imminent | 00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130

General

Target

00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe
Size

354KB
MD5

c5751319ba50158c8d86bdc778b82e58
SHA1

944999322cd74164446a9d4ba0dd62cbbb4fe53c
SHA256

00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130
SHA512

bff0e83e01a561001e293ed8d9deaaa97468dd7d53ee4a9d04a1f018dbb233a6ed02495aab321725a6e17f1e7dcd43c079e0dd268d93ca56b765c7f98f2d467b
SSDEEP

3072:0wi51kpjgUdkY8NvaKUGVy1ltYWVnXKiivnFOq43yUQBB3cuAUXLinIcsHtPbXl/:wopjgUqY84yLWVkt3HhObgzvDROyE4Z

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Detects executables packed with ConfuserEx Custom; outside of GIT 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001231c-7.dat	INDICATOR_EXE_Packed_ConfuserEx_Custom

Detects executables packed with ConfuserEx Mod 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001231c-7.dat	INDICATOR_EXE_Packed_ConfuserEx

Deletes itself 1 IoCs

pid	Process
2620	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2920	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Loads dropped DLL 2 IoCs

pid	Process
2700	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe
2700	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Default Key = "C:\\Users\\Admin\\AppData\\Local\\Default Folder\\Server.exe"	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Default Key = "\\Default Folder\\Server.exe"	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2464	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2920	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe
Token: SeDebugPrivilege	2920	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2920	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2920	2700	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe	28
PID 2700 wrote to memory of 2920	2700	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe	28
PID 2700 wrote to memory of 2920	2700	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe	28
PID 2700 wrote to memory of 2920	2700	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe	28
PID 2700 wrote to memory of 2620	2700	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe	29
PID 2700 wrote to memory of 2620	2700	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe	29
PID 2700 wrote to memory of 2620	2700	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe	29
PID 2700 wrote to memory of 2620	2700	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe	29
PID 2620 wrote to memory of 2464	2620	cmd.exe	31
PID 2620 wrote to memory of 2464	2620	cmd.exe	31
PID 2620 wrote to memory of 2464	2620	cmd.exe	31
PID 2620 wrote to memory of 2464	2620	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe
"C:\Users\Admin\AppData\Local\Temp\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe
  "C:\Users\Admin\AppData\Local\Temp\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 1000
    3⤵
    - Runs ping.exe
    PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Imminent\Path.dat

Filesize
54B

MD5
3710c450e30ec792eb8a69d8da09062e

SHA1
53f4af77836e8033a60d7657f137d44ee9460293

SHA256
d8776916ff8f614bd00642361ee241308d80c5d88d612fe518277a939308a8dc

SHA512
964efdeacb2560a6220a65c582f22d09e2ffd6ee912d5a75743392baae6d45e0f87fe9882e4dd8a43ad3dba589db83f4b7bf4d89db00ec4674539b414c95db76

Download Submit
\Users\Admin\AppData\Local\Temp\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Filesize
354KB

MD5
c5751319ba50158c8d86bdc778b82e58

SHA1
944999322cd74164446a9d4ba0dd62cbbb4fe53c

SHA256
00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130

SHA512
bff0e83e01a561001e293ed8d9deaaa97468dd7d53ee4a9d04a1f018dbb233a6ed02495aab321725a6e17f1e7dcd43c079e0dd268d93ca56b765c7f98f2d467b

Download Submit
memory/2700-0-0x0000000074B70000-0x000000007511B000-memory.dmp

Filesize
5.7MB

Download
memory/2700-1-0x0000000002230000-0x0000000002270000-memory.dmp

Filesize
256KB

Download
memory/2700-2-0x0000000074B70000-0x000000007511B000-memory.dmp

Filesize
5.7MB

Download
memory/2700-18-0x0000000074B70000-0x000000007511B000-memory.dmp

Filesize
5.7MB

Download
memory/2920-13-0x0000000074B70000-0x000000007511B000-memory.dmp

Filesize
5.7MB

Download
memory/2920-14-0x0000000000230000-0x0000000000270000-memory.dmp

Filesize
256KB

Download
memory/2920-15-0x0000000074B70000-0x000000007511B000-memory.dmp

Filesize
5.7MB

Download
memory/2920-44-0x0000000074B70000-0x000000007511B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads