imminent | 21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc

General

Target

21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe
Size

273KB
MD5

35a515d816785d3ce2f59eb206133c06
SHA1

a4ef3f64a17dc8abfb583e47f281cae2b6a443de
SHA256

21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc
SHA512

698a3187670728d5285428dd9ef803feebcdc75a0d46e631ae821de9e158256657854b1e734edb9cfb8e5e2945d6f48000248d0dd2228c2c536aefb3d11472c9
SSDEEP

6144:8IiW4AcPkGRLlcbFExG4X+0fg1G34WmUctlR0kD:4AcPdRuy+zVWHISkD

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 1 IoCs

pid	Process
376	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe

Deletes itself 1 IoCs

pid	Process
1296	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1544	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe
1544	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\Java.exe"	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java = "\\Java\\Java.exe"	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
972	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
376	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe
Token: SeDebugPrivilege	376	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe
Token: SeDebugPrivilege	376	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
376	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 376	1544	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe	28
PID 1544 wrote to memory of 376	1544	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe	28
PID 1544 wrote to memory of 376	1544	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe	28
PID 1544 wrote to memory of 376	1544	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe	28
PID 1544 wrote to memory of 1296	1544	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe	29
PID 1544 wrote to memory of 1296	1544	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe	29
PID 1544 wrote to memory of 1296	1544	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe	29
PID 1544 wrote to memory of 1296	1544	21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe	29
PID 1296 wrote to memory of 972	1296	cmd.exe	31
PID 1296 wrote to memory of 972	1296	cmd.exe	31
PID 1296 wrote to memory of 972	1296	cmd.exe	31
PID 1296 wrote to memory of 972	1296	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe
"C:\Users\Admin\AppData\Local\Temp\21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc\21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe
  "C:\Users\Admin\AppData\Local\Temp\21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc\21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:376
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 1000
    3⤵
    - Runs ping.exe
    PID:972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f267977963ce7581e250057e590d2407

SHA1
586e16fde4526912c9991ea8668644b378379e0b

SHA256
49611c0f108d93c70d0494c02f9bf330f0dd319f42a595fa032ef7a2018ea340

SHA512
76e2b250871cb9614de4ac2ef157a30dce857d2533b58f6df91d64f1442a817923eacab3f1a6b3c86f8fa0c25e079c85df0b877557e54c64d5e75aa9e1f9327c

Download Submit
C:\Users\Admin\AppData\Local\Temp\21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc\21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe

Filesize
273KB

MD5
35a515d816785d3ce2f59eb206133c06

SHA1
a4ef3f64a17dc8abfb583e47f281cae2b6a443de

SHA256
21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc

SHA512
698a3187670728d5285428dd9ef803feebcdc75a0d46e631ae821de9e158256657854b1e734edb9cfb8e5e2945d6f48000248d0dd2228c2c536aefb3d11472c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc\21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe

Filesize
273KB

MD5
35a515d816785d3ce2f59eb206133c06

SHA1
a4ef3f64a17dc8abfb583e47f281cae2b6a443de

SHA256
21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc

SHA512
698a3187670728d5285428dd9ef803feebcdc75a0d46e631ae821de9e158256657854b1e734edb9cfb8e5e2945d6f48000248d0dd2228c2c536aefb3d11472c9

Download Submit
\Users\Admin\AppData\Local\Temp\21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc\21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe

Filesize
273KB

MD5
35a515d816785d3ce2f59eb206133c06

SHA1
a4ef3f64a17dc8abfb583e47f281cae2b6a443de

SHA256
21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc

SHA512
698a3187670728d5285428dd9ef803feebcdc75a0d46e631ae821de9e158256657854b1e734edb9cfb8e5e2945d6f48000248d0dd2228c2c536aefb3d11472c9

Download Submit
\Users\Admin\AppData\Local\Temp\21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc\21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc.exe

Filesize
273KB

MD5
35a515d816785d3ce2f59eb206133c06

SHA1
a4ef3f64a17dc8abfb583e47f281cae2b6a443de

SHA256
21a1f5a0a478d0ef16c47210137bdcbf8e94cc200c88c9b69f17e075237043fc

SHA512
698a3187670728d5285428dd9ef803feebcdc75a0d46e631ae821de9e158256657854b1e734edb9cfb8e5e2945d6f48000248d0dd2228c2c536aefb3d11472c9

Download Submit
memory/376-66-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/376-67-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/1544-54-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1544-55-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/1544-65-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing