imminent | 5a178e873bea63aa2c0c4c05c2fab788cf3e18bbeeeb94cdc921b77c2c5584c5

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5a178e873bea63aa2c0c4c05c2fab788cf3e18bbeeeb94cdc921b77c2c5584c5.exe
Size 1.0MB
Sample221122-xftx7sdd26
SHA256 5a178e873bea63aa2c0c4c05c2fab788cf3e18bbeeeb94cdc921b77c2c5584c5
MD5 27fe66f32b3bdad4fb04a0b15701f7e3
SHA1 a1a97813c5be852a63526d81254cd4f75e5da3ae
SHA512 2a935a04e1b2d968219e2a9e1393ca11fe1dd324693040a72ee06f0d49ce387d0b6a763476be4dde6c1015e1c9145d12bfeef6c101fe3b899f3a3de60a2d7266
SSDEEP 24576:mt24vqVnszwQ28Qcuc+OSgLphaZ3etWrJ:sXwQ2jbD8hm3vJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 2 IoCs

pid	Process
1660	jnotg.com
240	jnotg.com

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	5a178e873bea63aa2c0c4c05c2fab788cf3e18bbeeeb94cdc921b77c2c5584c5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	jnotg.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\uueea\\jnotg.com C:\\Users\\Admin\\AppData\\Roaming\\uueea\\egwlg.plw"	jnotg.com

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	RegSvcs.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 240 set thread context of 3952	240	jnotg.com	89

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	RegSvcs.exe
File created	C:\Windows\assembly\Desktop.ini	RegSvcs.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3952	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3952	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 1660	4700	5a178e873bea63aa2c0c4c05c2fab788cf3e18bbeeeb94cdc921b77c2c5584c5.exe	83
PID 4700 wrote to memory of 1660	4700	5a178e873bea63aa2c0c4c05c2fab788cf3e18bbeeeb94cdc921b77c2c5584c5.exe	83
PID 4700 wrote to memory of 1660	4700	5a178e873bea63aa2c0c4c05c2fab788cf3e18bbeeeb94cdc921b77c2c5584c5.exe	83
PID 1660 wrote to memory of 240	1660	jnotg.com	86
PID 1660 wrote to memory of 240	1660	jnotg.com	86
PID 1660 wrote to memory of 240	1660	jnotg.com	86
PID 240 wrote to memory of 3952	240	jnotg.com	89
PID 240 wrote to memory of 3952	240	jnotg.com	89
PID 240 wrote to memory of 3952	240	jnotg.com	89
PID 240 wrote to memory of 3952	240	jnotg.com	89
PID 240 wrote to memory of 3952	240	jnotg.com	89
PID 240 wrote to memory of 3952	240	jnotg.com	89
PID 240 wrote to memory of 3952	240	jnotg.com	89
PID 240 wrote to memory of 3952	240	jnotg.com	89

C:\Users\Admin\AppData\Local\Temp\5a178e873bea63aa2c0c4c05c2fab788cf3e18bbeeeb94cdc921b77c2c5584c5.exe
"C:\Users\Admin\AppData\Local\Temp\5a178e873bea63aa2c0c4c05c2fab788cf3e18bbeeeb94cdc921b77c2c5584c5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Roaming\uueea\jnotg.com
  "C:\Users\Admin\AppData\Roaming\uueea\jnotg.com" egwlg.plw
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Users\Admin\AppData\Roaming\uueea\jnotg.com
    C:\Users\Admin\AppData\Roaming\uueea\jnotg.com C:\Users\Admin\AppData\Roaming\uueea\TLIST
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:240
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      Drops desktop.ini file(s)
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TLIST

Path C:\Users\Admin\AppData\Roaming\uueea\TLIST
Size 118KB
SHA256 f4277a31ceba382ca8de4d8771e9d12e67dac07c421edbb9dc38be4d843bcb63
MD5 c346f5cd7684d742e218dc717b47c027
SHA1 c1486531db25d3c7f86e6a0031342885bd8580b5
SHA512 90548e009e967c0151b3330c5070352a5de2e227d61a0695044ebaddad492d2a95a05fbeddb7155b959320ffbfbb0866f091348f8e7927a5810aa8ec2344edaf
SSDEEP 3072:u5DEjpwBPpCVF9vpr0prsW9Bw7VphxUMuy0:r7VphxUMur
MD5 SHA1 SHA512 SSDEEP

Submit Download

YMQGIX

Path C:\Users\Admin\AppData\Roaming\uueea\YMQGIX
Size 30KB
SHA256 5921af928a8577b129ae3a1ba8a29b7f7763e9a4aa2870429c5b6ee35490c28b
MD5 a500068edd85d9eb32b9f3f72be05243
SHA1 80646209a2639306075d6090767fc8f33208cfbb
SHA512 704384f8b83c837a34d4eda349e64cb68ce3c05a98c0b8615c3286002c95b7579126f68b3091d459e21fbfce6896d7ae6218e906b18636706c86f3aba5d0e018
SSDEEP 768:gYSpDNdjDk5LCYvTS4sZCKysOI7GFbxhwgFme1g:XujDu+ATxsZCKzORbxO8u
MD5 SHA1 SHA512 SSDEEP

Submit Download

egwlg.plw

Path C:\Users\Admin\AppData\Roaming\uueea\egwlg.plw
Size 127KB
SHA256 e12b30f79ad7cf4b71d5aaf2eb5b1d2b0971a5d460f526406ce2def601c4f3df
MD5 d598e742d1aa8ff9de5eae06207552d4
SHA1 f623c13916ecd450cb8c090dd65226c40a5d1a8e
SHA512 3efc8bc8a7b562c21127732d8bb6e1f3ed70f702edc2b1a99f624f13b92de054accb09014ebf8d32eb82a64c7d0a4c7ac441b951170a6da8152c64be75f59364
SSDEEP 96:9GczP0yl5W7yltP6j7Qlfw9fHzpFMSEO/Agw:as87sxgfHdFMvSAJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hllwp

Path C:\Users\Admin\AppData\Roaming\uueea\hllwp
Size 277KB
SHA256 7ef88c8ffd41bacbb7cdf540dd1e4cac7df32881cb8dfb0aaab3339bb120bf8c
MD5 6a637d94198ddffcbc6bb0c5f7d1f9fa
SHA1 62dc7ae5444a2a31d8ea4160851e89c327e0a8ff
SHA512 ac1dcabf380917a24ffce1c72c74cd52514dc4aaf15b263114096740dfe16c42d3e128b4d04649b3a0b518ee8a378ab8e26050a9bebf258dd914182c6a316317
SSDEEP 6144:kJGuAjc5k1YAlURVa5F8CeD2ZP4FIHlDu/7sc25d6:IGDGkB+Va/I2ZQFKSQckd6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jnotg.com

Path C:\Users\Admin\AppData\Roaming\uueea\jnotg.com
Size 732KB
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
SSDEEP 12288:IBzZm7d9AZAYJVB7ii/XAvKxRJBnwvogSJ4M4G4auLzzV+XMhN5DGDt2:ycneJVBvXAvwRJdwvZ5auLl+XyN5DGR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

jnotg.com

Path C:\Users\Admin\AppData\Roaming\uueea\jnotg.com
Size 732KB
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
SSDEEP 12288:IBzZm7d9AZAYJVB7ii/XAvKxRJBnwvogSJ4M4G4auLzzV+XMhN5DGDt2:ycneJVBvXAvwRJdwvZ5auLl+XyN5DGR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

jnotg.com

Path C:\Users\Admin\AppData\Roaming\uueea\jnotg.com
Size 732KB
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
SSDEEP 12288:IBzZm7d9AZAYJVB7ii/XAvKxRJBnwvogSJ4M4G4auLzzV+XMhN5DGDt2:ycneJVBvXAvwRJdwvZ5auLl+XyN5DGR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

pfxif.wte

Path C:\Users\Admin\AppData\Roaming\uueea\pfxif.wte
Size 118KB
SHA256 b84f15965a8afe578a1a138e6bf194fc283d76e7131a013ea5c3a996a5173af4
MD5 f6e15c6d7f0c9520825cb0f0b792153f
SHA1 337135a46591e4139300775cf0acee39e87d961e
SHA512 d196fc316d2c2e9fdc4e58aa432a29cd7bbd54b03a6f71bb7dbe1832d750194caccddf441677fd975d3a5d094ed86cfcab618bbf05d0e9866ccf32b570291920
SSDEEP 3072:K6aD7HFyyZVjxJ5Hvr14ZhCzhDwNxPKu9:g7H9jHvJ5yRT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3952-143-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3952-144-0x00000000740F0000-0x00000000746A1000-memory.dmp

Download

memory/3952-145-0x00000000740F0000-0x00000000746A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads