imminent | 00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130

General

Target

00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe
Size

354KB
MD5

c5751319ba50158c8d86bdc778b82e58
SHA1

944999322cd74164446a9d4ba0dd62cbbb4fe53c
SHA256

00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130
SHA512

bff0e83e01a561001e293ed8d9deaaa97468dd7d53ee4a9d04a1f018dbb233a6ed02495aab321725a6e17f1e7dcd43c079e0dd268d93ca56b765c7f98f2d467b
SSDEEP

3072:0wi51kpjgUdkY8NvaKUGVy1ltYWVnXKiivnFOq43yUQBB3cuAUXLinIcsHtPbXl/:wopjgUqY84yLWVkt3HhObgzvDROyE4Z

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Detects executables packed with ConfuserEx Custom; outside of GIT 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023203-7.dat	INDICATOR_EXE_Packed_ConfuserEx_Custom

Detects executables packed with ConfuserEx Mod 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023203-7.dat	INDICATOR_EXE_Packed_ConfuserEx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Executes dropped EXE 1 IoCs

pid	Process
2980	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Default Key = "\\Default Folder\\Server.exe"	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Default Key = "C:\\Users\\Admin\\AppData\\Local\\Default Folder\\Server.exe"	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe
File created	C:\Windows\assembly\Desktop.ini	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4512	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2980	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe
Token: SeDebugPrivilege	2980	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2980	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 2980	4656	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe	86
PID 4656 wrote to memory of 2980	4656	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe	86
PID 4656 wrote to memory of 2980	4656	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe	86
PID 4656 wrote to memory of 3268	4656	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe	87
PID 4656 wrote to memory of 3268	4656	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe	87
PID 4656 wrote to memory of 3268	4656	00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe	87
PID 3268 wrote to memory of 4512	3268	cmd.exe	90
PID 3268 wrote to memory of 4512	3268	cmd.exe	90
PID 3268 wrote to memory of 4512	3268	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe
"C:\Users\Admin\AppData\Local\Temp\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe
  "C:\Users\Admin\AppData\Local\Temp\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 1000
    3⤵
    - Runs ping.exe
    PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130\00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130.exe

Filesize
354KB

MD5
c5751319ba50158c8d86bdc778b82e58

SHA1
944999322cd74164446a9d4ba0dd62cbbb4fe53c

SHA256
00039be931e4e18d0b62df135a5bfc5457365c6797f1153076baa6366e347130

SHA512
bff0e83e01a561001e293ed8d9deaaa97468dd7d53ee4a9d04a1f018dbb233a6ed02495aab321725a6e17f1e7dcd43c079e0dd268d93ca56b765c7f98f2d467b

Download Submit
C:\Users\Admin\AppData\Roaming\Imminent\Path.dat

Filesize
54B

MD5
3710c450e30ec792eb8a69d8da09062e

SHA1
53f4af77836e8033a60d7657f137d44ee9460293

SHA256
d8776916ff8f614bd00642361ee241308d80c5d88d612fe518277a939308a8dc

SHA512
964efdeacb2560a6220a65c582f22d09e2ffd6ee912d5a75743392baae6d45e0f87fe9882e4dd8a43ad3dba589db83f4b7bf4d89db00ec4674539b414c95db76

Download Submit
memory/2980-14-0x0000000074610000-0x0000000074BC1000-memory.dmp

Filesize
5.7MB

Download
memory/2980-16-0x00000000019D0000-0x00000000019E0000-memory.dmp

Filesize
64KB

Download
memory/2980-18-0x0000000074610000-0x0000000074BC1000-memory.dmp

Filesize
5.7MB

Download
memory/2980-48-0x00000000019D0000-0x00000000019E0000-memory.dmp

Filesize
64KB

Download
memory/2980-49-0x0000000074610000-0x0000000074BC1000-memory.dmp

Filesize
5.7MB

Download
memory/4656-0-0x0000000074610000-0x0000000074BC1000-memory.dmp

Filesize
5.7MB

Download
memory/4656-1-0x0000000074610000-0x0000000074BC1000-memory.dmp

Filesize
5.7MB

Download
memory/4656-2-0x0000000000C60000-0x0000000000C70000-memory.dmp

Filesize
64KB

Download
memory/4656-17-0x0000000074610000-0x0000000074BC1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads