imminent | f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7

General

Target

f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe
Size

15.3MB
MD5

990a2e47277c3bffe454f4f48f0cd7bf
SHA1

7970cfcd5b63e87385f74bbb730a9f749ff71a80
SHA256

f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7
SHA512

f93c0b6b0985d255ac576edf843278e8941e2efd1fac362b7f476ec13285c4ffcfe2e1faadebca740933638be82f73eb6e98c933851a0e2f15c38feb67492340
SSDEEP

393216:IDMDfO0IHI7Krnk0SmkypsCFn9W2SQanbAcZIfbMhs6my7Sqqh:guObIeZSmksFn0caRIYh37

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\eokLC9pERK36Kl3O\\Xm6kBi1aqXDu.exe\",explorer.exe"	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe

Executes dropped EXE 1 IoCs

pid	Process
760	rbxPHnAT6exXkqQF.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5032 set thread context of 964	5032	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	94

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe
File created	C:\Windows\assembly\Desktop.ini	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x000b000000022e06-135.dat	nsis_installer_1
behavioral2/files/0x000b000000022e06-135.dat	nsis_installer_2
behavioral2/files/0x000b000000022e06-136.dat	nsis_installer_1
behavioral2/files/0x000b000000022e06-136.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5032	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe
5032	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5032	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe
Token: SeDebugPrivilege	964	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
964	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 760	5032	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	93
PID 5032 wrote to memory of 760	5032	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	93
PID 5032 wrote to memory of 760	5032	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	93
PID 5032 wrote to memory of 964	5032	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	94
PID 5032 wrote to memory of 964	5032	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	94
PID 5032 wrote to memory of 964	5032	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	94
PID 5032 wrote to memory of 964	5032	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	94
PID 5032 wrote to memory of 964	5032	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	94
PID 5032 wrote to memory of 964	5032	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	94
PID 5032 wrote to memory of 964	5032	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	94
PID 5032 wrote to memory of 964	5032	f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe	94

C:\Users\Admin\AppData\Local\Temp\f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe
"C:\Users\Admin\AppData\Local\Temp\f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Users\Admin\AppData\Local\Temp\rbxPHnAT6exXkqQF.exe
  "C:\Users\Admin\AppData\Local\Temp\rbxPHnAT6exXkqQF.exe"
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Users\Admin\AppData\Local\Temp\f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe
  "C:\Users\Admin\AppData\Local\Temp\f841bcb05f60885d16227b209e4863e5cada9df1db88c13eee9c7f289f3982d7.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rbxPHnAT6exXkqQF.exe

Filesize
14.7MB

MD5
b75ae064134d795d7552125022f5a675

SHA1
49fbb7a99a472b46038702eb99ac4473f79f281a

SHA256
b0ced62132a8abb4caea4cc33a00afd1890780fb65c811ecac748753f852a25a

SHA512
1fa27592eb881aeb402cfaac2dc408cc1c797ebda2da0e759d512b46c22f3f9d5e7afaf595fb0d93f27239176d39fa671cc8ea715debb25b00342686291ff233

Download Submit
C:\Users\Admin\AppData\Local\Temp\rbxPHnAT6exXkqQF.exe

Filesize
14.7MB

MD5
b75ae064134d795d7552125022f5a675

SHA1
49fbb7a99a472b46038702eb99ac4473f79f281a

SHA256
b0ced62132a8abb4caea4cc33a00afd1890780fb65c811ecac748753f852a25a

SHA512
1fa27592eb881aeb402cfaac2dc408cc1c797ebda2da0e759d512b46c22f3f9d5e7afaf595fb0d93f27239176d39fa671cc8ea715debb25b00342686291ff233

Download Submit
memory/964-138-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/964-139-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download
memory/964-140-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download
memory/5032-132-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download
memory/5032-133-0x00000000750B0000-0x0000000075661000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing