Analysis

  • max time kernel
    149s
  • max time network
    61s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 14:27

General

  • Target

    454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d.exe

  • Size

    385KB

  • MD5

    04cfc2135b1bf2061b5893d826536a23

  • SHA1

    af152c1d257812a315c4e36bb71b871f09bfa47c

  • SHA256

    454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d

  • SHA512

    b364b7f53eeeee263a7f1687cb1a55428ec5d2d99b5698d05cc0f67b674314a693bd9b49f4b122f3d333354a978f81d109345b1d074737f30aadbb7067834335

  • SSDEEP

    6144:g5GxLm5HeuV6VeAJiGE5+I6e2aD+4B6htvOi/+k/Igk2b3LQlwkGnTLELguh9NbE:ikLIHFLAMGEBUq+uluggkC7QifTLULbE

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NTFS ADS 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d.exe
    "C:\Users\Admin\AppData\Local\Temp\454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d.exe"
    1⤵
    • Loads dropped DLL
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Local\Temp\454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d.exe":ZONE.identifier & exit
      2⤵
      • NTFS ADS
      PID:760
    • C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
      "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:2020
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe":ZONE.identifier & exit
        3⤵
        • NTFS ADS
        PID:1356
      • C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:616
      • C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe
        "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe" -reg C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe -proc 616 C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1660

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d.exe

    Filesize

    385KB

    MD5

    04cfc2135b1bf2061b5893d826536a23

    SHA1

    af152c1d257812a315c4e36bb71b871f09bfa47c

    SHA256

    454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d

    SHA512

    b364b7f53eeeee263a7f1687cb1a55428ec5d2d99b5698d05cc0f67b674314a693bd9b49f4b122f3d333354a978f81d109345b1d074737f30aadbb7067834335

  • C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe

    Filesize

    385KB

    MD5

    04cfc2135b1bf2061b5893d826536a23

    SHA1

    af152c1d257812a315c4e36bb71b871f09bfa47c

    SHA256

    454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d

    SHA512

    b364b7f53eeeee263a7f1687cb1a55428ec5d2d99b5698d05cc0f67b674314a693bd9b49f4b122f3d333354a978f81d109345b1d074737f30aadbb7067834335

  • C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe

    Filesize

    385KB

    MD5

    04cfc2135b1bf2061b5893d826536a23

    SHA1

    af152c1d257812a315c4e36bb71b871f09bfa47c

    SHA256

    454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d

    SHA512

    b364b7f53eeeee263a7f1687cb1a55428ec5d2d99b5698d05cc0f67b674314a693bd9b49f4b122f3d333354a978f81d109345b1d074737f30aadbb7067834335

  • C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

    Filesize

    385KB

    MD5

    04cfc2135b1bf2061b5893d826536a23

    SHA1

    af152c1d257812a315c4e36bb71b871f09bfa47c

    SHA256

    454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d

    SHA512

    b364b7f53eeeee263a7f1687cb1a55428ec5d2d99b5698d05cc0f67b674314a693bd9b49f4b122f3d333354a978f81d109345b1d074737f30aadbb7067834335

  • C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

    Filesize

    385KB

    MD5

    04cfc2135b1bf2061b5893d826536a23

    SHA1

    af152c1d257812a315c4e36bb71b871f09bfa47c

    SHA256

    454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d

    SHA512

    b364b7f53eeeee263a7f1687cb1a55428ec5d2d99b5698d05cc0f67b674314a693bd9b49f4b122f3d333354a978f81d109345b1d074737f30aadbb7067834335

  • C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

    Filesize

    385KB

    MD5

    04cfc2135b1bf2061b5893d826536a23

    SHA1

    af152c1d257812a315c4e36bb71b871f09bfa47c

    SHA256

    454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d

    SHA512

    b364b7f53eeeee263a7f1687cb1a55428ec5d2d99b5698d05cc0f67b674314a693bd9b49f4b122f3d333354a978f81d109345b1d074737f30aadbb7067834335

  • C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

    Filesize

    385KB

    MD5

    04cfc2135b1bf2061b5893d826536a23

    SHA1

    af152c1d257812a315c4e36bb71b871f09bfa47c

    SHA256

    454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d

    SHA512

    b364b7f53eeeee263a7f1687cb1a55428ec5d2d99b5698d05cc0f67b674314a693bd9b49f4b122f3d333354a978f81d109345b1d074737f30aadbb7067834335

  • \Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe

    Filesize

    385KB

    MD5

    04cfc2135b1bf2061b5893d826536a23

    SHA1

    af152c1d257812a315c4e36bb71b871f09bfa47c

    SHA256

    454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d

    SHA512

    b364b7f53eeeee263a7f1687cb1a55428ec5d2d99b5698d05cc0f67b674314a693bd9b49f4b122f3d333354a978f81d109345b1d074737f30aadbb7067834335

  • \Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe

    Filesize

    385KB

    MD5

    04cfc2135b1bf2061b5893d826536a23

    SHA1

    af152c1d257812a315c4e36bb71b871f09bfa47c

    SHA256

    454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d

    SHA512

    b364b7f53eeeee263a7f1687cb1a55428ec5d2d99b5698d05cc0f67b674314a693bd9b49f4b122f3d333354a978f81d109345b1d074737f30aadbb7067834335

  • \Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

    Filesize

    385KB

    MD5

    04cfc2135b1bf2061b5893d826536a23

    SHA1

    af152c1d257812a315c4e36bb71b871f09bfa47c

    SHA256

    454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d

    SHA512

    b364b7f53eeeee263a7f1687cb1a55428ec5d2d99b5698d05cc0f67b674314a693bd9b49f4b122f3d333354a978f81d109345b1d074737f30aadbb7067834335

  • \Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

    Filesize

    385KB

    MD5

    04cfc2135b1bf2061b5893d826536a23

    SHA1

    af152c1d257812a315c4e36bb71b871f09bfa47c

    SHA256

    454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d

    SHA512

    b364b7f53eeeee263a7f1687cb1a55428ec5d2d99b5698d05cc0f67b674314a693bd9b49f4b122f3d333354a978f81d109345b1d074737f30aadbb7067834335

  • \Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe

    Filesize

    385KB

    MD5

    04cfc2135b1bf2061b5893d826536a23

    SHA1

    af152c1d257812a315c4e36bb71b871f09bfa47c

    SHA256

    454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d

    SHA512

    b364b7f53eeeee263a7f1687cb1a55428ec5d2d99b5698d05cc0f67b674314a693bd9b49f4b122f3d333354a978f81d109345b1d074737f30aadbb7067834335

  • memory/616-71-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/616-83-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/616-96-0x00000000748F0000-0x0000000074E9B000-memory.dmp

    Filesize

    5.7MB

  • memory/616-88-0x00000000748F0000-0x0000000074E9B000-memory.dmp

    Filesize

    5.7MB

  • memory/616-80-0x000000000044690E-mapping.dmp

  • memory/616-74-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/616-72-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/616-76-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/616-78-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/616-85-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/760-57-0x0000000000000000-mapping.dmp

  • memory/1324-65-0x00000000748F0000-0x0000000074E9B000-memory.dmp

    Filesize

    5.7MB

  • memory/1324-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

    Filesize

    8KB

  • memory/1324-56-0x00000000748F0000-0x0000000074E9B000-memory.dmp

    Filesize

    5.7MB

  • memory/1324-55-0x00000000748F0000-0x0000000074E9B000-memory.dmp

    Filesize

    5.7MB

  • memory/1356-68-0x0000000000000000-mapping.dmp

  • memory/1660-90-0x0000000000000000-mapping.dmp

  • memory/1660-95-0x00000000748F0000-0x0000000074E9B000-memory.dmp

    Filesize

    5.7MB

  • memory/1660-97-0x00000000748F0000-0x0000000074E9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2020-61-0x0000000000000000-mapping.dmp

  • memory/2020-66-0x00000000748F0000-0x0000000074E9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2020-94-0x00000000748F0000-0x0000000074E9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2020-67-0x00000000748F0000-0x0000000074E9B000-memory.dmp

    Filesize

    5.7MB