imminent | 9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f

General

Target

9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe
Size

350KB
MD5

22a4ca0bb8c69559d1705afcfd19036e
SHA1

1e5a7bd56f9c80ea45c36a15a49cd922c1a4b22b
SHA256

9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f
SHA512

1defcf24711937b3a078a6221189e80ea15788ca0a4274bb0da52708c7af45fb51eda68f78e98e13de189478114f3efef3361f9cc5a3a99df0888b9cb331d374
SSDEEP

6144:K7NnAkDl9Rymx8mni62kJmj5SNw9IQV+REZrHfUT0+2ZXShqL:IXDlTyA8mi69JuXGQV4GHfUT0+2ZCY

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SYSTEM.lnk	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe

Loads dropped DLL 1 IoCs

pid	Process
1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1928 set thread context of 956	1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe
1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
956	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe
Token: SeDebugPrivilege	956	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
956	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 956	1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe	29
PID 1928 wrote to memory of 956	1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe	29
PID 1928 wrote to memory of 956	1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe	29
PID 1928 wrote to memory of 956	1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe	29
PID 1928 wrote to memory of 956	1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe	29
PID 1928 wrote to memory of 956	1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe	29
PID 1928 wrote to memory of 956	1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe	29
PID 1928 wrote to memory of 956	1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe	29
PID 1928 wrote to memory of 956	1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe	29
PID 1928 wrote to memory of 956	1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe	29
PID 1928 wrote to memory of 956	1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe	29
PID 1928 wrote to memory of 956	1928	9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe	29

C:\Users\Admin\AppData\Local\Temp\9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe
"C:\Users\Admin\AppData\Local\Temp\9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\svchost\svchost.exe

Filesize
350KB

MD5
22a4ca0bb8c69559d1705afcfd19036e

SHA1
1e5a7bd56f9c80ea45c36a15a49cd922c1a4b22b

SHA256
9f6da3708198e2274424357250b5842d627f1486373731f88d520ecd66b2275f

SHA512
1defcf24711937b3a078a6221189e80ea15788ca0a4274bb0da52708c7af45fb51eda68f78e98e13de189478114f3efef3361f9cc5a3a99df0888b9cb331d374

Download Submit
memory/956-60-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/956-56-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/956-57-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/956-59-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/956-61-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/956-64-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/956-66-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/956-70-0x0000000074360000-0x000000007490B000-memory.dmp

Filesize
5.7MB

Download
memory/956-71-0x0000000074360000-0x000000007490B000-memory.dmp

Filesize
5.7MB

Download
memory/1928-54-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1928-67-0x0000000074360000-0x000000007490B000-memory.dmp

Filesize
5.7MB

Download
memory/1928-55-0x0000000074360000-0x000000007490B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing