imminent | 80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe

General

Target

80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe
Size

586KB
MD5

6ec39f51ab68ca1c7cd5d46a8cd48575
SHA1

4236c3f3ab3abbddc581b5f98ddf6eb85d4bed21
SHA256

80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe
SHA512

aa84362e33faefee0ddf6528cfe6da2d9903cc3f5079140505f70b54e6b55bcefeb782ae86a9df2a5c71c9706c4b391501af2c26eeb11ddcbc31a5b9328dee84
SSDEEP

12288:yz/2eDwdx3cNw0j4Vz7UsrYgLfMgr2akeVNmG4CHEkPwU50DEEpa:ydCBVHUsEihvvSUf

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win Update = "C:\\Users\\Admin\\AppData\\Roaming\\Win Update\\Win Update.exe"	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 268	2040	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2040	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe
2040	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
268	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	268	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe
Token: SeDebugPrivilege	2040	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
268	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 268	2040	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe	29
PID 2040 wrote to memory of 268	2040	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe	29
PID 2040 wrote to memory of 268	2040	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe	29
PID 2040 wrote to memory of 268	2040	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe	29
PID 2040 wrote to memory of 268	2040	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe	29
PID 2040 wrote to memory of 268	2040	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe	29
PID 2040 wrote to memory of 268	2040	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe	29
PID 2040 wrote to memory of 268	2040	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe	29
PID 2040 wrote to memory of 268	2040	80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe	29

C:\Users\Admin\AppData\Local\Temp\80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe
"C:\Users\Admin\AppData\Local\Temp\80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe
  "C:\Users\Admin\AppData\Local\Temp\80561420419409dfb23baba9fc1658d22a7e0cdb9c783422a134eb540380ddbe.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/268-64-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/268-56-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/268-57-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/268-59-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/268-60-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/268-71-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/268-69-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/268-66-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2040-68-0x0000000002175000-0x0000000002186000-memory.dmp

Filesize
68KB

Download
memory/2040-54-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/2040-70-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/2040-55-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing