imminent | d03009ce65db3582f0c9f046d58d7449b30c1e7a6241b76fbeb2656ac11a188a

Analysis

max time kernel
157s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2023, 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.68abb76bc5690517ec41168a16789b80_JC.exe
Size

476KB
MD5

68abb76bc5690517ec41168a16789b80
SHA1

ad3cc14d5d84320233ffd97af4fc826979c8903e
SHA256

d03009ce65db3582f0c9f046d58d7449b30c1e7a6241b76fbeb2656ac11a188a
SHA512

693f2db2fa39d84d7401148c54749673be5d6d41d6818694892629c793bcb285a590462d33374bc02c0ef0f93e6f20b80651e771991d8e95d4d9ddd25b2c35ea
SSDEEP

12288:tntoifIwkqdVQocSJXaa6r11lN1SP9hC/43h:FmifIVqv+SJXaa6r113Il

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gcg.vbe	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3700 set thread context of 3900	3700	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	96

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe
File created	C:\Windows\assembly\Desktop.ini	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3900	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3900	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe
Token: 33	3900	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe
Token: SeIncBasePriorityPrivilege	3900	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3700	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe
3900	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3900	3700	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	96
PID 3700 wrote to memory of 3900	3700	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	96
PID 3700 wrote to memory of 3900	3700	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	96
PID 3700 wrote to memory of 3900	3700	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	96
PID 3700 wrote to memory of 3900	3700	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	96
PID 3700 wrote to memory of 3900	3700	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	96
PID 3700 wrote to memory of 3900	3700	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	96
PID 3700 wrote to memory of 3900	3700	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	96
PID 3700 wrote to memory of 3900	3700	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	96
PID 3700 wrote to memory of 3900	3700	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	96

C:\Users\Admin\AppData\Local\Temp\NEAS.68abb76bc5690517ec41168a16789b80_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.68abb76bc5690517ec41168a16789b80_JC.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Users\Admin\AppData\Local\Temp\NEAS.68abb76bc5690517ec41168a16789b80_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.68abb76bc5690517ec41168a16789b80_JC.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3900

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3700-0-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/3700-3-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/3700-5-0x00000000022F0000-0x00000000022F7000-memory.dmp

Filesize
28KB

Download
memory/3900-8-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3900-11-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3900-12-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3900-13-0x0000000074680000-0x0000000074C31000-memory.dmp

Filesize
5.7MB

Download
memory/3900-14-0x0000000074680000-0x0000000074C31000-memory.dmp

Filesize
5.7MB

Download
memory/3900-15-0x0000000000880000-0x0000000000890000-memory.dmp

Filesize
64KB

Download
memory/3900-16-0x0000000000880000-0x0000000000890000-memory.dmp

Filesize
64KB

Download
memory/3900-18-0x0000000000880000-0x0000000000890000-memory.dmp

Filesize
64KB

Download
memory/3900-17-0x0000000000880000-0x0000000000890000-memory.dmp

Filesize
64KB

Download
memory/3900-22-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3900-23-0x0000000074680000-0x0000000074C31000-memory.dmp

Filesize
5.7MB

Download
memory/3900-27-0x0000000000880000-0x0000000000890000-memory.dmp

Filesize
64KB

Download
memory/3900-28-0x0000000000880000-0x0000000000890000-memory.dmp

Filesize
64KB

Download
memory/3900-29-0x0000000000880000-0x0000000000890000-memory.dmp

Filesize
64KB

Download
memory/3900-30-0x0000000000880000-0x0000000000890000-memory.dmp

Filesize
64KB

Download
memory/3900-31-0x0000000000880000-0x0000000000890000-memory.dmp

Filesize
64KB

Download