imminent | 4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe

General

Target

4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe
Size

607KB
MD5

91a9d2b0e956318e7cbcf05f9681f7c4
SHA1

2e3780b19b67351fb02027656549addb8d0836af
SHA256

4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe
SHA512

a4545e344bf106b30e61d69deaa40b4181149ea94340dcd72287b4b7803ce95a129e4c91a9e87eae4cc6bc1172785c78a5139060625258ad559ee9e12aaff6e7
SSDEEP

12288:zpaDulO2GU6YvurtyjPYr9Jp0LiiW8QdOn9VbtFC78qADbU1Z:zkDyO2p2gjgJULuzon/JFCwqAPC

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win Fonts = "C:\\Users\\Admin\\AppData\\Roaming\\Win Fonts\\Win Fonts.exe"	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2008 set thread context of 1752	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	31

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe
2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe
2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe
2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe
2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe
2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe
2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe
2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1752	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe
Token: SeDebugPrivilege	1752	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1752	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1688	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	29
PID 2008 wrote to memory of 1688	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	29
PID 2008 wrote to memory of 1688	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	29
PID 2008 wrote to memory of 1688	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	29
PID 2008 wrote to memory of 1796	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	30
PID 2008 wrote to memory of 1796	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	30
PID 2008 wrote to memory of 1796	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	30
PID 2008 wrote to memory of 1796	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	30
PID 2008 wrote to memory of 1752	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	31
PID 2008 wrote to memory of 1752	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	31
PID 2008 wrote to memory of 1752	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	31
PID 2008 wrote to memory of 1752	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	31
PID 2008 wrote to memory of 1752	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	31
PID 2008 wrote to memory of 1752	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	31
PID 2008 wrote to memory of 1752	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	31
PID 2008 wrote to memory of 1752	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	31
PID 2008 wrote to memory of 1752	2008	4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe	31

C:\Users\Admin\AppData\Local\Temp\4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe
"C:\Users\Admin\AppData\Local\Temp\4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe
  "C:\Users\Admin\AppData\Local\Temp\4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe"
  2⤵
  PID:1688
- C:\Users\Admin\AppData\Local\Temp\4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe
  "C:\Users\Admin\AppData\Local\Temp\4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe"
  2⤵
  PID:1796
- C:\Users\Admin\AppData\Local\Temp\4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe
  "C:\Users\Admin\AppData\Local\Temp\4faf2528e5611bfd26b359408eed8715289a3e628c2d5bfe6a000f350066dffe.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-61-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1752-64-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1752-56-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1752-57-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1752-59-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1752-60-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1752-71-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/1752-69-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/1752-66-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2008-68-0x0000000002225000-0x0000000002236000-memory.dmp

Filesize
68KB

Download
memory/2008-54-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download
memory/2008-70-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2008-55-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing