imminent | a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06

General

Target

a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe
Size

405KB
MD5

3fab513ea72b66790a740640d373a607
SHA1

e469c0f22b903886c630653fc03fb13874c79376
SHA256

a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06
SHA512

955a4c564bbf9a9cac798883aeb2df10b503375df6f5baa635a013e5130a8728a8b5c5883555d6c9ebe69b3daf8bb9f1303cb0ec393c1723a96549599e8aea2b
SSDEEP

6144:CoUdF36jIOMPqT2uNLgGzuNQaQPzMqGOY+uoc4OERP493fLk:CoUdF36cOMiZ+QF7MqLck

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 1792	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1152	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1792	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1792	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1152	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	28
PID 1756 wrote to memory of 1152	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	28
PID 1756 wrote to memory of 1152	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	28
PID 1756 wrote to memory of 1152	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	28
PID 1756 wrote to memory of 1800	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	30
PID 1756 wrote to memory of 1800	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	30
PID 1756 wrote to memory of 1800	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	30
PID 1756 wrote to memory of 1800	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	30
PID 1756 wrote to memory of 1792	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	31
PID 1756 wrote to memory of 1792	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	31
PID 1756 wrote to memory of 1792	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	31
PID 1756 wrote to memory of 1792	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	31
PID 1756 wrote to memory of 1792	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	31
PID 1756 wrote to memory of 1792	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	31
PID 1756 wrote to memory of 1792	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	31
PID 1756 wrote to memory of 1792	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	31
PID 1756 wrote to memory of 1792	1756	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	31

C:\Users\Admin\AppData\Local\Temp\a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe
"C:\Users\Admin\AppData\Local\Temp\a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Google Update" /XML "C:\Users\Admin\AppData\Local\Temp\aHHHHH.xml"
  2⤵
  - Creates scheduled task(s)
  PID:1152
- C:\Users\Admin\AppData\Local\Temp\a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe
  "C:\Users\Admin\AppData\Local\Temp\a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe"
  2⤵
  PID:1800
- C:\Users\Admin\AppData\Local\Temp\a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe
  "C:\Users\Admin\AppData\Local\Temp\a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aHHHHH.xml

Filesize
1KB

MD5
29b27124496694a1df4c407712518fbd

SHA1
f1b8ec9690eeb992ef5b1bf410ab4515ff068507

SHA256
c99ed3cdfd4ed126c19b75ba3bc84f2ed15b24607fc29935d1ff0d0b74617706

SHA512
59e5c76db9d5100909c7bc622974c7c49c27dd4e65e232e1f3224ae733486d2bea3bb508b7e074cb692f858b82f689c1f3c79d1b9132f0a39205d1a79f43424f

Download Submit
memory/1756-71-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/1756-55-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/1756-56-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/1756-54-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/1792-78-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-76-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-64-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-66-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-73-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-60-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-70-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-59-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-79-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-77-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-62-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-83-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-82-0x0000000073B50000-0x00000000740FB000-memory.dmp

Filesize
5.7MB

Download
memory/1792-81-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-80-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-88-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-87-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-85-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-91-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-93-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-94-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-96-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1792-97-0x0000000073B50000-0x00000000740FB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads