imminent | 29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b

Analysis

max time kernel
151s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-02-2023 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe
Size

1.1MB
MD5

45e1b744323e707af2cf64b54a77fa89
SHA1

2a960f622ce05a0a8deab49d4fc068c1b3b9a663
SHA256

29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b
SHA512

a0fa0f097cf8678b70aac8357e1c0dd07a702e2306e8fcac5b73eb42b74025b9af97d1824505805551a7e8adaeab24a5fbb66d3e8b83b7e47facdb1c9fe534b9
SSDEEP

24576:ME9GCM9FNBx3s9L90j7TlX+06Cn5qVWQK:ME0CMTvx3sh6Re

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 320	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe
1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe
1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe
1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe
1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe
1120	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe
Token: SeDebugPrivilege	320	RegSvcs.exe
Token: SeDebugPrivilege	1120	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
320	RegSvcs.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1120	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	27
PID 1488 wrote to memory of 1120	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	27
PID 1488 wrote to memory of 1120	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	27
PID 1488 wrote to memory of 1120	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	27
PID 1488 wrote to memory of 1164	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	29
PID 1488 wrote to memory of 1164	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	29
PID 1488 wrote to memory of 1164	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	29
PID 1488 wrote to memory of 1164	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	29
PID 1488 wrote to memory of 1336	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	31
PID 1488 wrote to memory of 1336	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	31
PID 1488 wrote to memory of 1336	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	31
PID 1488 wrote to memory of 1336	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	31
PID 1488 wrote to memory of 1336	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	31
PID 1488 wrote to memory of 1336	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	31
PID 1488 wrote to memory of 1336	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	31
PID 1488 wrote to memory of 320	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	32
PID 1488 wrote to memory of 320	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	32
PID 1488 wrote to memory of 320	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	32
PID 1488 wrote to memory of 320	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	32
PID 1488 wrote to memory of 320	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	32
PID 1488 wrote to memory of 320	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	32
PID 1488 wrote to memory of 320	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	32
PID 1488 wrote to memory of 320	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	32
PID 1488 wrote to memory of 320	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	32
PID 1488 wrote to memory of 320	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	32
PID 1488 wrote to memory of 320	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	32
PID 1488 wrote to memory of 320	1488	29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe	32

C:\Users\Admin\AppData\Local\Temp\29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe
"C:\Users\Admin\AppData\Local\Temp\29d66a003f3f80f24cb1c84cda66204f359f0bf6cbf6f8eba1badfda4f8b5b1b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XOHOqDcWua.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XOHOqDcWua" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2953.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1336
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2953.tmp

Filesize
1KB

MD5
2218f9a93de4322acc71ac6282b815d2

SHA1
1bef6ce71eaa8e06373e0de374ae7fc7bd8f043e

SHA256
9f0971bedea9f0fb15cc30b2a669670a3119dff4d803f0210a58210749ae2423

SHA512
a7011106852d24dd0f08a1c7eae084950c1ad330526227b7533550797d3b09735f6d40a76b4d3e4e7a297b71aa71615ef87867d04bb8ac6e891e8452408ea13a

Download Submit
memory/320-77-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-87-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-75-0x00000000003C0000-0x00000000003E8000-memory.dmp

Filesize
160KB

Download
memory/320-100-0x0000000000760000-0x0000000000776000-memory.dmp

Filesize
88KB

Download
memory/320-97-0x0000000000460000-0x000000000046E000-memory.dmp

Filesize
56KB

Download
memory/320-96-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-94-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-93-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-64-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-65-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-68-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-69-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-67-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-72-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-74-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-91-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-88-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-78-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-79-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-81-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-80-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-82-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-83-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/320-85-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1120-99-0x000000006EAA0000-0x000000006F04B000-memory.dmp

Filesize
5.7MB

Download
memory/1120-101-0x000000006EAA0000-0x000000006F04B000-memory.dmp

Filesize
5.7MB

Download
memory/1120-102-0x000000006EAA0000-0x000000006F04B000-memory.dmp

Filesize
5.7MB

Download
memory/1488-56-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/1488-58-0x0000000005480000-0x0000000005518000-memory.dmp

Filesize
608KB

Download
memory/1488-57-0x0000000000880000-0x000000000088A000-memory.dmp

Filesize
40KB

Download
memory/1488-63-0x00000000056A0000-0x0000000005700000-memory.dmp

Filesize
384KB

Download
memory/1488-55-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/1488-54-0x0000000000C10000-0x0000000000D24000-memory.dmp

Filesize
1.1MB

Download