imminent | 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7

General

Target

7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
Size

533KB
MD5

6b6213539afc18332b63b710ab9570bc
SHA1

a3fbb4a82ef989bc8b97bc429251032e47aa1eb6
SHA256

7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7
SHA512

71fea4bb4bea40566b21f4057d013eb2e16a57b5e3a17a9c351be4c523a3271ebdcffadb916b545fe995ffc38443969f0e07346517b07cd6c3fc8fa55680972e
SSDEEP

12288:SDNXmc6yNoW0shQjrscZziDbY26b3KkRwNhcDy7Jf:lzW/ajcD6b6kRwNhNJf

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 2 IoCs

Processes:

7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

pid	process
5064	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
2164	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\Sample.lnk"	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

description	pid	process	target process
PID 4056 set thread context of 2164	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

Drops file in Windows directory 3 IoCs

Processes:

7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

description	ioc	process
File opened for modification	C:\Windows\assembly\Desktop.ini	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
File opened for modification	C:\Windows\assembly	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
File created	C:\Windows\assembly\Desktop.ini	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

pid	process
4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

pid process

2164 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

pid	process
2164	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

description	pid	process
Token: SeDebugPrivilege	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
Token: SeDebugPrivilege	2164	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

pid process

2164 7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

pid	process
2164	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

C:\Users\Admin\AppData\Local\Temp\7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
"C:\Users\Admin\AppData\Local\Temp\7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\SysWOW64\CMD.exe
"CMD"
2⤵
PID:1352

C:\Windows\SysWOW64\CMD.exe
"CMD"
2⤵
PID:1068

C:\Users\Admin\AppData\Local\Temp\7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
"C:\Users\Admin\AppData\Local\Temp\7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe"
2⤵
- Executes dropped EXE
PID:5064

C:\Users\Admin\AppData\Local\Temp\7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
"C:\Users\Admin\AppData\Local\Temp\7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe"
2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
Filesize
533KB

MD5
6b6213539afc18332b63b710ab9570bc

SHA1
a3fbb4a82ef989bc8b97bc429251032e47aa1eb6

SHA256
7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7

SHA512
71fea4bb4bea40566b21f4057d013eb2e16a57b5e3a17a9c351be4c523a3271ebdcffadb916b545fe995ffc38443969f0e07346517b07cd6c3fc8fa55680972e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
Filesize
533KB

MD5
6b6213539afc18332b63b710ab9570bc

SHA1
a3fbb4a82ef989bc8b97bc429251032e47aa1eb6

SHA256
7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7

SHA512
71fea4bb4bea40566b21f4057d013eb2e16a57b5e3a17a9c351be4c523a3271ebdcffadb916b545fe995ffc38443969f0e07346517b07cd6c3fc8fa55680972e

Download Submit
memory/1068-264-0x0000000000000000-mapping.dmp

Download
memory/1352-263-0x0000000000000000-mapping.dmp

Download
memory/2164-290-0x0000000075010000-0x00000000755C1000-memory.dmp

Filesize
5.7MB

Download
memory/2164-277-0x0000000075010000-0x00000000755C1000-memory.dmp

Filesize
5.7MB

Download
memory/2164-273-0x0000000000770000-0x00000000007701A7-memory.dmp

Filesize
423B

Download
memory/2164-272-0x0000000000000000-mapping.dmp

Download
memory/4056-184-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-269-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-172-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-173-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-183-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-132-0x0000000075010000-0x00000000755C1000-memory.dmp

Filesize
5.7MB

Download
memory/4056-204-0x0000000075010000-0x00000000755C1000-memory.dmp

Filesize
5.7MB

Download
memory/4056-205-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-206-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-215-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-217-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-226-0x0000000001575000-0x0000000001577000-memory.dmp

Filesize
8KB

Download
memory/4056-228-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-238-0x000000000158F000-0x0000000001591000-memory.dmp

Filesize
8KB

Download
memory/4056-239-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-240-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-241-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-251-0x0000000001593000-0x0000000001595000-memory.dmp

Filesize
8KB

Download
memory/4056-160-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-159-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-265-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-266-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-267-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-161-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-268-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-133-0x000000000155F000-0x0000000001568000-memory.dmp

Filesize
36KB

Download
memory/4056-138-0x0000000001593000-0x0000000001595000-memory.dmp

Filesize
8KB

Download
memory/4056-139-0x0000000001592000-0x0000000001594000-memory.dmp

Filesize
8KB

Download
memory/4056-136-0x000000000158F000-0x0000000001591000-memory.dmp

Filesize
8KB

Download
memory/4056-135-0x000000000158E000-0x0000000001591000-memory.dmp

Filesize
12KB

Download
memory/4056-275-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-276-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-134-0x0000000001575000-0x0000000001577000-memory.dmp

Filesize
8KB

Download
memory/4056-278-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-279-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-280-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-281-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-282-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-283-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-284-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-285-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-286-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-287-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-288-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/4056-289-0x0000000006990000-0x0000000006A90000-memory.dmp

Filesize
1024KB

Download
memory/5064-270-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 4056 wrote to memory of 1352	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	CMD.exe
PID 4056 wrote to memory of 1352	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	CMD.exe
PID 4056 wrote to memory of 1352	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	CMD.exe
PID 4056 wrote to memory of 1068	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	CMD.exe
PID 4056 wrote to memory of 1068	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	CMD.exe
PID 4056 wrote to memory of 1068	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	CMD.exe
PID 4056 wrote to memory of 5064	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
PID 4056 wrote to memory of 5064	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
PID 4056 wrote to memory of 5064	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
PID 4056 wrote to memory of 2164	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
PID 4056 wrote to memory of 2164	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
PID 4056 wrote to memory of 2164	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
PID 4056 wrote to memory of 2164	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
PID 4056 wrote to memory of 2164	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
PID 4056 wrote to memory of 2164	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
PID 4056 wrote to memory of 2164	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
PID 4056 wrote to memory of 2164	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
PID 4056 wrote to memory of 2164	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe
PID 4056 wrote to memory of 2164	4056	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe	7a93490e9058ec8a46a67012d797f0385c7ab54821a130cbec77e78ce95ae6c7.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads