imminent | 5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f

General

Target

5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
Size

536KB
MD5

75763e6be22e4595b754eba831ec8fd5
SHA1

02f6dc89f70f46702c13684418e8aa1561f75955
SHA256

5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f
SHA512

3ae0de33a997e81690278d49afdc64faa91e3c4af18098182a9ffd925639a8daa9a8f270ba9a234873d1b51008f4867ad5f81d06c5eb2d342b10fe1be24406be
SSDEEP

6144:NNm9Kzer+0pfxKBC5hZ0EnVgv2hTwGk2gFIcVGSaypkVN74j9aVIM6666666666B:DmozEfkgzZTCv22BFI29ay/jsVIbMrH

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 1 IoCs

pid	Process
948	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4964 set thread context of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
File opened for modification	C:\Windows\assembly	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe:ZONE.identifier	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
948	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	948	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
948	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4328	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	88
PID 4964 wrote to memory of 4328	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	88
PID 4964 wrote to memory of 4328	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	88
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90

C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
"C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe":ZONE.identifier & exit
  2⤵
  - NTFS ADS
  PID:4328
- C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
  "C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe.log

Filesize
223B

MD5
1cc4c5b51e50ec74a6880b50ecbee28b

SHA1
1ba7bb0e86c3d23fb0dc8bf16798d37afb4c4aba

SHA256
0556734df26e82e363d47748a3ceedd5c23ea4b9ded6e68bd5c373c1c9f8777b

SHA512
5d5532602b381125b24a9bd78781ed722ce0c862214ef17e7d224d269e6e7045c919ab19896dd8d9ae8920726092efe0ffb776a77a9a9539c4a70188d5a4c706

Download Submit
C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Filesize
536KB

MD5
75763e6be22e4595b754eba831ec8fd5

SHA1
02f6dc89f70f46702c13684418e8aa1561f75955

SHA256
5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f

SHA512
3ae0de33a997e81690278d49afdc64faa91e3c4af18098182a9ffd925639a8daa9a8f270ba9a234873d1b51008f4867ad5f81d06c5eb2d342b10fe1be24406be

Download Submit
C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Filesize
536KB

MD5
75763e6be22e4595b754eba831ec8fd5

SHA1
02f6dc89f70f46702c13684418e8aa1561f75955

SHA256
5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f

SHA512
3ae0de33a997e81690278d49afdc64faa91e3c4af18098182a9ffd925639a8daa9a8f270ba9a234873d1b51008f4867ad5f81d06c5eb2d342b10fe1be24406be

Download Submit
memory/948-139-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/948-144-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/948-145-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/4964-135-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/4964-136-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/4964-143-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing