Malware Analysis Report

2024-11-13 15:44

Sample ID 221029-s4bz3scfh2
Target 050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738
SHA256 050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738
Tags
imminent persistence spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738

Threat Level: Known bad

The file 050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738 was found to be: Known bad.

Malicious Activity Summary

imminent persistence spyware trojan

Imminent RAT

Modifies WinLogon for persistence

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Windows directory

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-29 15:40

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-29 15:40

Reported

2022-10-29 21:46

Platform

win7-20220812-en

Max time kernel

141s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe"

Signatures

Imminent RAT

trojan spyware imminent

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\VXyp7dAoE27slGpl\\wFCcEGTWEmh5.exe\",explorer.exe" C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1880 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe
PID 1880 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe
PID 1880 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe
PID 1880 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe
PID 1880 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe
PID 1880 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe
PID 1880 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe
PID 1880 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe
PID 1880 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe

Processes

C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe

"C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe"

C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe

"C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe"

Network

Country Destination Domain Proto
US 50.165.190.203:200 tcp
US 50.165.190.203:200 tcp
US 50.165.190.203:200 tcp
US 50.165.190.203:200 tcp

Files

memory/1880-54-0x0000000075571000-0x0000000075573000-memory.dmp

memory/1880-55-0x00000000740E0000-0x000000007468B000-memory.dmp

memory/1880-56-0x00000000740E0000-0x000000007468B000-memory.dmp

memory/1936-57-0x0000000000400000-0x0000000000454000-memory.dmp

memory/1936-58-0x0000000000400000-0x0000000000454000-memory.dmp

memory/1936-60-0x0000000000400000-0x0000000000454000-memory.dmp

memory/1936-62-0x0000000000400000-0x0000000000454000-memory.dmp

memory/1936-63-0x0000000000400000-0x0000000000454000-memory.dmp

memory/1936-64-0x000000000044578E-mapping.dmp

memory/1936-66-0x0000000000400000-0x0000000000454000-memory.dmp

memory/1936-68-0x0000000000400000-0x0000000000454000-memory.dmp

memory/1880-70-0x00000000740E0000-0x000000007468B000-memory.dmp

memory/1936-71-0x00000000740E0000-0x000000007468B000-memory.dmp

memory/1936-72-0x00000000740E0000-0x000000007468B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-29 15:40

Reported

2022-10-29 21:46

Platform

win10v2004-20220812-en

Max time kernel

147s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe"

Signatures

Imminent RAT

trojan spyware imminent

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\VXyp7dAoE27slGpl\\1CU2wqcQdYVv.exe\",explorer.exe" C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2036 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe
PID 2036 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe
PID 2036 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe
PID 2036 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe
PID 2036 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe
PID 2036 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe
PID 2036 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe
PID 2036 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe

Processes

C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe

"C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe"

C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe

"C:\Users\Admin\AppData\Local\Temp\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe"

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 52.168.112.66:443 tcp
US 8.252.51.254:80 tcp
NL 104.80.225.205:443 tcp
US 50.165.190.203:200 tcp
US 8.8.8.8:53 226.101.242.52.in-addr.arpa udp
US 50.165.190.203:200 tcp
US 50.165.190.203:200 tcp
US 50.165.190.203:200 tcp

Files

memory/2036-132-0x0000000074EC0000-0x0000000075471000-memory.dmp

memory/2036-133-0x0000000074EC0000-0x0000000075471000-memory.dmp

memory/3108-134-0x0000000000000000-mapping.dmp

memory/3108-135-0x0000000000400000-0x0000000000454000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\050ba96d0efe30e1b9f525ac12941a25affd0e7ff51efba8f2d7602387792738.exe.log

MD5 0a9b4592cd49c3c21f6767c2dabda92f
SHA1 f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256 c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA512 6b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307

memory/2036-137-0x0000000074EC0000-0x0000000075471000-memory.dmp

memory/3108-138-0x0000000074EC0000-0x0000000075471000-memory.dmp

memory/3108-139-0x0000000074EC0000-0x0000000075471000-memory.dmp