imminent | 5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8

General

Target

5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe
Size

1.7MB
MD5

154c3a264fb533d72ad45319517c0727
SHA1

ace750a10e8e2bd4da9c6d2e840db79a7d4a0889
SHA256

5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8
SHA512

7a8337712ce642daab63448def991b3922f8331601fa4670fe8167a837a8958e63cc0bcb705c5176edb7933d186bfba81154f13b6eeaffae85bdcddf21143dc9
SSDEEP

49152:FbE3NHD8Qi3p81gUeub9+WslI7V4DlOfe:ZsF4ESu5jsuV4G

Score

10^/10

imminent agilenet spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 2 IoCs

pid	Process
4892	35436.exe
4104	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe

Loads dropped DLL 1 IoCs

pid	Process
4104	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/4104-140-0x0000000000400000-0x000000000052C000-memory.dmp	agile_net

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	35436.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	35436.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2052 set thread context of 4104	2052	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	85

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	35436.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	35436.exe
File opened for modification	C:\Windows\assembly	35436.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe:ZONE.identifier	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4892	35436.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	35436.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4892	35436.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 4892	2052	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	82
PID 2052 wrote to memory of 4892	2052	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	82
PID 2052 wrote to memory of 4892	2052	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	82
PID 2052 wrote to memory of 2116	2052	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	83
PID 2052 wrote to memory of 2116	2052	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	83
PID 2052 wrote to memory of 2116	2052	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	83
PID 2052 wrote to memory of 4104	2052	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	85
PID 2052 wrote to memory of 4104	2052	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	85
PID 2052 wrote to memory of 4104	2052	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	85
PID 2052 wrote to memory of 4104	2052	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	85
PID 2052 wrote to memory of 4104	2052	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	85
PID 2052 wrote to memory of 4104	2052	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	85
PID 2052 wrote to memory of 4104	2052	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	85
PID 2052 wrote to memory of 4104	2052	5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe	85

C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe
"C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Users\Admin\AppData\Local\Temp\35436.exe
  "C:\Users\Admin\AppData\Local\Temp\35436.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe":ZONE.identifier & exit
  2⤵
  - NTFS ADS
  PID:2116
- C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe
  "C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe.log

Filesize
223B

MD5
1cc4c5b51e50ec74a6880b50ecbee28b

SHA1
1ba7bb0e86c3d23fb0dc8bf16798d37afb4c4aba

SHA256
0556734df26e82e363d47748a3ceedd5c23ea4b9ded6e68bd5c373c1c9f8777b

SHA512
5d5532602b381125b24a9bd78781ed722ce0c862214ef17e7d224d269e6e7045c919ab19896dd8d9ae8920726092efe0ffb776a77a9a9539c4a70188d5a4c706

Download Submit
C:\Users\Admin\AppData\Local\Temp\35436.exe

Filesize
299KB

MD5
4677afdabed8cb27fb7c4127b321023b

SHA1
3e9926e00ed53faa3adbce415d0ad3e15bc8a881

SHA256
450ddaf0193353283cb11a8818320d00b468060088059eb56e43681a7d8a1c4e

SHA512
81ed72901ba26925833ae2e7eb74482735d0e1f2292a538062ad22580a367ee3848be323cdc4f0d4790114ec9eb349be6058e0e486be63c367a7ff6111fa8a1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\35436.exe

Filesize
299KB

MD5
4677afdabed8cb27fb7c4127b321023b

SHA1
3e9926e00ed53faa3adbce415d0ad3e15bc8a881

SHA256
450ddaf0193353283cb11a8818320d00b468060088059eb56e43681a7d8a1c4e

SHA512
81ed72901ba26925833ae2e7eb74482735d0e1f2292a538062ad22580a367ee3848be323cdc4f0d4790114ec9eb349be6058e0e486be63c367a7ff6111fa8a1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe

Filesize
1.7MB

MD5
154c3a264fb533d72ad45319517c0727

SHA1
ace750a10e8e2bd4da9c6d2e840db79a7d4a0889

SHA256
5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8

SHA512
7a8337712ce642daab63448def991b3922f8331601fa4670fe8167a837a8958e63cc0bcb705c5176edb7933d186bfba81154f13b6eeaffae85bdcddf21143dc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8.exe

Filesize
1.7MB

MD5
154c3a264fb533d72ad45319517c0727

SHA1
ace750a10e8e2bd4da9c6d2e840db79a7d4a0889

SHA256
5cf517a87e8b41b05b6f8b69c285aea898e48344e344d6d8ae963f31b6f2b7a8

SHA512
7a8337712ce642daab63448def991b3922f8331601fa4670fe8167a837a8958e63cc0bcb705c5176edb7933d186bfba81154f13b6eeaffae85bdcddf21143dc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\65285c40-ff11-48bc-abe7-bafc09cc4fc1\AgileDotNetRT.dll

Filesize
121KB

MD5
b00823b0095b4bfaa0c0044e8c9759a5

SHA1
10dfacf94196d3f4a4cf09b9a502eb0c4a1d7e6e

SHA256
fbe82a7b20535f59650af688d4068038d9dca9a5d9bc3083645f8ee87a54f076

SHA512
69301f1d7077e7cb1cc208a143383a8bb0a4d3a75fe88d0a5df180c370d13d5368116cf13b9bbf9e26a84a83cc4328f5f151582c75dd47385f2f9a8966de4dd8

Download Submit
memory/2052-144-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/2052-132-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/2052-133-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/4104-140-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/4104-147-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/4104-146-0x0000000073BC0000-0x0000000073C1B000-memory.dmp

Filesize
364KB

Download
memory/4104-148-0x00000000732C0000-0x00000000732F4000-memory.dmp

Filesize
208KB

Download
memory/4104-149-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/4892-137-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/4892-150-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing