imminent | fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe
Size

1.1MB
MD5

55aaf5931e1f74b704044b846d2ffcdf
SHA1

1bf392fb69e3d76e4a105c8efe4ec2c9cab96e63
SHA256

fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a
SHA512

4ca8c392cb2c6db962df8cebb67cfaf9c0ee0f81e43dd9be058ff7cc2c851c4c9f4de8c264617293d32885b986e5dab3c030296237ea9ecd6f57c0702373bee8
SSDEEP

24576:t2O/Gl+L9i4SWzsCx592IRNHfOUED4RVPVI8Qyqd7FbO:sqn0IfHfOUEDAILyYhO

Score

10^/10

imminent evasion persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent
Executes dropped EXE 1 IoCs

Processes:

winUpdate.exe

pid process

1952 winUpdate.exe

Loads dropped DLL 4 IoCs

Processes:

fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe

pid	process
1976	fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe
1976	fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe
1976	fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe
1976	fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winUpdate.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	winUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RUN	winUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	winUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	winUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\m2v4v7zg9ix7 = "\\Users\\Admin\\m2v4v7zg9ix7\\lextapzxx.vbs"	winUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RUN	winUpdate.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

winUpdate.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winUpdate.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

winUpdate.exe

description pid process target process

PID 1952 set thread context of 1808 1952 winUpdate.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winUpdate.exe

description	pid	process	target process
PID 1952 set thread context of 1808	1952	winUpdate.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

winUpdate.exe

pid	process
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe
1952	winUpdate.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegSvcs.exe

pid process

1808 RegSvcs.exe

pid	process
1808	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

winUpdate.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1808	RegSvcs.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe
Token: SeDebugPrivilege	1952	winUpdate.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

828 DllHost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

1808 RegSvcs.exe

pid	process
828	DllHost.exe

pid	process
1808	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exewinUpdate.exe

description	pid	process	target process
PID 1976 wrote to memory of 1952	1976	fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe	winUpdate.exe
PID 1976 wrote to memory of 1952	1976	fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe	winUpdate.exe
PID 1976 wrote to memory of 1952	1976	fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe	winUpdate.exe
PID 1976 wrote to memory of 1952	1976	fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe	winUpdate.exe
PID 1976 wrote to memory of 1952	1976	fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe	winUpdate.exe
PID 1976 wrote to memory of 1952	1976	fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe	winUpdate.exe
PID 1976 wrote to memory of 1952	1976	fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe	winUpdate.exe
PID 1952 wrote to memory of 1808	1952	winUpdate.exe	RegSvcs.exe
PID 1952 wrote to memory of 1808	1952	winUpdate.exe	RegSvcs.exe
PID 1952 wrote to memory of 1808	1952	winUpdate.exe	RegSvcs.exe
PID 1952 wrote to memory of 1808	1952	winUpdate.exe	RegSvcs.exe
PID 1952 wrote to memory of 1808	1952	winUpdate.exe	RegSvcs.exe
PID 1952 wrote to memory of 1808	1952	winUpdate.exe	RegSvcs.exe
PID 1952 wrote to memory of 1808	1952	winUpdate.exe	RegSvcs.exe
PID 1952 wrote to memory of 1808	1952	winUpdate.exe	RegSvcs.exe
PID 1952 wrote to memory of 1808	1952	winUpdate.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe
"C:\Users\Admin\AppData\Local\Temp\fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976

C:\Users\Admin\m2v4v7zg9ix7\winUpdate.exe
"C:\Users\Admin\m2v4v7zg9ix7\winUpdate.exe" kvokks.MCA
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1808

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\M2V4V7~1\ZEITBJ~1.LED

Filesize
277KB

MD5
4d830bb6881a011a725275f75499645c

SHA1
53f14a69f53dcda8425405123425f34930753218

SHA256
e06fe878c778112e6784fea4b309f7b44fe027e1a89d030975bf565fea815bfe

SHA512
cd52904a56651d9f9a292b7161adf28520869bd42d907b44535cab2399c7091ed0dfa3a1f757d83a8b21f082dc6f794b59f8e765de5879965352e7bc70375fc6

Download Submit
C:\Users\Admin\M2V4V7~1\dnrmxytyqprc.API

Filesize
229B

MD5
4b94795c0152d55af432c777d1e21d0e

SHA1
64fd547f958cba6fea747cc8a476bd194ff10845

SHA256
16d5e9af35da06436f114d21f14e53beb93c6a57e0ae6fabc603edd27f355eba

SHA512
6d9bed98380f2a377e9dc889da85c714f4f5f9ba029d551f340bd53c229547573a49e215d43d7143ccf0b74dd08b05c7b7c7b4e1329844b5687f1461c817e4d1

Download Submit
C:\Users\Admin\m2v4v7zg9ix7\10247263_10202873382028955_2089067036119093882_n.jpg

Filesize
8KB

MD5
1d83511c6eff4e2e7d5602f7f5371242

SHA1
db38371c527c658fc01ca363eaab04ef4e4aeef1

SHA256
9270c4da84198d5ccc0f36974dfaf452e21998d15db9223ecb90729ed22f7297

SHA512
d8c34479fa1404cca90a848e00c66efda5e89a2031a04d1f1b5240683f76681c8d268dc3fd52b159857a4350c54913d6b557ff7c4253e0bd47453d8ad2cd5209

Download Submit
C:\Users\Admin\m2v4v7zg9ix7\kvokks.MCA

Filesize
324.1MB

MD5
1528a7a002c969e55798a08329130ba2

SHA1
054e90574a38cfdf61097decb332ee741fcddd2a

SHA256
409699856af740ef8e251d8a72080a19eb2d9589975a5a6c5a8b503010f2d190

SHA512
2128551e1f1ec79a9cd2d821d73b3b7a20460f6c7a598f232eab75357ddb7b1e8dadd2cadb92bd82a26da2867b3db6c789138df85ff590e92aa4cf8e44db0d9c

Download Submit
C:\Users\Admin\m2v4v7zg9ix7\winUpdate.exe

Filesize
912KB

MD5
6a93a4071cc7c22628af40a4d872f49b

SHA1
ba916e686aa0cae19ab907bdab94924ada92b5f4

SHA256
8465f3fcbccce3ea12495edbb0bd09c3b066e3df891613ce3180f9bb38b37b01

SHA512
5a26af395a03397aadab13a53cac320f1d8bbe77046a61ae12e1f72f93df7afb360f52ef52f979f7b946a814365a298c3a3a536add6cdd7165896fb82abc4afd

Download Submit
\Users\Admin\m2v4v7zg9ix7\winUpdate.exe

Filesize
912KB

MD5
6a93a4071cc7c22628af40a4d872f49b

SHA1
ba916e686aa0cae19ab907bdab94924ada92b5f4

SHA256
8465f3fcbccce3ea12495edbb0bd09c3b066e3df891613ce3180f9bb38b37b01

SHA512
5a26af395a03397aadab13a53cac320f1d8bbe77046a61ae12e1f72f93df7afb360f52ef52f979f7b946a814365a298c3a3a536add6cdd7165896fb82abc4afd

Download Submit
\Users\Admin\m2v4v7zg9ix7\winUpdate.exe

Filesize
912KB

MD5
6a93a4071cc7c22628af40a4d872f49b

SHA1
ba916e686aa0cae19ab907bdab94924ada92b5f4

SHA256
8465f3fcbccce3ea12495edbb0bd09c3b066e3df891613ce3180f9bb38b37b01

SHA512
5a26af395a03397aadab13a53cac320f1d8bbe77046a61ae12e1f72f93df7afb360f52ef52f979f7b946a814365a298c3a3a536add6cdd7165896fb82abc4afd

Download Submit
\Users\Admin\m2v4v7zg9ix7\winUpdate.exe

Filesize
912KB

MD5
6a93a4071cc7c22628af40a4d872f49b

SHA1
ba916e686aa0cae19ab907bdab94924ada92b5f4

SHA256
8465f3fcbccce3ea12495edbb0bd09c3b066e3df891613ce3180f9bb38b37b01

SHA512
5a26af395a03397aadab13a53cac320f1d8bbe77046a61ae12e1f72f93df7afb360f52ef52f979f7b946a814365a298c3a3a536add6cdd7165896fb82abc4afd

Download Submit
\Users\Admin\m2v4v7zg9ix7\winUpdate.exe

Filesize
912KB

MD5
6a93a4071cc7c22628af40a4d872f49b

SHA1
ba916e686aa0cae19ab907bdab94924ada92b5f4

SHA256
8465f3fcbccce3ea12495edbb0bd09c3b066e3df891613ce3180f9bb38b37b01

SHA512
5a26af395a03397aadab13a53cac320f1d8bbe77046a61ae12e1f72f93df7afb360f52ef52f979f7b946a814365a298c3a3a536add6cdd7165896fb82abc4afd

Download Submit
memory/1808-66-0x0000000000190000-0x00000000001DC000-memory.dmp

Filesize
304KB

Download
memory/1808-68-0x0000000000190000-0x00000000001DC000-memory.dmp

Filesize
304KB

Download
memory/1808-69-0x00000000001D676E-mapping.dmp

Download
memory/1808-71-0x0000000000190000-0x00000000001DC000-memory.dmp

Filesize
304KB

Download
memory/1808-73-0x0000000000190000-0x00000000001DC000-memory.dmp

Filesize
304KB

Download
memory/1808-75-0x0000000072D90000-0x000000007333B000-memory.dmp

Filesize
5.7MB

Download
memory/1808-76-0x0000000072D90000-0x000000007333B000-memory.dmp

Filesize
5.7MB

Download
memory/1952-59-0x0000000000000000-mapping.dmp

Download
memory/1976-54-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download