imminent | 5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8

General

Target

5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe
Size

1.7MB
MD5

154c3a264fb533d72ad45319517c0727
SHA1

ace750a10e8e2bd4da9c6d2e840db79a7d4a0889
SHA256

5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8
SHA512

7a8337712ce642daab63448def991b3922f8331601fa4670fe8167a837a8958e63cc0bcb705c5176edb7933d186bfba81154f13b6eeaffae85bdcddf21143dc9
SSDEEP

49152:FbE3NHD8Qi3p81gUeub9+WslI7V4DlOfe:ZsF4ESu5jsuV4G

Score

10^/10

imminent agilenet spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 2 IoCs

pid	Process
1940	35436.exe
960	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe

Loads dropped DLL 4 IoCs

pid	Process
1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe
1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe
1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe
960	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe

Obfuscated with Agile.Net obfuscator 6 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/960-69-0x0000000000400000-0x000000000052C000-memory.dmp	agile_net
behavioral1/memory/960-70-0x0000000000400000-0x000000000052C000-memory.dmp	agile_net
behavioral1/memory/960-72-0x0000000000526B5A-mapping.dmp	agile_net
behavioral1/memory/960-71-0x0000000000400000-0x000000000052C000-memory.dmp	agile_net
behavioral1/memory/960-78-0x0000000000400000-0x000000000052C000-memory.dmp	agile_net
behavioral1/memory/960-76-0x0000000000400000-0x000000000052C000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1388 set thread context of 960	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe:ZONE.identifier	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1940	35436.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	35436.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1940	35436.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1940	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	27
PID 1388 wrote to memory of 1940	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	27
PID 1388 wrote to memory of 1940	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	27
PID 1388 wrote to memory of 1940	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	27
PID 1388 wrote to memory of 1448	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	28
PID 1388 wrote to memory of 1448	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	28
PID 1388 wrote to memory of 1448	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	28
PID 1388 wrote to memory of 1448	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	28
PID 1388 wrote to memory of 960	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	30
PID 1388 wrote to memory of 960	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	30
PID 1388 wrote to memory of 960	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	30
PID 1388 wrote to memory of 960	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	30
PID 1388 wrote to memory of 960	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	30
PID 1388 wrote to memory of 960	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	30
PID 1388 wrote to memory of 960	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	30
PID 1388 wrote to memory of 960	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	30
PID 1388 wrote to memory of 960	1388	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	30

C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe
"C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\35436.exe
  "C:\Users\Admin\AppData\Local\Temp\35436.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe":ZONE.identifier & exit
  2⤵
  - NTFS ADS
  PID:1448
- C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe
  "C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\35436.exe

Filesize
299KB

MD5
4677afdabed8cb27fb7c4127b321023b

SHA1
3e9926e00ed53faa3adbce415d0ad3e15bc8a881

SHA256
450ddaf0193353283cb11a8818320d00b468060088059eb56e43681a7d8a1c4e

SHA512
81ed72901ba26925833ae2e7eb74482735d0e1f2292a538062ad22580a367ee3848be323cdc4f0d4790114ec9eb349be6058e0e486be63c367a7ff6111fa8a1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\35436.exe

Filesize
299KB

MD5
4677afdabed8cb27fb7c4127b321023b

SHA1
3e9926e00ed53faa3adbce415d0ad3e15bc8a881

SHA256
450ddaf0193353283cb11a8818320d00b468060088059eb56e43681a7d8a1c4e

SHA512
81ed72901ba26925833ae2e7eb74482735d0e1f2292a538062ad22580a367ee3848be323cdc4f0d4790114ec9eb349be6058e0e486be63c367a7ff6111fa8a1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe

Filesize
1.7MB

MD5
154c3a264fb533d72ad45319517c0727

SHA1
ace750a10e8e2bd4da9c6d2e840db79a7d4a0889

SHA256
5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8

SHA512
7a8337712ce642daab63448def991b3922f8331601fa4670fe8167a837a8958e63cc0bcb705c5176edb7933d186bfba81154f13b6eeaffae85bdcddf21143dc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe

Filesize
1.7MB

MD5
154c3a264fb533d72ad45319517c0727

SHA1
ace750a10e8e2bd4da9c6d2e840db79a7d4a0889

SHA256
5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8

SHA512
7a8337712ce642daab63448def991b3922f8331601fa4670fe8167a837a8958e63cc0bcb705c5176edb7933d186bfba81154f13b6eeaffae85bdcddf21143dc9

Download Submit
\Users\Admin\AppData\Local\Temp\35436.exe

Filesize
299KB

MD5
4677afdabed8cb27fb7c4127b321023b

SHA1
3e9926e00ed53faa3adbce415d0ad3e15bc8a881

SHA256
450ddaf0193353283cb11a8818320d00b468060088059eb56e43681a7d8a1c4e

SHA512
81ed72901ba26925833ae2e7eb74482735d0e1f2292a538062ad22580a367ee3848be323cdc4f0d4790114ec9eb349be6058e0e486be63c367a7ff6111fa8a1c

Download Submit
\Users\Admin\AppData\Local\Temp\35436.exe

Filesize
299KB

MD5
4677afdabed8cb27fb7c4127b321023b

SHA1
3e9926e00ed53faa3adbce415d0ad3e15bc8a881

SHA256
450ddaf0193353283cb11a8818320d00b468060088059eb56e43681a7d8a1c4e

SHA512
81ed72901ba26925833ae2e7eb74482735d0e1f2292a538062ad22580a367ee3848be323cdc4f0d4790114ec9eb349be6058e0e486be63c367a7ff6111fa8a1c

Download Submit
\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe

Filesize
1.7MB

MD5
154c3a264fb533d72ad45319517c0727

SHA1
ace750a10e8e2bd4da9c6d2e840db79a7d4a0889

SHA256
5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8

SHA512
7a8337712ce642daab63448def991b3922f8331601fa4670fe8167a837a8958e63cc0bcb705c5176edb7933d186bfba81154f13b6eeaffae85bdcddf21143dc9

Download Submit
\Users\Admin\AppData\Local\Temp\65285c40-ff11-48bc-abe7-bafc09cc4fc1\AgileDotNetRT.dll

Filesize
121KB

MD5
b00823b0095b4bfaa0c0044e8c9759a5

SHA1
10dfacf94196d3f4a4cf09b9a502eb0c4a1d7e6e

SHA256
fbe82a7b20535f59650af688d4068038d9dca9a5d9bc3083645f8ee87a54f076

SHA512
69301f1d7077e7cb1cc208a143383a8bb0a4d3a75fe88d0a5df180c370d13d5368116cf13b9bbf9e26a84a83cc4328f5f151582c75dd47385f2f9a8966de4dd8

Download Submit
memory/960-70-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/960-83-0x0000000073FA0000-0x0000000073FFB000-memory.dmp

Filesize
364KB

Download
memory/960-86-0x0000000073710000-0x0000000073744000-memory.dmp

Filesize
208KB

Download
memory/960-66-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/960-67-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/960-69-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/960-85-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/960-84-0x0000000073710000-0x0000000073744000-memory.dmp

Filesize
208KB

Download
memory/960-71-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/960-78-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/960-76-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/960-80-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/1388-75-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/1388-55-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/1388-56-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/1388-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/1940-81-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/1940-87-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing