imminent | 44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e

General

Target

44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe
Size

356KB
MD5

7b29d2bdf75a8c1470803aa389b7979e
SHA1

56d116e2812b87eecd652e57f0a1a461ce77db52
SHA256

44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e
SHA512

af3efc650062e90366861a88750b8254796be876a3582c16762aeceb051bb601524b76ba14a42d002cb9ef487bdf6e4d2b5341114b724a26e457ebdad3560b23
SSDEEP

6144:e+2Z0zZGUlQqluuICq+XD2Xj0rHdjEL1FA1z7XiQzdH+m2QXotsZbnp:p2ZyZFJuiPDC45jQ1FA1z7XrzoFQo4p

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Default Key = "C:\\Users\\Admin\\AppData\\Local\\Default Folder\\Default File.exe"	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Default Key = "\\Default Folder\\Default File.exe"	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 1748	1848	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	28

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1748	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe
Token: SeDebugPrivilege	1748	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1748	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1748	1848	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	28
PID 1848 wrote to memory of 1748	1848	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	28
PID 1848 wrote to memory of 1748	1848	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	28
PID 1848 wrote to memory of 1748	1848	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	28
PID 1848 wrote to memory of 1748	1848	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	28
PID 1848 wrote to memory of 1748	1848	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	28
PID 1848 wrote to memory of 1748	1848	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	28
PID 1848 wrote to memory of 1748	1848	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	28
PID 1848 wrote to memory of 1748	1848	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	28

C:\Users\Admin\AppData\Local\Temp\44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe
"C:\Users\Admin\AppData\Local\Temp\44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe
  "C:\Users\Admin\AppData\Local\Temp\44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1748-61-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1748-56-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1748-57-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1748-59-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1748-60-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1748-67-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1748-64-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1748-69-0x0000000073F00000-0x00000000744AB000-memory.dmp

Filesize
5.7MB

Download
memory/1748-70-0x0000000073F00000-0x00000000744AB000-memory.dmp

Filesize
5.7MB

Download
memory/1848-55-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/1848-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/1848-66-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing