imminent | f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7

General

Target

f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe
Size

15.3MB
MD5

990a2e47277c3bffe454f4f48f0cd7bf
SHA1

7970cfcd5b63e87385f74bbb730a9f749ff71a80
SHA256

f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7
SHA512

f93c0b6b0985d255ac576edf843278e8941e2efd1fac362b7f476ec13285c4ffcfe2e1faadebca740933638be82f73eb6e98c933851a0e2f15c38feb67492340
SSDEEP

393216:IDMDfO0IHI7Krnk0SmkypsCFn9W2SQanbAcZIfbMhs6my7Sqqh:guObIeZSmksFn0caRIYh37

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\eokLC9pERK36Kl3O\\7zLt5N8UAvjM.exe\",explorer.exe"	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe

Executes dropped EXE 1 IoCs

pid	Process
2008	Fa2xXWGenayjm3nY.exe

Loads dropped DLL 1 IoCs

pid	Process
1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1228 set thread context of 1124	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral1/files/0x0008000000012304-57.dat	nsis_installer_1
behavioral1/files/0x0008000000012304-57.dat	nsis_installer_2
behavioral1/files/0x0008000000012304-59.dat	nsis_installer_1
behavioral1/files/0x0008000000012304-59.dat	nsis_installer_2
behavioral1/files/0x0008000000012304-66.dat	nsis_installer_1
behavioral1/files/0x0008000000012304-66.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe
1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe
1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1124	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe
Token: SeDebugPrivilege	1124	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1124	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2008	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	28
PID 1228 wrote to memory of 2008	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	28
PID 1228 wrote to memory of 2008	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	28
PID 1228 wrote to memory of 2008	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	28
PID 1228 wrote to memory of 1576	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	30
PID 1228 wrote to memory of 1576	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	30
PID 1228 wrote to memory of 1576	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	30
PID 1228 wrote to memory of 1576	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	30
PID 1228 wrote to memory of 1124	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	29
PID 1228 wrote to memory of 1124	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	29
PID 1228 wrote to memory of 1124	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	29
PID 1228 wrote to memory of 1124	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	29
PID 1228 wrote to memory of 1124	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	29
PID 1228 wrote to memory of 1124	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	29
PID 1228 wrote to memory of 1124	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	29
PID 1228 wrote to memory of 1124	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	29
PID 1228 wrote to memory of 1124	1228	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	29

C:\Users\Admin\AppData\Local\Temp\f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe
"C:\Users\Admin\AppData\Local\Temp\f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\Fa2xXWGenayjm3nY.exe
  "C:\Users\Admin\AppData\Local\Temp\Fa2xXWGenayjm3nY.exe"
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Users\Admin\AppData\Local\Temp\f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe
  "C:\Users\Admin\AppData\Local\Temp\f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1124
- C:\Users\Admin\AppData\Local\Temp\f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe
  "C:\Users\Admin\AppData\Local\Temp\f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe"
  2⤵
  PID:1576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Fa2xXWGenayjm3nY.exe

Filesize
14.7MB

MD5
b75ae064134d795d7552125022f5a675

SHA1
49fbb7a99a472b46038702eb99ac4473f79f281a

SHA256
b0ced62132a8abb4caea4cc33a00afd1890780fb65c811ecac748753f852a25a

SHA512
1fa27592eb881aeb402cfaac2dc408cc1c797ebda2da0e759d512b46c22f3f9d5e7afaf595fb0d93f27239176d39fa671cc8ea715debb25b00342686291ff233

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fa2xXWGenayjm3nY.exe

Filesize
14.7MB

MD5
b75ae064134d795d7552125022f5a675

SHA1
49fbb7a99a472b46038702eb99ac4473f79f281a

SHA256
b0ced62132a8abb4caea4cc33a00afd1890780fb65c811ecac748753f852a25a

SHA512
1fa27592eb881aeb402cfaac2dc408cc1c797ebda2da0e759d512b46c22f3f9d5e7afaf595fb0d93f27239176d39fa671cc8ea715debb25b00342686291ff233

Download Submit
\Users\Admin\AppData\Local\Temp\Fa2xXWGenayjm3nY.exe

Filesize
14.7MB

MD5
b75ae064134d795d7552125022f5a675

SHA1
49fbb7a99a472b46038702eb99ac4473f79f281a

SHA256
b0ced62132a8abb4caea4cc33a00afd1890780fb65c811ecac748753f852a25a

SHA512
1fa27592eb881aeb402cfaac2dc408cc1c797ebda2da0e759d512b46c22f3f9d5e7afaf595fb0d93f27239176d39fa671cc8ea715debb25b00342686291ff233

Download Submit
memory/1124-67-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1124-75-0x0000000074A60000-0x000000007500B000-memory.dmp

Filesize
5.7MB

Download
memory/1124-61-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1124-62-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1124-64-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1124-65-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1124-74-0x0000000074A60000-0x000000007500B000-memory.dmp

Filesize
5.7MB

Download
memory/1124-72-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1124-70-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1228-54-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/1228-55-0x0000000074A60000-0x000000007500B000-memory.dmp

Filesize
5.7MB

Download
memory/1228-56-0x0000000074A60000-0x000000007500B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing