imminent | fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c

General

Target

fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe
Size

669KB
MD5

4bf1521ed6112feb176f9b6907f2c96b
SHA1

0a66dacbf5cb0e230c52fd0229af9f64002d4f3c
SHA256

fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c
SHA512

bbae3e6b0cac75866b2bc34dc19f60dbce03aba48de10df6edce644c2cac1add84579c3d3fc33f2e53009413ba94c790bd6c58f2d9678007a09d8630b5df957c
SSDEEP

12288:tRMQmWIW9rQzgyx+ec3Ed4D/enUaRRVLgWTvoCd/Zk:oW6Mk+D3Ed4Qh

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\v2t6bIXtK.lnk	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe

Loads dropped DLL 1 IoCs

pid	Process
948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\RZRSYNAPSE = "C:\\Users\\Admin\\AppData\\Roaming\\Razer\\RazerComms5.5.14.exe"	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 948 set thread context of 1412	948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe
948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe
948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe
948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1412	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe
Token: SeDebugPrivilege	1412	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1412	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1412	948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe	28
PID 948 wrote to memory of 1412	948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe	28
PID 948 wrote to memory of 1412	948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe	28
PID 948 wrote to memory of 1412	948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe	28
PID 948 wrote to memory of 1412	948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe	28
PID 948 wrote to memory of 1412	948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe	28
PID 948 wrote to memory of 1412	948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe	28
PID 948 wrote to memory of 1412	948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe	28
PID 948 wrote to memory of 1412	948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe	28
PID 948 wrote to memory of 1412	948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe	28
PID 948 wrote to memory of 1412	948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe	28
PID 948 wrote to memory of 1412	948	fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe	28

C:\Users\Admin\AppData\Local\Temp\fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe
"C:\Users\Admin\AppData\Local\Temp\fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\vSILlzCwX\RZRSynapse.exe

Filesize
669KB

MD5
4bf1521ed6112feb176f9b6907f2c96b

SHA1
0a66dacbf5cb0e230c52fd0229af9f64002d4f3c

SHA256
fe4c008464e7f99279ab099192ef803de60c31605b240a7a6497d2bc8809cc8c

SHA512
bbae3e6b0cac75866b2bc34dc19f60dbce03aba48de10df6edce644c2cac1add84579c3d3fc33f2e53009413ba94c790bd6c58f2d9678007a09d8630b5df957c

Download Submit
memory/948-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/948-55-0x0000000074DB0000-0x000000007535B000-memory.dmp

Filesize
5.7MB

Download
memory/948-70-0x0000000074DB0000-0x000000007535B000-memory.dmp

Filesize
5.7MB

Download
memory/1412-60-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1412-62-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1412-61-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1412-57-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1412-65-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1412-67-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1412-69-0x0000000074DB0000-0x000000007535B000-memory.dmp

Filesize
5.7MB

Download
memory/1412-58-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1412-71-0x0000000074DB0000-0x000000007535B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing