imminent | 3b32b6fc5406fc754c68fb447ff307427ce7acc9a506c18429cb79dfd86a9496

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e0c7607f378ce0cac081420d270e352.exe
Size

9.9MB
MD5

7e0c7607f378ce0cac081420d270e352
SHA1

7334d15139330c769dbe09cdf7968bd8dedacc56
SHA256

3b32b6fc5406fc754c68fb447ff307427ce7acc9a506c18429cb79dfd86a9496
SHA512

a50245b7c3e594083e6d738f5f736a87bcbbbd5fb66d5d5f0a4beae870a4d5efeb0d0f61f3a8cc4ca6b8efa599dbfb42458a13443937691a585ec5ec8908f587
SSDEEP

196608:8lZrwL3PXWwE4W+iNoLCrdwJkfSl7WDiBaiM0tfAIyazhIqdJqts/kF4u7u:8lZsTXlxW+ifB8kfxLLT6aqatVF4R

Score

10^/10

imminent bootkit discovery persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\64DXPYp3PQKGg74A\\ElZxAEfOw0O8.exe\",explorer.exe"	7e0c7607f378ce0cac081420d270e352.exe

Executes dropped EXE 1 IoCs

pid	Process
2548	QqFZAKYwmSFLCeMh.exe

Loads dropped DLL 12 IoCs

pid	Process
1444	7e0c7607f378ce0cac081420d270e352.exe
2548	QqFZAKYwmSFLCeMh.exe
2548	QqFZAKYwmSFLCeMh.exe
2548	QqFZAKYwmSFLCeMh.exe
2548	QqFZAKYwmSFLCeMh.exe
2548	QqFZAKYwmSFLCeMh.exe
2548	QqFZAKYwmSFLCeMh.exe
2548	QqFZAKYwmSFLCeMh.exe
2548	QqFZAKYwmSFLCeMh.exe
2548	QqFZAKYwmSFLCeMh.exe
2548	QqFZAKYwmSFLCeMh.exe
2548	QqFZAKYwmSFLCeMh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\Updater = "C:\\Users\\Admin\\AppData\\Roaming\\Updates\\Mediaupdater.exe"	7e0c7607f378ce0cac081420d270e352.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	QqFZAKYwmSFLCeMh.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	7e0c7607f378ce0cac081420d270e352.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2852	ping.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1444	7e0c7607f378ce0cac081420d270e352.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	7e0c7607f378ce0cac081420d270e352.exe
Token: 33	1444	7e0c7607f378ce0cac081420d270e352.exe
Token: SeIncBasePriorityPrivilege	1444	7e0c7607f378ce0cac081420d270e352.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1444	7e0c7607f378ce0cac081420d270e352.exe
2548	QqFZAKYwmSFLCeMh.exe
2548	QqFZAKYwmSFLCeMh.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2548	1444	7e0c7607f378ce0cac081420d270e352.exe	28
PID 1444 wrote to memory of 2548	1444	7e0c7607f378ce0cac081420d270e352.exe	28
PID 1444 wrote to memory of 2548	1444	7e0c7607f378ce0cac081420d270e352.exe	28
PID 1444 wrote to memory of 2548	1444	7e0c7607f378ce0cac081420d270e352.exe	28
PID 1444 wrote to memory of 2548	1444	7e0c7607f378ce0cac081420d270e352.exe	28
PID 1444 wrote to memory of 2548	1444	7e0c7607f378ce0cac081420d270e352.exe	28
PID 1444 wrote to memory of 2548	1444	7e0c7607f378ce0cac081420d270e352.exe	28
PID 2548 wrote to memory of 2852	2548	QqFZAKYwmSFLCeMh.exe	30
PID 2548 wrote to memory of 2852	2548	QqFZAKYwmSFLCeMh.exe	30
PID 2548 wrote to memory of 2852	2548	QqFZAKYwmSFLCeMh.exe	30
PID 2548 wrote to memory of 2852	2548	QqFZAKYwmSFLCeMh.exe	30

C:\Users\Admin\AppData\Local\Temp\7e0c7607f378ce0cac081420d270e352.exe
"C:\Users\Admin\AppData\Local\Temp\7e0c7607f378ce0cac081420d270e352.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\QqFZAKYwmSFLCeMh.exe
  "C:\Users\Admin\AppData\Local\Temp\QqFZAKYwmSFLCeMh.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\ping.exe
    ping -n 1 -w 1000 www.piriform.com
    3⤵
    - Runs ping.exe
    PID:2852

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsdB675.tmp\System.dll

Filesize
11KB

MD5
41a3c964232edd2d7d5edea53e8245cd

SHA1
76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206

SHA256
8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5

SHA512
fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdB675.tmp\g\gcapi_dll.dll

Filesize
348KB

MD5
2973af8515effd0a3bfc7a43b03b3fcc

SHA1
4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

SHA256
d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

SHA512
b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdB675.tmp\ui\res\CC_logo_72x66.png

Filesize
7KB

MD5
a736159759a56c29575e49cb2a51f2b3

SHA1
b1594bbca4358886d25c3a1bc662d87c913318cb

SHA256
58e75de1789c90333daaf93176194d2a3d64f2eecdf57a4b9384a229e81f874f

SHA512
4da523a36375b37fa7bc4b4ccf7c93e1df7b2da15152edf7d419927aa1bb271ef8ba27fe734d2f623fcc02b47319e75333df014bed01eb466e0cd9ec4111ef53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdB675.tmp\ui\res\PF_computer.png

Filesize
87KB

MD5
7f4f45c9393a0664d9d0725a2ff42c6b

SHA1
b7b30eb534e6dc69e8e293443c157134569e8ce7

SHA256
dbd8b6fdb66604a0a5e8efe269fbfa598e4a94dc146006036409d905209da42b

SHA512
0c27f9ce615cbff3e17fd772ce3929ab4419d7432d96223b7eec1ba70953f2ac993404b954020247b52d7f7499212d44eb6f85da2e2676773cafe1ce89b390f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdB675.tmp\ui\res\PF_logo.png

Filesize
3KB

MD5
079cca30760cca3c01863b6b96e87848

SHA1
98c2ca01f248bc61817db7e5faea4a3d8310db50

SHA256
8dd37d3721e25c32c5bf878b6dba9e61d04b7ce8aec45bdf703a41bc41802dfa

SHA512
3e25c10e3a5830584c608b9178ab062e93e0e9009a7d897bb5e3561180b0b0910bd4178063d982eb33806a005c93931ae2ec5be520ec0d0c9a7c452cb78fd6a8

Download Submit
\Users\Admin\AppData\Local\Temp\QqFZAKYwmSFLCeMh.exe

Filesize
9.4MB

MD5
a1d648bf9328c7fffaf3e0a40de85358

SHA1
e0c7e796c315ea7cf5f26a551483e18a1a099042

SHA256
61e1b4bf028b09ee20787cdf23cab7e3c511132f7df45da11bd9f2568cad7739

SHA512
5641ed7ae0ed238c47d29eaaa38192be2e2c99b37bf802695b232eadb25144b0ac2b54a7a2531d778b893a9f96b558c4fa6873fda8f85b4766a8fd8c7d821c64

Download Submit
\Users\Admin\AppData\Local\Temp\nsdB675.tmp\UserInfo.dll

Filesize
4KB

MD5
c1f778a6d65178d34bde4206161a98e0

SHA1
29719fffef1ab6fe2df47e5ed258a5e3b3a11cfc

SHA256
9caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87

SHA512
9c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d

Download Submit
\Users\Admin\AppData\Local\Temp\nsdB675.tmp\g\gtapi_signed.dll

Filesize
71KB

MD5
61bc40d1fad9e0faa9a07219b90ba0e4

SHA1
5b5c3badedba915707000d2047eaf13f27b8925e

SHA256
89e157a4f61d7d18180cb7f901c0095da3b7a5cc5a9fd58d710099e5f0ee505a

SHA512
fa341aa975c471082b4b6c380f794d1e9ab3939382972cfb9e1dbb3491f68296ad1cedc8f03736921c8e133f62432997de29642e223c2a97f1cab5ce91d68af9

Download Submit
\Users\Admin\AppData\Local\Temp\nsdB675.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
\Users\Admin\AppData\Local\Temp\nsdB675.tmp\nsExec.dll

Filesize
6KB

MD5
5ed60250f74fa36a5a247a715bcd026e

SHA1
ff5f3ad0b32ede49a28e744664d086f6fe9e46b0

SHA256
ea8026766adc2d7cc26e2206cfdf5f0865b1426bfe3bc2aec8f43d3fc9a072ef

SHA512
2dd77324c1e0fea801a5cac1fe1d67349a5a93d4a9a459ee1e6b469f6ccce309fc45e513f38de238971b0a83d31e0afe3a2686eca8887772445209cde5735cee

Download Submit
\Users\Admin\AppData\Local\Temp\nsdB675.tmp\p\syschk.dll

Filesize
253KB

MD5
f46bc8015929e17a2b1aff097d7df0e4

SHA1
6c30de3e6a004021e231aaa62a2c5cedec72bc6d

SHA256
26602d21203cf28b0c840a57bee8f1ff52ff885223095797180c9afe91265c32

SHA512
ddee56e56a60db139029bc6a43e281d0eaeb8425363e28847e43819425e0ec28bb807408488a18fa492dbfe92f27f91f83575275f952cf35c81cee7b250d5cb2

Download Submit
\Users\Admin\AppData\Local\Temp\nsdB675.tmp\ui\pfUI.dll

Filesize
4.2MB

MD5
4a335bc4528b3b15a287615a9462cb3e

SHA1
8d05ba213c2ca142ea111bb03af7e8d2ad5d1816

SHA256
50190d7564ebd642f973377baebbd4e58585044b2bd335749d02295fd5998565

SHA512
d57a4bce4f26bbb89f3a7bf106bcd9804d2a49874f26cbb3151f5fc112782157c8fa0926e291ca570dba9eeec76a71e75b1dfa532a8438100da10b628cba919e

Download Submit
memory/1444-63-0x0000000002B50000-0x0000000002B90000-memory.dmp

Filesize
256KB

Download
memory/1444-7-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Filesize
4KB

Download
memory/1444-6-0x0000000074690000-0x0000000074C3B000-memory.dmp

Filesize
5.7MB

Download
memory/1444-17-0x0000000002B50000-0x0000000002B90000-memory.dmp

Filesize
256KB

Download
memory/1444-5-0x0000000074690000-0x0000000074C3B000-memory.dmp

Filesize
5.7MB

Download
memory/1444-28-0x0000000002B50000-0x0000000002B90000-memory.dmp

Filesize
256KB

Download
memory/1444-0-0x0000000074690000-0x0000000074C3B000-memory.dmp

Filesize
5.7MB

Download
memory/1444-3-0x0000000002B50000-0x0000000002B90000-memory.dmp

Filesize
256KB

Download
memory/1444-4-0x0000000002B50000-0x0000000002B90000-memory.dmp

Filesize
256KB

Download
memory/1444-2-0x0000000002B50000-0x0000000002B90000-memory.dmp

Filesize
256KB

Download
memory/1444-1-0x0000000074690000-0x0000000074C3B000-memory.dmp

Filesize
5.7MB

Download
memory/2548-139-0x0000000003000000-0x0000000003001000-memory.dmp

Filesize
4KB

Download
memory/2548-161-0x0000000003000000-0x0000000003001000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads