imminent | a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06

General

Target

a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe
Size

405KB
MD5

3fab513ea72b66790a740640d373a607
SHA1

e469c0f22b903886c630653fc03fb13874c79376
SHA256

a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06
SHA512

955a4c564bbf9a9cac798883aeb2df10b503375df6f5baa635a013e5130a8728a8b5c5883555d6c9ebe69b3daf8bb9f1303cb0ec393c1723a96549599e8aea2b
SSDEEP

6144:CoUdF36jIOMPqT2uNLgGzuNQaQPzMqGOY+uoc4OERP493fLk:CoUdF36cOMiZ+QF7MqLck

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 384 set thread context of 3084	384	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	84

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe
File created	C:\Windows\assembly\Desktop.ini	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4812	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3084	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3084	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 4812	384	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	81
PID 384 wrote to memory of 4812	384	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	81
PID 384 wrote to memory of 4812	384	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	81
PID 384 wrote to memory of 1776	384	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	83
PID 384 wrote to memory of 1776	384	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	83
PID 384 wrote to memory of 1776	384	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	83
PID 384 wrote to memory of 3084	384	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	84
PID 384 wrote to memory of 3084	384	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	84
PID 384 wrote to memory of 3084	384	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	84
PID 384 wrote to memory of 3084	384	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	84
PID 384 wrote to memory of 3084	384	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	84
PID 384 wrote to memory of 3084	384	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	84
PID 384 wrote to memory of 3084	384	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	84
PID 384 wrote to memory of 3084	384	a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe	84

C:\Users\Admin\AppData\Local\Temp\a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe
"C:\Users\Admin\AppData\Local\Temp\a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Google Update" /XML "C:\Users\Admin\AppData\Local\Temp\axxxxx.xml"
  2⤵
  - Creates scheduled task(s)
  PID:4812
- C:\Users\Admin\AppData\Local\Temp\a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe
  "C:\Users\Admin\AppData\Local\Temp\a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe"
  2⤵
  PID:1776
- C:\Users\Admin\AppData\Local\Temp\a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe
  "C:\Users\Admin\AppData\Local\Temp\a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\a9948b9d207375c838170f10d4d9f2b105c7c50161eb87302283bcc3252efe06.exe.log

Filesize
312B

MD5
6dba4702b346903da02f7dd9e839a128

SHA1
d69f255866f30a87c9eca8312d425c47059bf15e

SHA256
29d145faac0201870c39b9119894f78694a776e03fc8f79349bdf92e56a65bcd

SHA512
33afef187e806838717238881aaaf41272f8b484fcfe97a85057fd43a7eeb119df813d6023d2ee770aa22a067f7e9d532dd1c30b512f9c48b76f838615863e1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\axxxxx.xml

Filesize
1KB

MD5
00529ecd157323a73d671f070d23bc1b

SHA1
620e13b5fcaafd6be509c5800fc294add76582f0

SHA256
40b16d40366947ad9b9781a1f1606671be1552bd7c8b104ff715714f9d61f3f5

SHA512
6c67caaec8a7b4a50518a19a92998693e66058f8166f3b0dfc26619d1ebcf6a6f0af199ae1cf9f72eb10cfb5fd1de22dc06d0b7c10d62d559d5f3dd54f84c254

Download Submit
memory/384-133-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/384-132-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/384-142-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3084-146-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-152-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-139-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-137-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-144-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-145-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-165-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3084-147-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-148-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-149-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-138-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-154-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-150-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-155-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-158-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-160-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-161-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-163-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3084-164-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads