Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
20-03-2024 02:02
General
-
Target
047fcf6cf1e83002c31d9725f92abe3014bcb0a65a3078dcc6467036ba792547.exe
-
Size
852KB
-
MD5
e04213f27f4e2c763e0b8910f7743af3
-
SHA1
2707a70bfb085112cb02c82c738f752a4e789825
-
SHA256
047fcf6cf1e83002c31d9725f92abe3014bcb0a65a3078dcc6467036ba792547
-
SHA512
423039cd63fac7e3ceda72bf26695cc94339b1105b4c1a0bf603364e239658b30be841c47e781da867ff1ea0f22428c589ce3daac2c3834ef58e552fdafb242e
-
SSDEEP
24576:2deM8k31Q2B7oVSRZw/bO/PVggnoGhkOF8rcbfdaMQ8NNr+OZQw6F77GEm+pV0kn:8e831bEOOyy
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Detects PowerShell content designed to retrieve passwords from host 14 IoCs
-
detects Windows exceutables potentially bypassing UAC using eventvwr.exe 13 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\047fcf6cf1e83002c31d9725f92abe3014bcb0a65a3078dcc6467036ba792547.exe"C:\Users\Admin\AppData\Local\Temp\047fcf6cf1e83002c31d9725f92abe3014bcb0a65a3078dcc6467036ba792547.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Imminent\Path.datFilesize
50B
MD55e5949ab86f7e6eb19f2a7d1d11313e9
SHA14a92320fc66ef89ae83584962371fe2d7543ffa1
SHA256581df2cddc7a7b8753b6f7a448ef410500222a70c265e481ce4bd815d3ac0db6
SHA512dc5f4d1db3484512cc042f566570b9c4c91372a8fa22039d953597df81d5b616e285a0e7893e77d9d9f8ecd7ffed3a8983a62fca4f54159ccd7cf19fb261065c
-
memory/1424-25-0x000000000A230000-0x000000000A2CC000-memory.dmpFilesize
624KB
-
memory/1424-12-0x00000000013D0000-0x0000000001478000-memory.dmpFilesize
672KB
-
memory/1424-6-0x00000000013D0000-0x0000000001478000-memory.dmpFilesize
672KB
-
memory/1424-7-0x00000000013D0000-0x0000000001478000-memory.dmpFilesize
672KB
-
memory/1424-26-0x000000000A880000-0x000000000AE24000-memory.dmpFilesize
5.6MB
-
memory/1424-9-0x00000000013D0000-0x0000000001478000-memory.dmpFilesize
672KB
-
memory/1424-10-0x00000000013D0000-0x0000000001478000-memory.dmpFilesize
672KB
-
memory/1424-27-0x0000000005E60000-0x0000000005EF2000-memory.dmpFilesize
584KB
-
memory/1424-14-0x00000000013D0000-0x0000000001478000-memory.dmpFilesize
672KB
-
memory/1424-28-0x00000000063B0000-0x0000000006416000-memory.dmpFilesize
408KB
-
memory/1424-18-0x00000000013D0000-0x0000000001478000-memory.dmpFilesize
672KB
-
memory/1424-20-0x00000000013D0000-0x0000000001478000-memory.dmpFilesize
672KB
-
memory/1424-21-0x00000000013D0000-0x0000000001478000-memory.dmpFilesize
672KB
-
memory/1424-23-0x00000000013D0000-0x0000000001478000-memory.dmpFilesize
672KB
-
memory/1424-24-0x0000000005AD0000-0x0000000005AE0000-memory.dmpFilesize
64KB
-
memory/1424-0-0x00000000013D0000-0x0000000001478000-memory.dmpFilesize
672KB
-
memory/1424-8-0x00000000013D0000-0x0000000001478000-memory.dmpFilesize
672KB
-
memory/1424-5-0x00000000034C0000-0x00000000034E8000-memory.dmpFilesize
160KB
-
memory/1424-15-0x00000000013D0000-0x0000000001478000-memory.dmpFilesize
672KB
-
memory/1424-29-0x00000000067C0000-0x00000000067D8000-memory.dmpFilesize
96KB
-
memory/1424-32-0x0000000006A40000-0x0000000006A56000-memory.dmpFilesize
88KB
-
memory/1424-33-0x0000000007390000-0x000000000739A000-memory.dmpFilesize
40KB
-
memory/1424-71-0x0000000074C30000-0x00000000753E0000-memory.dmpFilesize
7.7MB
-
memory/1424-4-0x0000000074C30000-0x00000000753E0000-memory.dmpFilesize
7.7MB
-
memory/2872-35-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/2872-41-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/2872-44-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/2872-45-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/2872-42-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/2872-46-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/2872-47-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/2872-48-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/2872-36-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/2872-37-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB