imminent | d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b

General

Target

d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe
Size

283KB
MD5

8cb8710b7da5abf186990b0d20f9204a
SHA1

361b362e201021c61c145f3ceee972b99217d135
SHA256

d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b
SHA512

76878d3447124456605a505de02d97710ac1c236b76bab7e1ab4ab70ffeceac6a3d466a562558f12762fe777147134c27589466e20f922cb2818dbd1bfb1a2f3
SSDEEP

6144:3VuZKWcJp2gPf6CHcy2xU2/F6iadu6qSN44h+bXge5UX+JbAgS:wZup2gPyCbCy3rjN9+se5U

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows Software Utilizer = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Utilizer.exe"	WScript.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 316 set thread context of 3524	316	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe	85

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe
File opened for modification	C:\Windows\assembly	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3524	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	316	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe
Token: SeDebugPrivilege	3524	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3524	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 3624	316	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe	84
PID 316 wrote to memory of 3624	316	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe	84
PID 316 wrote to memory of 3624	316	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe	84
PID 316 wrote to memory of 3524	316	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe	85
PID 316 wrote to memory of 3524	316	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe	85
PID 316 wrote to memory of 3524	316	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe	85
PID 316 wrote to memory of 3524	316	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe	85
PID 316 wrote to memory of 3524	316	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe	85
PID 316 wrote to memory of 3524	316	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe	85
PID 316 wrote to memory of 3524	316	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe	85
PID 316 wrote to memory of 3524	316	d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe	85
PID 4740 wrote to memory of 4640	4740	explorer.exe	87
PID 4740 wrote to memory of 4640	4740	explorer.exe	87

C:\Users\Admin\AppData\Local\Temp\d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe
"C:\Users\Admin\AppData\Local\Temp\d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\MPXMV.vbs
  2⤵
  PID:3624
- C:\Users\Admin\AppData\Local\Temp\d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe
  "C:\Users\Admin\AppData\Local\Temp\d66f3d576d216843aa4a2aef507b16806ea325282ae0757c95d3d0ca51ad599b.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3524

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\MPXMV.vbs"
  2⤵
  - Adds Run key to start application
  PID:4640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MPXMV.vbs

Filesize
601B

MD5
6026c5831b249215091f76faa06b01c2

SHA1
72ea0a0e03b1272691595cad9b005884c0b2e67d

SHA256
acebaefb5eac358e537b6d19d7f2baf138a598bd6a6fcb5827c9e41c47fd01f6

SHA512
e8f676d1e26072fa9d50a42549248e4e52ad418ecf2fac9e19f1fee2e7f622c0d6a97997c86194404cf4cf5730894dc1bdb38f78328b5b1ccdda24f2174dc8c9

Download Submit
memory/316-132-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download
memory/316-139-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download
memory/3524-135-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3524-138-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download
memory/3524-140-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing