imminent | 7e084a9ca9b6b23f4aa41749d86ee0cfa324c4622637144d3ad824b132db3693

General

Target

Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe
Size

30.3MB
MD5

9464e7ccf6f949e5bcd412250ace1ae1
SHA1

c69b38a6289ec2d722b26c7248b77ed055e19b94
SHA256

ad162bcde5f5a77253c20d7c2e331db6607c7aa666e57a5a74be75d3cdd8c783
SHA512

f40eebc9d5d7ee15d640e8eab3d4dc271f6324aa520bea38b9b3f4fe226844fe5fb0966deab1bc01d3cb55641f3b3d36b382e875c54bd198b938fd92a5f7e672
SSDEEP

6144:T3T3CN57+SBHljnXVS1B9yjEMv3hE3N+hAD08JwsYptahCdLlfi5NvuaMGsgL7G:TD3ABHIX94EYxQst4nUtahUhMZ/nG

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvBackend = "C:\\ProgramData\\fa8a7d35-8651-4fc2-83b6-a8484650143f\\csrss.exe"	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 1940	1976	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1976	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe
Token: SeDebugPrivilege	1940	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe
Token: 33	1940	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe
Token: SeIncBasePriorityPrivilege	1940	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1940	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1940	1976	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe	27
PID 1976 wrote to memory of 1940	1976	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe	27
PID 1976 wrote to memory of 1940	1976	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe	27
PID 1976 wrote to memory of 1940	1976	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe	27
PID 1976 wrote to memory of 1940	1976	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe	27
PID 1976 wrote to memory of 1940	1976	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe	27
PID 1976 wrote to memory of 1940	1976	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe	27
PID 1976 wrote to memory of 1940	1976	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe	27
PID 1976 wrote to memory of 1940	1976	Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe	27

C:\Users\Admin\AppData\Local\Temp\Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe
"C:\Users\Admin\AppData\Local\Temp\Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe
  "C:\Users\Admin\AppData\Local\Temp\Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1940

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-64-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1940-67-0x00000000003B0000-0x00000000003C0000-memory.dmp

Filesize
64KB

Download
memory/1940-57-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1940-58-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1940-77-0x0000000000AD0000-0x0000000000B10000-memory.dmp

Filesize
256KB

Download
memory/1940-60-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1940-71-0x00000000009B0000-0x00000000009C6000-memory.dmp

Filesize
88KB

Download
memory/1940-61-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1940-59-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1940-66-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1940-62-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1940-68-0x0000000004290000-0x000000000433E000-memory.dmp

Filesize
696KB

Download
memory/1940-69-0x00000000003D0000-0x00000000003F8000-memory.dmp

Filesize
160KB

Download
memory/1940-70-0x0000000000AD0000-0x0000000000B10000-memory.dmp

Filesize
256KB

Download
memory/1976-55-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1976-54-0x0000000000BD0000-0x0000000000C50000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing