Overview

overview

10

Static

static

39f5a987a3...b5.exe

windows7-x64

10

39f5a987a3...b5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2022 19:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    39f5a987a305dabb5bd83ec494cd964e5a13883d8c20f0668eb15e63ba3831b5.exe

  • Size

    490KB

  • MD5

    d1a344cfd2c760233f1d0a4c02e6338e

  • SHA1

    6aa39ffed3c813c7fe2666d3b3432b130d67edba

  • SHA256

    39f5a987a305dabb5bd83ec494cd964e5a13883d8c20f0668eb15e63ba3831b5

  • SHA512

    916545a3345398be1b959797151e295dbde53a887b9a6633e273b2ab9b743d48927ef5016b2fad9fa084aadd3430b36050aa4ba5bb497e1d193b4590b64bb3c0

  • SSDEEP

    12288:h4TZmjKvRX4eToNQJRB1ttfKfpkZydR9YQqLW:h4TkeToyJRttfQ6EYJL

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

    trojanspywareimminent
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39f5a987a305dabb5bd83ec494cd964e5a13883d8c20f0668eb15e63ba3831b5.exe
    "C:\Users\Admin\AppData\Local\Temp\39f5a987a305dabb5bd83ec494cd964e5a13883d8c20f0668eb15e63ba3831b5.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2616
    • C:\Users\Admin\AppData\Local\Temp\39f5a987a305dabb5bd83ec494cd964e5a13883d8c20f0668eb15e63ba3831b5.exe
      "C:\Users\Admin\AppData\Local\Temp\39f5a987a305dabb5bd83ec494cd964e5a13883d8c20f0668eb15e63ba3831b5.exe"
      2⤵
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1540
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3404
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
          4⤵
          • Executes dropped EXE
          PID:4348
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          PID:2716

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\WUDHost.exe.log
    Filesize

    224B

    MD5

    c19eb8c8e7a40e6b987f9d2ee952996e

    SHA1

    6fc3049855bc9100643e162511673c6df0f28bfb

    SHA256

    677e9e30350df17e2bc20fa9f7d730e9f7cc6e870d6520a345f5f7dc5b31f58a

    SHA512

    860713b4a787c2189ed12a47d4b68b60ac00c7a253cae52dd4eb9276dacafeae3a81906b6d0742c8ecfdfaa255777c445beb7c2a532f3c677a9903237ac97596

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
    Filesize

    490KB

    MD5

    d1a344cfd2c760233f1d0a4c02e6338e

    SHA1

    6aa39ffed3c813c7fe2666d3b3432b130d67edba

    SHA256

    39f5a987a305dabb5bd83ec494cd964e5a13883d8c20f0668eb15e63ba3831b5

    SHA512

    916545a3345398be1b959797151e295dbde53a887b9a6633e273b2ab9b743d48927ef5016b2fad9fa084aadd3430b36050aa4ba5bb497e1d193b4590b64bb3c0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
    Filesize

    490KB

    MD5

    d1a344cfd2c760233f1d0a4c02e6338e

    SHA1

    6aa39ffed3c813c7fe2666d3b3432b130d67edba

    SHA256

    39f5a987a305dabb5bd83ec494cd964e5a13883d8c20f0668eb15e63ba3831b5

    SHA512

    916545a3345398be1b959797151e295dbde53a887b9a6633e273b2ab9b743d48927ef5016b2fad9fa084aadd3430b36050aa4ba5bb497e1d193b4590b64bb3c0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
    Filesize

    490KB

    MD5

    d1a344cfd2c760233f1d0a4c02e6338e

    SHA1

    6aa39ffed3c813c7fe2666d3b3432b130d67edba

    SHA256

    39f5a987a305dabb5bd83ec494cd964e5a13883d8c20f0668eb15e63ba3831b5

    SHA512

    916545a3345398be1b959797151e295dbde53a887b9a6633e273b2ab9b743d48927ef5016b2fad9fa084aadd3430b36050aa4ba5bb497e1d193b4590b64bb3c0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
    Filesize

    12KB

    MD5

    884a632e551d76450d9661f04574ef5c

    SHA1

    ed4220823ad11028ceb684d76468ed4a08f756ee

    SHA256

    8f1c599be40ba8761b0272bd9971857c9e4614ae84634aeae6c51ac3823b7361

    SHA512

    bc52050c8dd91096fcfd9955e7cd3b4606c948d5669db8f429d5d9e46f87fd7e87b178ba9b92313bac4973cff27a153aea68328372641af409f9ccf08b7748a9

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
    Filesize

    12KB

    MD5

    884a632e551d76450d9661f04574ef5c

    SHA1

    ed4220823ad11028ceb684d76468ed4a08f756ee

    SHA256

    8f1c599be40ba8761b0272bd9971857c9e4614ae84634aeae6c51ac3823b7361

    SHA512

    bc52050c8dd91096fcfd9955e7cd3b4606c948d5669db8f429d5d9e46f87fd7e87b178ba9b92313bac4973cff27a153aea68328372641af409f9ccf08b7748a9

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
    Filesize

    12KB

    MD5

    884a632e551d76450d9661f04574ef5c

    SHA1

    ed4220823ad11028ceb684d76468ed4a08f756ee

    SHA256

    8f1c599be40ba8761b0272bd9971857c9e4614ae84634aeae6c51ac3823b7361

    SHA512

    bc52050c8dd91096fcfd9955e7cd3b4606c948d5669db8f429d5d9e46f87fd7e87b178ba9b92313bac4973cff27a153aea68328372641af409f9ccf08b7748a9

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
    Filesize

    12KB

    MD5

    884a632e551d76450d9661f04574ef5c

    SHA1

    ed4220823ad11028ceb684d76468ed4a08f756ee

    SHA256

    8f1c599be40ba8761b0272bd9971857c9e4614ae84634aeae6c51ac3823b7361

    SHA512

    bc52050c8dd91096fcfd9955e7cd3b4606c948d5669db8f429d5d9e46f87fd7e87b178ba9b92313bac4973cff27a153aea68328372641af409f9ccf08b7748a9

    Download Submit

  • memory/1540-136-0x00000000745B0000-0x0000000074B61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1540-141-0x00000000745B0000-0x0000000074B61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1540-135-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/2616-133-0x00000000745B0000-0x0000000074B61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2616-148-0x00000000745B0000-0x0000000074B61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2616-132-0x00000000745B0000-0x0000000074B61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2716-159-0x00000000745B0000-0x0000000074B61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2716-158-0x00000000745B0000-0x0000000074B61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2972-142-0x00000000745B0000-0x0000000074B61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2972-149-0x00000000745B0000-0x0000000074B61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2972-140-0x00000000745B0000-0x0000000074B61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3404-147-0x00000000745B0000-0x0000000074B61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3404-146-0x00000000745B0000-0x0000000074B61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/4348-157-0x00000000745B0000-0x0000000074B61000-memory.dmp

    Filesize

    5.7MB

    Download