imminent | 44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e

General

Target

44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe
Size

356KB
MD5

7b29d2bdf75a8c1470803aa389b7979e
SHA1

56d116e2812b87eecd652e57f0a1a461ce77db52
SHA256

44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e
SHA512

af3efc650062e90366861a88750b8254796be876a3582c16762aeceb051bb601524b76ba14a42d002cb9ef487bdf6e4d2b5341114b724a26e457ebdad3560b23
SSDEEP

6144:e+2Z0zZGUlQqluuICq+XD2Xj0rHdjEL1FA1z7XiQzdH+m2QXotsZbnp:p2ZyZFJuiPDC45jQ1FA1z7XrzoFQo4p

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Default Key = "\\Default Folder\\Default File.exe"	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Default Key = "C:\\Users\\Admin\\AppData\\Local\\Default Folder\\Default File.exe"	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2952 set thread context of 5056	2952	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	80

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe
File created	C:\Windows\assembly\Desktop.ini	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5056	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2952	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe
Token: SeDebugPrivilege	5056	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5056	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 5056	2952	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	80
PID 2952 wrote to memory of 5056	2952	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	80
PID 2952 wrote to memory of 5056	2952	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	80
PID 2952 wrote to memory of 5056	2952	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	80
PID 2952 wrote to memory of 5056	2952	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	80
PID 2952 wrote to memory of 5056	2952	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	80
PID 2952 wrote to memory of 5056	2952	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	80
PID 2952 wrote to memory of 5056	2952	44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe	80

C:\Users\Admin\AppData\Local\Temp\44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe
"C:\Users\Admin\AppData\Local\Temp\44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Users\Admin\AppData\Local\Temp\44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe
  "C:\Users\Admin\AppData\Local\Temp\44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe"
  2⤵
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\44313461595aab5603003276a9afa3952987a1df3e9e774bb8caa65e9a4d9a1e.exe.log

Filesize
319B

MD5
91046f2e147049d3e53cd9bf9d4d95ed

SHA1
228e347d062840b2edcbd16904475aacad414c62

SHA256
ea92f8291b86440b98162409b1f9f04470455c22be01a1480ea5ebc37eb168dc

SHA512
071a9c6e17760a726c3a4519cf8006f36f17f50946af0129e0e1f3e480f6b7fcc804a7614b044247f2420a8b2b46bec5b8493e4869bb918bc7c0f6aa1346c3e0

Download Submit
memory/2952-132-0x00000000754F0000-0x0000000075AA1000-memory.dmp

Filesize
5.7MB

Download
memory/2952-136-0x00000000754F0000-0x0000000075AA1000-memory.dmp

Filesize
5.7MB

Download
memory/5056-134-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/5056-137-0x00000000754F0000-0x0000000075AA1000-memory.dmp

Filesize
5.7MB

Download
memory/5056-138-0x00000000754F0000-0x0000000075AA1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing