90e88755beeacd0769cad798cebce

              SHA512

              1318f8ea1ff63fcd20d10b62a1a33fa77f1625eab6c18d39942e8536e3857fdc001d50fd3e30810cb85bdce77364a9c2b82a8260e0ee7b3650e5b50b262e804c

            • C:\Users\Admin\AppData\Local\Temp\3OcpUoMxERayVv5a.exe

              Filesize

              131KB

              MD5

              af9e24849dec91baa236d309b6fc54df

              SHA1

              6effffed3f777e7fe33396430cde07752b50bae6

              SHA256

              82c13bcdcf40d251835cf5792b75f919c8c90e88755beeacd0769cad798cebce

              SHA512

              1318f8ea1ff63fcd20d10b62a1a33fa77f1625eab6c18d39942e8536e3857fdc001d50fd3e30810cb85bdce77364a9c2b82a8260e0ee7b3650e5b50b262e804c

            • C:\Users\Admin\AppData\Local\Temp\ZLQJVWNeqg20OMaX.exe

              Filesize

              852KB

              MD5

              5e8c019883c1c5bd0fdac3663a863e94

              SHA1

              ad53d21c86af70b7fc791f5879f578758aa04525

              SHA256

              06eb77201d9df4c1cec9da72cd23f8d29fd624a9cc8c47da8ddc8098f5937676

              SHA512

              1a4281712e500276cb1b8d0f336bb2804de24d6fcc6eeb9ac4bda535613423639176e5cc870110e70d78bcf81c64594be8b87ce20755d4af9afd5e1d66fd3716

            • C:\Users\Admin\AppData\Local\Temp\ZLQJVWNeqg20OMaX.exe

              Filesize

              852KB

              MD5

              5e8c019883c1c5bd0fdac3663a863e94

              SHA1

              ad53d21c86af70b7fc791f5879f578758aa04525

              SHA256

              06eb77201d9df4c1cec9da72cd23f8d29fd624a9cc8c47da8ddc8098f5937676

              SHA512

              1a4281712e500276cb1b8d0f336bb2804de24d6fcc6eeb9ac4bda535613423639176e5cc870110e70d78bcf81c64594be8b87ce20755d4af9afd5e1d66fd3716

            • C:\Users\Admin\AppData\Local\Temp\ZLQJVWNeqg20OMaX.exe

              Filesize

              852KB

              MD5

              5e8c019883c1c5bd0fdac3663a863e94

              SHA1

              ad53d21c86af70b7fc791f5879f578758aa04525

              SHA256

              06eb77201d9df4c1cec9da72cd23f8d29fd624a9cc8c47da8ddc8098f5937676

              SHA512

              1a4281712e500276cb1b8d0f336bb2804de24d6fcc6eeb9ac4bda535613423639176e5cc870110e70d78bcf81c64594be8b87ce20755d4af9afd5e1d66fd3716

            • C:\Users\Admin\AppData\Roaming\Imminent\Logs\29-10-2022

              Filesize

              79B

              MD5

              656fce74b4983c534f96b89fb03d2dcb

              SHA1

              3cdb281c6c3a35a09a856ee154c8d8e3193283e1

              SHA256

              98d1b971f24099222dd5aaded3cfefce19a825dfee0bbcd460d4904fe318d56c

              SHA512

              1c66110aca02268b6f7e0c59bd3baaa41f6c3db83a8b5fc32c5adcbdbbdb167adf534bd8b26ace659d047547cff36f495b1c8db6393b9f7a6ed7733ab9ad564f

            • memory/376-144-0x000000007EFB0000-0x000000007F044000-memory.dmp

              Filesize

              592KB

            • memory/376-154-0x00000000748E0000-0x0000000074E91000-memory.dmp

              Filesize

              5.7MB

            • memory/376-133-0x00000000748E0000-0x0000000074E91000-memory.dmp

              Filesize

              5.7MB

            • memory/376-132-0x00000000748E0000-0x0000000074E91000-memory.dmp

              Filesize

              5.7MB

            • memory/1764-137-0x0000000000000000-mapping.dmp

            • memory/1836-139-0x0000000000000000-mapping.dmp

            • memory/2792-138-0x0000000000000000-mapping.dmp

            • memory/3424-142-0x00000000748E0000-0x0000000074E91000-memory.dmp

              Filesize

              5.7MB

            • memory/3424-134-0x0000000000000000-mapping.dmp

            • memory/3424-155-0x00000000748E0000-0x0000000074E91000-memory.dmp

              Filesize

              5.7MB

            • memory/3424-152-0x000000007F590000-0x000000007F624000-memory.dmp

              Filesize

              592KB

            • memory/3756-153-0x00007FF854ED0000-0x00007FF855906000-memory.dmp

              Filesize

              10.2MB

            • memory/3756-145-0x0000000000000000-mapping.dmp

            • memory/4356-143-0x00000000748E0000-0x0000000074E91000-memory.dmp

              Filesize

              5.7MB

            • memory/4356-141-0x0000000000400000-0x0000000000494000-memory.dmp

              Filesize

              592KB

            • memory/4356-156-0x00000000748E0000-0x0000000074E91000-memory.dmp

              Filesize

              5.7MB

            • memory/4356-140-0x0000000000000000-mapping.dmp

            • memory/4572-149-0x0000000000400000-0x0000000000494000-memory.dmp

              Filesize

              592KB

            • memory/4572-148-0x0000000000000000-mapping.dmp

            • memory/4572-151-0x00000000748E0000-0x0000000074E91000-memory.dmp

              Filesize

              5.7MB

            • memory/4572-158-0x00000000748E0000-0x0000000074E91000-memory.dmp

              Filesize

              5.7MB