Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    15-03-2024 22:12

General

  • Target

    c5d113e1f4e719d4298bae662ff1eb07.exe

  • Size

    583KB

  • MD5

    c5d113e1f4e719d4298bae662ff1eb07

  • SHA1

    23fdaa69f26986ca548d02f910495785d4790798

  • SHA256

    91e3a85c7f25297f921a6b0927998aea5085a5f9d09a8945360afb03bf60cf20

  • SHA512

    b1d2666c56f4168141164831de8b65c049e3bcc0dcb185fb4b3572d745f24ee92fad66bb8d40fa20a3fa9d9d086a55f34d7ef3b682771d2625bf7c86b1fc0ef4

  • SSDEEP

    12288:v4aHAKg35BTIdTeB1/TVLIbunEplJyH8FUxcjolbPP/czodz75Dj:1g35WA/pIbbJdwbPP/E4

Score
10/10

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5d113e1f4e719d4298bae662ff1eb07.exe
    "C:\Users\Admin\AppData\Local\Temp\c5d113e1f4e719d4298bae662ff1eb07.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Users\Admin\AppData\Local\SvchostReader.exe
      "C:\Users\Admin\AppData\Local\SvchostReader.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Users\Admin\AppData\Local\SvchostReader.exe
        "C:\Users\Admin\AppData\Local\SvchostReader.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2792
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:684

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\SvchostReader.exe

      Filesize

      128KB

      MD5

      2faded45147b1747b2763109bf611f8b

      SHA1

      9ad063591119666bca63aefb35c141e611656136

      SHA256

      b3eebe4f3dc1593477e5b161b6473f679a2fea1750b360e259435240b992184c

      SHA512

      249853cfb2be25f8a410c5cbf64649d07ecaf127349b4da50bd604ff86b53189d403c8e5c378cb107259a9c8b7f5ddeb38b27bf6e2abdf43e4d34b93619c18dc

    • \Users\Admin\AppData\Local\SvchostReader.exe

      Filesize

      583KB

      MD5

      c5d113e1f4e719d4298bae662ff1eb07

      SHA1

      23fdaa69f26986ca548d02f910495785d4790798

      SHA256

      91e3a85c7f25297f921a6b0927998aea5085a5f9d09a8945360afb03bf60cf20

      SHA512

      b1d2666c56f4168141164831de8b65c049e3bcc0dcb185fb4b3572d745f24ee92fad66bb8d40fa20a3fa9d9d086a55f34d7ef3b682771d2625bf7c86b1fc0ef4

    • memory/2276-19-0x00000000740F0000-0x000000007469B000-memory.dmp

      Filesize

      5.7MB

    • memory/2276-0-0x00000000740F0000-0x000000007469B000-memory.dmp

      Filesize

      5.7MB

    • memory/2276-5-0x0000000002260000-0x00000000022A0000-memory.dmp

      Filesize

      256KB

    • memory/2276-2-0x0000000002260000-0x00000000022A0000-memory.dmp

      Filesize

      256KB

    • memory/2276-4-0x00000000740F0000-0x000000007469B000-memory.dmp

      Filesize

      5.7MB

    • memory/2276-3-0x0000000002260000-0x00000000022A0000-memory.dmp

      Filesize

      256KB

    • memory/2276-1-0x00000000740F0000-0x000000007469B000-memory.dmp

      Filesize

      5.7MB

    • memory/2700-30-0x00000000740F0000-0x000000007469B000-memory.dmp

      Filesize

      5.7MB

    • memory/2700-13-0x00000000740F0000-0x000000007469B000-memory.dmp

      Filesize

      5.7MB

    • memory/2700-14-0x0000000000A60000-0x0000000000AA0000-memory.dmp

      Filesize

      256KB

    • memory/2700-15-0x00000000740F0000-0x000000007469B000-memory.dmp

      Filesize

      5.7MB

    • memory/2700-16-0x0000000000A60000-0x0000000000AA0000-memory.dmp

      Filesize

      256KB

    • memory/2700-20-0x00000000740F0000-0x000000007469B000-memory.dmp

      Filesize

      5.7MB

    • memory/2792-39-0x0000000002330000-0x0000000002370000-memory.dmp

      Filesize

      256KB

    • memory/2792-24-0x0000000000400000-0x000000000045C000-memory.dmp

      Filesize

      368KB

    • memory/2792-27-0x00000000740F0000-0x000000007469B000-memory.dmp

      Filesize

      5.7MB

    • memory/2792-28-0x00000000740F0000-0x000000007469B000-memory.dmp

      Filesize

      5.7MB

    • memory/2792-29-0x0000000002330000-0x0000000002370000-memory.dmp

      Filesize

      256KB

    • memory/2792-26-0x0000000000400000-0x000000000045C000-memory.dmp

      Filesize

      368KB

    • memory/2792-32-0x0000000002330000-0x0000000002370000-memory.dmp

      Filesize

      256KB

    • memory/2792-37-0x00000000740F0000-0x000000007469B000-memory.dmp

      Filesize

      5.7MB

    • memory/2792-38-0x00000000740F0000-0x000000007469B000-memory.dmp

      Filesize

      5.7MB

    • memory/2792-21-0x0000000000400000-0x000000000045C000-memory.dmp

      Filesize

      368KB