Malware Analysis Report

2024-11-13 15:44

Sample ID 221029-px53ssfhd6
Target e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229
SHA256 e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229
Tags
imminent persistence spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229

Threat Level: Known bad

The file e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229 was found to be: Known bad.

Malicious Activity Summary

imminent persistence spyware trojan

Imminent RAT

Checks computer location settings

Adds Run key to start application

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-29 12:43

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-29 12:43

Reported

2022-10-29 17:47

Platform

win7-20220812-en

Max time kernel

177s

Max time network

46s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe"

Signatures

Imminent RAT

trojan spyware imminent

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Updater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe" C:\Windows\SysWOW64\WScript.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2024 set thread context of 1756 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2024 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 2024 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 2024 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 2024 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 2024 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 2024 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 2024 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 2024 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 2024 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 2024 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe C:\Windows\SysWOW64\cmd.exe
PID 2024 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe C:\Windows\SysWOW64\cmd.exe
PID 2024 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe C:\Windows\SysWOW64\cmd.exe
PID 2024 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe C:\Windows\SysWOW64\cmd.exe
PID 1264 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1264 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1264 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1264 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe

"C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe"

\??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe

"c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\fuckyounod32.vbs"

Network

N/A

Files

memory/2024-54-0x0000000076031000-0x0000000076033000-memory.dmp

memory/2024-55-0x0000000074360000-0x000000007490B000-memory.dmp

memory/1756-56-0x0000000000400000-0x000000000044A000-memory.dmp

memory/1756-57-0x0000000000400000-0x000000000044A000-memory.dmp

memory/1756-59-0x0000000000400000-0x000000000044A000-memory.dmp

memory/1756-60-0x0000000000400000-0x000000000044A000-memory.dmp

memory/1756-61-0x0000000000400000-0x000000000044A000-memory.dmp

memory/1756-62-0x000000000044564E-mapping.dmp

memory/1756-64-0x0000000000400000-0x000000000044A000-memory.dmp

memory/1756-66-0x0000000000400000-0x000000000044A000-memory.dmp

memory/1264-68-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\fuckyounod32.vbs

MD5 a65f94d737d307f65def620728688123
SHA1 ba22cfd98fa6aa8a28de32b3eac5f20fbf0843d8
SHA256 3564dcda92b3ec106f0f9a2710a795a8eada973a9d50511c68cdaea5ec12f87e
SHA512 fa008d1fa740bad8496f6678cb8345d4894afc0385b6abe86577c3f48dbdd1acee5a9ded9fa4e47a879592a1d4bdf8f491362279a94299b2473917d0f57c1847

memory/580-71-0x0000000000000000-mapping.dmp

memory/2024-72-0x0000000074360000-0x000000007490B000-memory.dmp

memory/1756-73-0x0000000074360000-0x000000007490B000-memory.dmp

memory/1756-75-0x0000000074360000-0x000000007490B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-29 12:43

Reported

2022-10-29 17:47

Platform

win10v2004-20220812-en

Max time kernel

188s

Max time network

194s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe"

Signatures

Imminent RAT

trojan spyware imminent

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\WScript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Updater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe" C:\Windows\SysWOW64\WScript.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5112 set thread context of 4548 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe N/A
File created C:\Windows\assembly\Desktop.ini \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5112 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 5112 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 5112 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 5112 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 5112 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 5112 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 5112 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 5112 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe \??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe
PID 5112 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe C:\Windows\SysWOW64\cmd.exe
PID 5112 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe C:\Windows\SysWOW64\cmd.exe
PID 5112 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe C:\Windows\SysWOW64\cmd.exe
PID 4092 wrote to memory of 3484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4092 wrote to memory of 3484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4092 wrote to memory of 3484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe

"C:\Users\Admin\AppData\Local\Temp\e7c90a88de446654da0f5506f2b7590d9816095a864fe12e7997909d576e8229.exe"

\??\c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe

"c:\windows\microsoft.net\framework\v2.0.50727\CasPol.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\fuckyounod32.vbs"

Network

Country Destination Domain Proto
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
NL 104.80.224.44:443 tcp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 176.122.125.40.in-addr.arpa udp

Files

memory/5112-132-0x0000000075100000-0x00000000756B1000-memory.dmp

memory/5112-133-0x0000000075100000-0x00000000756B1000-memory.dmp

memory/4548-134-0x0000000000000000-mapping.dmp

memory/4548-135-0x0000000000400000-0x000000000044A000-memory.dmp

memory/4092-136-0x0000000000000000-mapping.dmp

memory/4548-137-0x0000000075100000-0x00000000756B1000-memory.dmp

C:\Users\Admin\AppData\Roaming\fuckyounod32.vbs

MD5 a65f94d737d307f65def620728688123
SHA1 ba22cfd98fa6aa8a28de32b3eac5f20fbf0843d8
SHA256 3564dcda92b3ec106f0f9a2710a795a8eada973a9d50511c68cdaea5ec12f87e
SHA512 fa008d1fa740bad8496f6678cb8345d4894afc0385b6abe86577c3f48dbdd1acee5a9ded9fa4e47a879592a1d4bdf8f491362279a94299b2473917d0f57c1847

memory/3484-139-0x0000000000000000-mapping.dmp

memory/5112-140-0x0000000075100000-0x00000000756B1000-memory.dmp

memory/4548-141-0x0000000075100000-0x00000000756B1000-memory.dmp