Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-10-2022 12:06

General

  • Target

    c4ee35c5a13033a9adc0da1c99c9b4bbc9a7572ca4e697fa6868a8b44ff1987a.exe

  • Size

    637KB

  • MD5

    84feedb206ce6f56fcbea63636597780

  • SHA1

    7563c8c9531b872b787190a0cdb6fc168a3117ab

  • SHA256

    c4ee35c5a13033a9adc0da1c99c9b4bbc9a7572ca4e697fa6868a8b44ff1987a

  • SHA512

    1852cbaf9ce05f0539a160180ff0d2be4f75a1ea14d7acfa805402afd68e557cf600faab94877d619e40bffbf15002e8855c095829cb45902eef06369c2506ed

  • SSDEEP

    12288:+CPBprQ64gRZR6WRgb14aB1BveN14I8RotUP6fUsSO:jZprXPR3xKr4qktUPcS

Score
10/10

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4ee35c5a13033a9adc0da1c99c9b4bbc9a7572ca4e697fa6868a8b44ff1987a.exe
    "C:\Users\Admin\AppData\Local\Temp\c4ee35c5a13033a9adc0da1c99c9b4bbc9a7572ca4e697fa6868a8b44ff1987a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Windows\temp\notepad.exe
      C:\Windows\temp\notepad.exe
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3264
      • C:\Users\Admin\AppData\RoamingRealmPlayer.exe
        "C:\Users\Admin\AppData\RoamingRealmPlayer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2184
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
          dw20.exe -x -s 824
          4⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:312
      • C:\Windows\temp\notepad.exe
        "C:\Windows\temp\notepad.exe"
        3⤵
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • Drops file in Windows directory
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1548

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\RoamingRealmPlayer.exe

    Filesize

    31KB

    MD5

    7a607550e6bcafcf6024216d4a12162c

    SHA1

    849336bc7b847fd35311a921eaa5eb7b7e051542

    SHA256

    5ea1edafff5ffc11f9b8cf1cdf8a821d5e41957ce5c0aab0e4afb206b34354fb

    SHA512

    f4e38fb50d438bce094aec8d36c8c189b62687ac46d9b5d0d94c96658bfaa4e08a013dd0222dc63343c42fbc178ecb3705d89392f709de153c0647452baeaaf4

  • C:\Users\Admin\AppData\RoamingRealmPlayer.exe

    Filesize

    31KB

    MD5

    7a607550e6bcafcf6024216d4a12162c

    SHA1

    849336bc7b847fd35311a921eaa5eb7b7e051542

    SHA256

    5ea1edafff5ffc11f9b8cf1cdf8a821d5e41957ce5c0aab0e4afb206b34354fb

    SHA512

    f4e38fb50d438bce094aec8d36c8c189b62687ac46d9b5d0d94c96658bfaa4e08a013dd0222dc63343c42fbc178ecb3705d89392f709de153c0647452baeaaf4

  • C:\Windows\Temp\notepad.exe

    Filesize

    52KB

    MD5

    a64daca3cfbcd039df3ec29d3eddd001

    SHA1

    eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3

    SHA256

    403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36

    SHA512

    b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479

  • C:\Windows\Temp\notepad.exe

    Filesize

    52KB

    MD5

    a64daca3cfbcd039df3ec29d3eddd001

    SHA1

    eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3

    SHA256

    403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36

    SHA512

    b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479

  • C:\Windows\temp\notepad.exe

    Filesize

    52KB

    MD5

    a64daca3cfbcd039df3ec29d3eddd001

    SHA1

    eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3

    SHA256

    403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36

    SHA512

    b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479

  • memory/312-167-0x0000000000000000-mapping.dmp

  • memory/1548-149-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1548-151-0x0000000074CB0000-0x0000000075261000-memory.dmp

    Filesize

    5.7MB

  • memory/1548-170-0x0000000074CB0000-0x0000000075261000-memory.dmp

    Filesize

    5.7MB

  • memory/1548-141-0x0000000000000000-mapping.dmp

  • memory/1548-142-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1548-165-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1548-145-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1548-146-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1548-147-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1548-148-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1548-163-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1548-150-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1548-152-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1548-162-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1548-154-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1548-156-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1548-157-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1548-160-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2184-138-0x0000000000000000-mapping.dmp

  • memory/2184-166-0x00007FFB83710000-0x00007FFB84146000-memory.dmp

    Filesize

    10.2MB

  • memory/3264-134-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/3264-133-0x0000000000000000-mapping.dmp

  • memory/3264-169-0x0000000074CB0000-0x0000000075261000-memory.dmp

    Filesize

    5.7MB

  • memory/3264-137-0x0000000074CB0000-0x0000000075261000-memory.dmp

    Filesize

    5.7MB

  • memory/4880-132-0x0000000074CB0000-0x0000000075261000-memory.dmp

    Filesize

    5.7MB

  • memory/4880-168-0x0000000074CB0000-0x0000000075261000-memory.dmp

    Filesize

    5.7MB

  • memory/4880-171-0x0000000074CB0000-0x0000000075261000-memory.dmp

    Filesize

    5.7MB