imminent | 77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042

General

Target

77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe
Size

365KB
MD5

ef25f357ae00df64245826914c696791
SHA1

b4f64d755760ad3ab632950ec49dc4df7b571c2c
SHA256

77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042
SHA512

0d349475e73f623578b6e1cc9340064686fd385087bc82f7196a0692558cd2520695d2de041973d11e2deb46532c0fa7fac4ce61820459f4b6db6d2ec224d196
SSDEEP

6144:5Bhvwg3CbgaGMmFZEIMQG6KJnSSqKcGXpDs2buLHZ0XoyQ+t66Lefppg540wcSpO:eGWmHaQiJS1y5wOCHZEt66ShpcPwhpUJ

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Default Key = "\\Default Folder\\Default File.exe"	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Default Key = "C:\\Users\\Admin\\AppData\\Local\\Default Folder\\Default File.exe"	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1448 set thread context of 2000	1448	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe	27

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe
Token: SeDebugPrivilege	2000	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2000	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2000	1448	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe	27
PID 1448 wrote to memory of 2000	1448	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe	27
PID 1448 wrote to memory of 2000	1448	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe	27
PID 1448 wrote to memory of 2000	1448	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe	27
PID 1448 wrote to memory of 2000	1448	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe	27
PID 1448 wrote to memory of 2000	1448	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe	27
PID 1448 wrote to memory of 2000	1448	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe	27
PID 1448 wrote to memory of 2000	1448	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe	27
PID 1448 wrote to memory of 2000	1448	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe	27
PID 1448 wrote to memory of 2000	1448	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe	27
PID 1448 wrote to memory of 2000	1448	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe	27
PID 1448 wrote to memory of 2000	1448	77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe	27

C:\Users\Admin\AppData\Local\Temp\77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe
"C:\Users\Admin\AppData\Local\Temp\77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe
  "C:\Users\Admin\AppData\Local\Temp\77514bea3bb73a8c75f81b942734d974f41fcbce756380eb000bfc8066a8d042.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1448-55-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/1448-56-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/1448-66-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/2000-61-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2000-60-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2000-58-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2000-62-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2000-65-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2000-57-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2000-68-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2000-70-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2000-71-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing