imminent | 1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8

General

Target

1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe
Size

813KB
MD5

32aadc848be09a6bea62ca6875aa0bcb
SHA1

ec8c42c9fa8358d33b32bf07f25967cba18ee2f2
SHA256

1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8
SHA512

a68e94c3df9f07b7686bc7254b2c6cc5b5ef4ac179240361ffcc05b3a393df1d480a579e3a826c7ad21711bb7998c91aff4f9cd928f583fde1e4ef5d2020067f
SSDEEP

12288:rWup0aV6QKvbAv+lY2Edfw9Dp/anz4GnBK0rKbLPDtlBT2N:vjVRmA3Pfwhp/Ccb5lBT2N

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\jPoCOasLddniczv9\\FPX6TfuEzwIL.exe\",explorer.exe"	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1504 set thread context of 1324	1504	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1504	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe
Token: SeDebugPrivilege	1324	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1504	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe
1504	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe
1324	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1324	1504	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe	28
PID 1504 wrote to memory of 1324	1504	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe	28
PID 1504 wrote to memory of 1324	1504	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe	28
PID 1504 wrote to memory of 1324	1504	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe	28
PID 1504 wrote to memory of 1324	1504	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe	28
PID 1504 wrote to memory of 1324	1504	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe	28
PID 1504 wrote to memory of 1324	1504	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe	28
PID 1504 wrote to memory of 1324	1504	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe	28
PID 1504 wrote to memory of 1324	1504	1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe	28

C:\Users\Admin\AppData\Local\Temp\1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe
"C:\Users\Admin\AppData\Local\Temp\1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe
  "C:\Users\Admin\AppData\Local\Temp\1e3c0558f0ad39a9783c459f03db340e2059a1d88dde6cde0217b3394e8356d8.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1324-61-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1324-71-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download
memory/1324-70-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download
memory/1324-58-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1324-62-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1324-68-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1324-59-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1324-66-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1324-63-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1504-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1504-55-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download
memory/1504-57-0x0000000000299000-0x00000000002AA000-memory.dmp

Filesize
68KB

Download
memory/1504-56-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing