imminent | 10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5

Analysis

max time kernel
128s
max time network
143s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-11-2022 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe
Size

419KB
MD5

34c755570f35d8443baf585848a7d6b0
SHA1

a80fb72c042954976a6fbad53d62fd9578464f01
SHA256

10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5
SHA512

ea52b23d4e6e88255137a066ce642bdd74a6521a1d92395e5d70169f79c97838314d37d07c6d4082f3bf246c5da159bdcc783d03c41e438348bf67150fb250d9
SSDEEP

12288:Ii2KfcG4m4VmU/G3imOZDFvciXne3rIAoo9:kKJ4DVmknZZci6Loo

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Deletes itself 1 IoCs

pid	Process
812	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GCnl5JJWuPD.lnk	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe

Loads dropped DLL 1 IoCs

pid	Process
1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1104 set thread context of 628	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	28
PID 1104 set thread context of 1672	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1072	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe
1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe
1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe
1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe
1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe
1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1672	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe
Token: SeDebugPrivilege	1672	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1672	RegAsm.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 628	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	28
PID 1104 wrote to memory of 628	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	28
PID 1104 wrote to memory of 628	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	28
PID 1104 wrote to memory of 628	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	28
PID 1104 wrote to memory of 628	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	28
PID 1104 wrote to memory of 628	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	28
PID 1104 wrote to memory of 628	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	28
PID 1104 wrote to memory of 628	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	28
PID 1104 wrote to memory of 628	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	28
PID 1104 wrote to memory of 628	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	28
PID 1104 wrote to memory of 628	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	28
PID 1104 wrote to memory of 628	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	28
PID 1104 wrote to memory of 1556	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	29
PID 1104 wrote to memory of 1556	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	29
PID 1104 wrote to memory of 1556	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	29
PID 1104 wrote to memory of 1556	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	29
PID 1104 wrote to memory of 1556	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	29
PID 1104 wrote to memory of 1556	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	29
PID 1104 wrote to memory of 1556	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	29
PID 1104 wrote to memory of 1672	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	30
PID 1104 wrote to memory of 1672	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	30
PID 1104 wrote to memory of 1672	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	30
PID 1104 wrote to memory of 1672	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	30
PID 1104 wrote to memory of 1672	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	30
PID 1104 wrote to memory of 1672	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	30
PID 1104 wrote to memory of 1672	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	30
PID 1104 wrote to memory of 1672	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	30
PID 1104 wrote to memory of 1672	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	30
PID 1104 wrote to memory of 1672	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	30
PID 1104 wrote to memory of 1672	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	30
PID 1104 wrote to memory of 1672	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	30
PID 1104 wrote to memory of 812	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	31
PID 1104 wrote to memory of 812	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	31
PID 1104 wrote to memory of 812	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	31
PID 1104 wrote to memory of 812	1104	10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe	31
PID 812 wrote to memory of 1072	812	cmd.exe	33
PID 812 wrote to memory of 1072	812	cmd.exe	33
PID 812 wrote to memory of 1072	812	cmd.exe	33
PID 812 wrote to memory of 1072	812	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe
"C:\Users\Admin\AppData\Local\Temp\10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:628
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:1556
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\N8mkaaJQQSxJ\HfdLyE4j.exe

Filesize
419KB

MD5
34c755570f35d8443baf585848a7d6b0

SHA1
a80fb72c042954976a6fbad53d62fd9578464f01

SHA256
10b81639c0629fff525883875b7cc4e1a01afec8c9138f06abe7e4e5627d00c5

SHA512
ea52b23d4e6e88255137a066ce642bdd74a6521a1d92395e5d70169f79c97838314d37d07c6d4082f3bf246c5da159bdcc783d03c41e438348bf67150fb250d9

Download Submit
memory/628-63-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/628-59-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/628-60-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/628-55-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/628-56-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/628-65-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/628-58-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/628-67-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1104-68-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1104-106-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1104-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/1672-94-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1672-100-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1672-91-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1672-90-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1672-85-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1672-84-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1672-97-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1672-83-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1672-99-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1672-93-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1672-82-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1672-102-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1672-88-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1672-87-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1672-86-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1672-107-0x0000000074760000-0x0000000074D0B000-memory.dmp

Filesize
5.7MB

Download