imminent | 5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f

General

Target

5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
Size

536KB
MD5

75763e6be22e4595b754eba831ec8fd5
SHA1

02f6dc89f70f46702c13684418e8aa1561f75955
SHA256

5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f
SHA512

3ae0de33a997e81690278d49afdc64faa91e3c4af18098182a9ffd925639a8daa9a8f270ba9a234873d1b51008f4867ad5f81d06c5eb2d342b10fe1be24406be
SSDEEP

6144:NNm9Kzer+0pfxKBC5hZ0EnVgv2hTwGk2gFIcVGSaypkVN74j9aVIM6666666666B:DmozEfkgzZTCv22BFI29ay/jsVIbMrH

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 1 IoCs

pid	Process
1516	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Deletes itself 1 IoCs

pid	Process
1516	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Loads dropped DLL 1 IoCs

pid	Process
1368	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1368 set thread context of 1516	1368	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe:ZONE.identifier	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1516	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1516	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1524	1368	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	28
PID 1368 wrote to memory of 1524	1368	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	28
PID 1368 wrote to memory of 1524	1368	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	28
PID 1368 wrote to memory of 1524	1368	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	28
PID 1368 wrote to memory of 1516	1368	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	30
PID 1368 wrote to memory of 1516	1368	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	30
PID 1368 wrote to memory of 1516	1368	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	30
PID 1368 wrote to memory of 1516	1368	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	30
PID 1368 wrote to memory of 1516	1368	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	30
PID 1368 wrote to memory of 1516	1368	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	30
PID 1368 wrote to memory of 1516	1368	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	30
PID 1368 wrote to memory of 1516	1368	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	30
PID 1368 wrote to memory of 1516	1368	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	30

C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
"C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe":ZONE.identifier & exit
  2⤵
  - NTFS ADS
  PID:1524
- C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
  "C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe"
  2⤵
  - Executes dropped EXE
  - Deletes itself
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Filesize
536KB

MD5
75763e6be22e4595b754eba831ec8fd5

SHA1
02f6dc89f70f46702c13684418e8aa1561f75955

SHA256
5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f

SHA512
3ae0de33a997e81690278d49afdc64faa91e3c4af18098182a9ffd925639a8daa9a8f270ba9a234873d1b51008f4867ad5f81d06c5eb2d342b10fe1be24406be

Download Submit
C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Filesize
536KB

MD5
75763e6be22e4595b754eba831ec8fd5

SHA1
02f6dc89f70f46702c13684418e8aa1561f75955

SHA256
5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f

SHA512
3ae0de33a997e81690278d49afdc64faa91e3c4af18098182a9ffd925639a8daa9a8f270ba9a234873d1b51008f4867ad5f81d06c5eb2d342b10fe1be24406be

Download Submit
\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Filesize
536KB

MD5
75763e6be22e4595b754eba831ec8fd5

SHA1
02f6dc89f70f46702c13684418e8aa1561f75955

SHA256
5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f

SHA512
3ae0de33a997e81690278d49afdc64faa91e3c4af18098182a9ffd925639a8daa9a8f270ba9a234873d1b51008f4867ad5f81d06c5eb2d342b10fe1be24406be

Download Submit
memory/1368-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1368-55-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/1368-56-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/1368-69-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/1516-63-0x0000000000070000-0x00000000000C2000-memory.dmp

Filesize
328KB

Download
memory/1516-61-0x0000000000070000-0x00000000000C2000-memory.dmp

Filesize
328KB

Download
memory/1516-64-0x0000000000070000-0x00000000000C2000-memory.dmp

Filesize
328KB

Download
memory/1516-60-0x0000000000070000-0x00000000000C2000-memory.dmp

Filesize
328KB

Download
memory/1516-70-0x0000000000070000-0x00000000000C2000-memory.dmp

Filesize
328KB

Download
memory/1516-68-0x0000000000070000-0x00000000000C2000-memory.dmp

Filesize
328KB

Download
memory/1516-74-0x0000000000070000-0x00000000000C2000-memory.dmp

Filesize
328KB

Download
memory/1516-77-0x0000000000070000-0x00000000000C2000-memory.dmp

Filesize
328KB

Download
memory/1516-79-0x00000000747C0000-0x0000000074D6B000-memory.dmp

Filesize
5.7MB

Download
memory/1516-80-0x00000000747C0000-0x0000000074D6B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing