imminent | d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019

Analysis

max time kernel
133s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe
Size

4.1MB
MD5

9439e74301186e03234adb19eb1e525a
SHA1

cf154286505f90df48b31df60478ca1efc2a88d1
SHA256

d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019
SHA512

e9925e735a8c2abec978a3591c7071e5ee7a4ccad986b721deb90843c35a770f9c62c875c1e7017e7da18d157ca54de56a775ee004ccbeb627f080427acf595a
SSDEEP

98304:axky0r4chIPsiSCrQ4S4sXg0RVQhwLpNsPdbyOKgO89A:axkZ7Ib7c9dadHbO4A

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\svchost.exe"	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe
File created	C:\Windows\assembly\Desktop.ini	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5080 set thread context of 3980	5080	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	81

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe
File created	C:\Windows\assembly\Desktop.ini	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3980	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3980	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3980	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 3980	5080	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	81
PID 5080 wrote to memory of 3980	5080	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	81
PID 5080 wrote to memory of 3980	5080	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	81
PID 5080 wrote to memory of 3980	5080	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	81
PID 5080 wrote to memory of 3980	5080	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	81
PID 5080 wrote to memory of 3980	5080	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	81
PID 5080 wrote to memory of 3980	5080	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	81
PID 5080 wrote to memory of 3980	5080	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	81

C:\Users\Admin\AppData\Local\Temp\d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe
"C:\Users\Admin\AppData\Local\Temp\d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe
  "C:\Users\Admin\AppData\Local\Temp\d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe"
  2⤵
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3980-135-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3980-136-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3980-134-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3980-138-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/3980-140-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/5080-132-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/5080-139-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download