Overview

overview

10

Static

static

781adf5fb3...3c.exe

windows7-x64

10

781adf5fb3...3c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    156s
  • max time network
    178s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2022 15:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    781adf5fb30e943d52753775c8d54f525eca11c32df3440c439ddc8cd0cce73c.exe

  • Size

    356KB

  • MD5

    aff421ee4730c73fa014586e1b088e22

  • SHA1

    340573f8366da182bc7a6e09a5cdeb2da58a0743

  • SHA256

    781adf5fb30e943d52753775c8d54f525eca11c32df3440c439ddc8cd0cce73c

  • SHA512

    4123a080e21a7c9b9d83a045cd77d036abdcb3fc72500ba518f4b7251d8c4735612bbcc16704fad2fcffab4ce9d5f0b07fe54c298cce1e6230d41c0f95137d26

  • SSDEEP

    6144:oORFNs1jtVCrlAbzbrHgnY+ae5wGZPEdjbIyI9R2nr+cRHLDU9gAQZ:FRXs1bwlIvK9aeaGZPijbYR2rvTAu

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

    trojanspywareimminent
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\781adf5fb30e943d52753775c8d54f525eca11c32df3440c439ddc8cd0cce73c.exe
    "C:\Users\Admin\AppData\Local\Temp\781adf5fb30e943d52753775c8d54f525eca11c32df3440c439ddc8cd0cce73c.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:560
    • C:\Users\Admin\AppData\Local\Temp\781adf5fb30e943d52753775c8d54f525eca11c32df3440c439ddc8cd0cce73c.exe
      "C:\Users\Admin\AppData\Local\Temp\781adf5fb30e943d52753775c8d54f525eca11c32df3440c439ddc8cd0cce73c.exe"
      2⤵
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:428
    • C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4248
      • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5040
        • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2844
        • C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          PID:1464

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\AeLookupSvi.exe.log
    Filesize

    128B

    MD5

    a5dcc7c9c08af7dddd82be5b036a4416

    SHA1

    4f998ca1526d199e355ffb435bae111a2779b994

    SHA256

    e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5

    SHA512

    56035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
    Filesize

    10KB

    MD5

    735c4d78663190b26c3bd7d55fe6d055

    SHA1

    41b86ac84eddf2ca11ec6e4822f78f38f61c809a

    SHA256

    227d6056cf5b8238ccf2cc73399b1e137fecface0c9f9d1a06b87270645d1a1c

    SHA512

    fecd523dd8725fb52fdfcdc29231b7d7de22cd424ab0469fcc267dbf63239addce9706771859863642f1ab63d245ca9a7062e6205f419c2e5e750909cf6cfb67

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
    Filesize

    10KB

    MD5

    735c4d78663190b26c3bd7d55fe6d055

    SHA1

    41b86ac84eddf2ca11ec6e4822f78f38f61c809a

    SHA256

    227d6056cf5b8238ccf2cc73399b1e137fecface0c9f9d1a06b87270645d1a1c

    SHA512

    fecd523dd8725fb52fdfcdc29231b7d7de22cd424ab0469fcc267dbf63239addce9706771859863642f1ab63d245ca9a7062e6205f419c2e5e750909cf6cfb67

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
    Filesize

    10KB

    MD5

    735c4d78663190b26c3bd7d55fe6d055

    SHA1

    41b86ac84eddf2ca11ec6e4822f78f38f61c809a

    SHA256

    227d6056cf5b8238ccf2cc73399b1e137fecface0c9f9d1a06b87270645d1a1c

    SHA512

    fecd523dd8725fb52fdfcdc29231b7d7de22cd424ab0469fcc267dbf63239addce9706771859863642f1ab63d245ca9a7062e6205f419c2e5e750909cf6cfb67

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
    Filesize

    10KB

    MD5

    735c4d78663190b26c3bd7d55fe6d055

    SHA1

    41b86ac84eddf2ca11ec6e4822f78f38f61c809a

    SHA256

    227d6056cf5b8238ccf2cc73399b1e137fecface0c9f9d1a06b87270645d1a1c

    SHA512

    fecd523dd8725fb52fdfcdc29231b7d7de22cd424ab0469fcc267dbf63239addce9706771859863642f1ab63d245ca9a7062e6205f419c2e5e750909cf6cfb67

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
    Filesize

    356KB

    MD5

    aff421ee4730c73fa014586e1b088e22

    SHA1

    340573f8366da182bc7a6e09a5cdeb2da58a0743

    SHA256

    781adf5fb30e943d52753775c8d54f525eca11c32df3440c439ddc8cd0cce73c

    SHA512

    4123a080e21a7c9b9d83a045cd77d036abdcb3fc72500ba518f4b7251d8c4735612bbcc16704fad2fcffab4ce9d5f0b07fe54c298cce1e6230d41c0f95137d26

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
    Filesize

    356KB

    MD5

    aff421ee4730c73fa014586e1b088e22

    SHA1

    340573f8366da182bc7a6e09a5cdeb2da58a0743

    SHA256

    781adf5fb30e943d52753775c8d54f525eca11c32df3440c439ddc8cd0cce73c

    SHA512

    4123a080e21a7c9b9d83a045cd77d036abdcb3fc72500ba518f4b7251d8c4735612bbcc16704fad2fcffab4ce9d5f0b07fe54c298cce1e6230d41c0f95137d26

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
    Filesize

    356KB

    MD5

    aff421ee4730c73fa014586e1b088e22

    SHA1

    340573f8366da182bc7a6e09a5cdeb2da58a0743

    SHA256

    781adf5fb30e943d52753775c8d54f525eca11c32df3440c439ddc8cd0cce73c

    SHA512

    4123a080e21a7c9b9d83a045cd77d036abdcb3fc72500ba518f4b7251d8c4735612bbcc16704fad2fcffab4ce9d5f0b07fe54c298cce1e6230d41c0f95137d26

    Download Submit

  • memory/428-136-0x0000000074B10000-0x00000000750C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/428-135-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

    Download

  • memory/428-141-0x0000000074B10000-0x00000000750C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/560-149-0x0000000074B10000-0x00000000750C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/560-133-0x0000000074B10000-0x00000000750C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/560-132-0x0000000074B10000-0x00000000750C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1464-160-0x0000000074B10000-0x00000000750C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1464-158-0x0000000074B10000-0x00000000750C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2844-159-0x0000000074B10000-0x00000000750C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2844-157-0x0000000074B10000-0x00000000750C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/4248-142-0x0000000074B10000-0x00000000750C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/4248-148-0x0000000074B10000-0x00000000750C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/4248-140-0x0000000074B10000-0x00000000750C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/5040-147-0x0000000074B10000-0x00000000750C1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/5040-146-0x0000000074B10000-0x00000000750C1000-memory.dmp

    Filesize

    5.7MB

    Download