imminent | 5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f

Analysis

max time kernel
131s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
Size 536KB
Sample221030-walh7sccb6
SHA256 5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f
MD5 75763e6be22e4595b754eba831ec8fd5
SHA1 02f6dc89f70f46702c13684418e8aa1561f75955
SHA512 3ae0de33a997e81690278d49afdc64faa91e3c4af18098182a9ffd925639a8daa9a8f270ba9a234873d1b51008f4867ad5f81d06c5eb2d342b10fe1be24406be
SSDEEP 6144:NNm9Kzer+0pfxKBC5hZ0EnVgv2hTwGk2gFIcVGSaypkVN74j9aVIM6666666666B:DmozEfkgzZTCv22BFI29ay/jsVIbMrH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 1 IoCs

pid	Process
948	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4964 set thread context of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
File opened for modification	C:\Windows\assembly	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe:ZONE.identifier	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
948	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	948	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
948	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4328	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	88
PID 4964 wrote to memory of 4328	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	88
PID 4964 wrote to memory of 4328	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	88
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90
PID 4964 wrote to memory of 948	4964	5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe	90

C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
"C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe":ZONE.identifier & exit
  2⤵
  - NTFS ADS
  PID:4328
- C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
  "C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe.log
Size 223B
SHA256 0556734df26e82e363d47748a3ceedd5c23ea4b9ded6e68bd5c373c1c9f8777b
MD5 1cc4c5b51e50ec74a6880b50ecbee28b
SHA1 1ba7bb0e86c3d23fb0dc8bf16798d37afb4c4aba
SHA512 5d5532602b381125b24a9bd78781ed722ce0c862214ef17e7d224d269e6e7045c919ab19896dd8d9ae8920726092efe0ffb776a77a9a9539c4a70188d5a4c706
MD5 SHA1 SHA512

Submit Download

5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Path C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
Size 536KB
SHA256 5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f
MD5 75763e6be22e4595b754eba831ec8fd5
SHA1 02f6dc89f70f46702c13684418e8aa1561f75955
SHA512 3ae0de33a997e81690278d49afdc64faa91e3c4af18098182a9ffd925639a8daa9a8f270ba9a234873d1b51008f4867ad5f81d06c5eb2d342b10fe1be24406be
SSDEEP 6144:NNm9Kzer+0pfxKBC5hZ0EnVgv2hTwGk2gFIcVGSaypkVN74j9aVIM6666666666B:DmozEfkgzZTCv22BFI29ay/jsVIbMrH
MD5 SHA1 SHA512 SSDEEP

Submit Download

5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe

Path C:\Users\Admin\AppData\Local\Temp\5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f.exe
Size 536KB
SHA256 5dbd6f5cc026c4f33888621b269d8bac5d41c454c944f80332d28457c1e7f26f
MD5 75763e6be22e4595b754eba831ec8fd5
SHA1 02f6dc89f70f46702c13684418e8aa1561f75955
SHA512 3ae0de33a997e81690278d49afdc64faa91e3c4af18098182a9ffd925639a8daa9a8f270ba9a234873d1b51008f4867ad5f81d06c5eb2d342b10fe1be24406be
SSDEEP 6144:NNm9Kzer+0pfxKBC5hZ0EnVgv2hTwGk2gFIcVGSaypkVN74j9aVIM6666666666B:DmozEfkgzZTCv22BFI29ay/jsVIbMrH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/948-139-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/948-144-0x00000000750E0000-0x0000000075691000-memory.dmp

Download

memory/948-145-0x00000000750E0000-0x0000000075691000-memory.dmp

Download

memory/4964-135-0x00000000750E0000-0x0000000075691000-memory.dmp

Download

memory/4964-136-0x00000000750E0000-0x0000000075691000-memory.dmp

Download

memory/4964-143-0x00000000750E0000-0x0000000075691000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads