imminent | 0227955895242e6f47f3ea76abf8b2032569b7efec7d5eddc249e3bb0f5485d2

General

Target

samp-server.exe
Size

440KB
MD5

ae6ce4f24fdf0a330382438fca5a8ed6
SHA1

fcfbe7f2c71111b3b89144723b5d1d5319f5ebbf
SHA256

0227955895242e6f47f3ea76abf8b2032569b7efec7d5eddc249e3bb0f5485d2
SHA512

9821ccd7b77787b297489fb97d87f335146d75be8612cb1603bf83f88486bdc51bdbb4e546a8548ac66d69f2c8990bfd8bac39e237b16753fe2e8551b1120f54
SSDEEP

6144:5gZisNr2tpwwwwfSsxTvfzY19Yiz29EJsa5zXBalvpmcpoZ1NNpE5B5pxwcvGmtz:a4MrYpw4J5vLY19Ys296GqojGq

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 4 IoCs

pid	Process
5096	samp-server.exe
3516	samp-server.exe
2760	samp-server.exe
704	samp-server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-682446400-748730298-2471801445-1000\Software\Microsoft\Windows\CurrentVersion\Run\HostProcess = "\\Tasks\\HostProcessForWindowsTask.exe"	samp-server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-682446400-748730298-2471801445-1000\Software\Microsoft\Windows\CurrentVersion\Run\HostProcess = "C:\\Users\\Admin\\AppData\\Local\\Tasks\\HostProcessForWindowsTask.exe"	samp-server.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	samp-server.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	samp-server.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	samp-server.exe
File opened for modification	C:\Windows\assembly	samp-server.exe
File created	C:\Windows\assembly\Desktop.ini	samp-server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4300	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5096	samp-server.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	samp-server.exe
Token: SeDebugPrivilege	5096	samp-server.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5096	samp-server.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 5096	4980	samp-server.exe	75
PID 4980 wrote to memory of 5096	4980	samp-server.exe	75
PID 4980 wrote to memory of 5096	4980	samp-server.exe	75
PID 4980 wrote to memory of 388	4980	samp-server.exe	76
PID 4980 wrote to memory of 388	4980	samp-server.exe	76
PID 4980 wrote to memory of 388	4980	samp-server.exe	76
PID 388 wrote to memory of 4300	388	cmd.exe	78
PID 388 wrote to memory of 4300	388	cmd.exe	78
PID 388 wrote to memory of 4300	388	cmd.exe	78

C:\Users\Admin\AppData\Local\Temp\samp-server.exe
"C:\Users\Admin\AppData\Local\Temp\samp-server.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\samp-server\samp-server.exe
  "C:\Users\Admin\AppData\Local\Temp\samp-server\samp-server.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5096
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\samp-server.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 1000
    3⤵
    - Runs ping.exe
    PID:4300

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4216

C:\Users\Admin\AppData\Local\Temp\samp-server\samp-server.exe
"C:\Users\Admin\AppData\Local\Temp\samp-server\samp-server.exe"
1⤵
- Executes dropped EXE
PID:3516

C:\Users\Admin\AppData\Local\Temp\samp-server\samp-server.exe
"C:\Users\Admin\AppData\Local\Temp\samp-server\samp-server.exe"
1⤵
- Executes dropped EXE
PID:2760

C:\Users\Admin\AppData\Local\Temp\samp-server\samp-server.exe
"C:\Users\Admin\AppData\Local\Temp\samp-server\samp-server.exe"
1⤵
- Executes dropped EXE
PID:704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\samp-server.exe.log

Filesize
319B

MD5
63d5e381c73f51d67f146673b579e1e2

SHA1
f19bdac1f4240ae47c21b67e0cae827696e69352

SHA256
5b0f01dfcbb68a865042f6456c0861fa616f6b32886cec3acc07df6c22e0fba2

SHA512
cb6b0c3235a082b605d8d0a9cb567099db8026ddc4266ef3148412e49348135c0cc4b752d9212578914f30ef6b9ce4be21d5ee76fcc3ead5c84dd940f74b9611

Download Submit
C:\Users\Admin\AppData\Local\Temp\samp-server\samp-server.exe

Filesize
440KB

MD5
ae6ce4f24fdf0a330382438fca5a8ed6

SHA1
fcfbe7f2c71111b3b89144723b5d1d5319f5ebbf

SHA256
0227955895242e6f47f3ea76abf8b2032569b7efec7d5eddc249e3bb0f5485d2

SHA512
9821ccd7b77787b297489fb97d87f335146d75be8612cb1603bf83f88486bdc51bdbb4e546a8548ac66d69f2c8990bfd8bac39e237b16753fe2e8551b1120f54

Download Submit
C:\Users\Admin\AppData\Roaming\Imminent\Path.dat

Filesize
64B

MD5
ba0f4f011b9d97fcf7607e43ad11bb9b

SHA1
61ef10616626609eefbe071b6b985c877d60c482

SHA256
411de1ec10068ffa6cbfcffeccec5e62b716fa44153f07cdef767fc3ec425749

SHA512
b4ea2f7909687248a18acedf5b4719da898c702782cf891cc385d202e09a964a4c051427667394bb4e5b3145d50439d6a859aab49a03699eb30f7d6b03d26170

Download Submit
memory/704-132-0x0000000073440000-0x00000000739F0000-memory.dmp

Filesize
5.7MB

Download
memory/704-131-0x0000000073440000-0x00000000739F0000-memory.dmp

Filesize
5.7MB

Download
memory/704-130-0x0000000000910000-0x0000000000920000-memory.dmp

Filesize
64KB

Download
memory/704-129-0x0000000073440000-0x00000000739F0000-memory.dmp

Filesize
5.7MB

Download
memory/2760-126-0x0000000073440000-0x00000000739F0000-memory.dmp

Filesize
5.7MB

Download
memory/2760-124-0x0000000073440000-0x00000000739F0000-memory.dmp

Filesize
5.7MB

Download
memory/2760-123-0x0000000002FF0000-0x0000000003000000-memory.dmp

Filesize
64KB

Download
memory/2760-122-0x0000000073440000-0x00000000739F0000-memory.dmp

Filesize
5.7MB

Download
memory/3516-110-0x0000000073440000-0x00000000739F0000-memory.dmp

Filesize
5.7MB

Download
memory/3516-111-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/3516-112-0x0000000073440000-0x00000000739F0000-memory.dmp

Filesize
5.7MB

Download
memory/3516-114-0x0000000073440000-0x00000000739F0000-memory.dmp

Filesize
5.7MB

Download
memory/4980-0-0x0000000073440000-0x00000000739F0000-memory.dmp

Filesize
5.7MB

Download
memory/4980-11-0x0000000073440000-0x00000000739F0000-memory.dmp

Filesize
5.7MB

Download
memory/4980-2-0x0000000002270000-0x0000000002280000-memory.dmp

Filesize
64KB

Download
memory/4980-1-0x0000000073440000-0x00000000739F0000-memory.dmp

Filesize
5.7MB

Download
memory/5096-50-0x0000000002640000-0x0000000002650000-memory.dmp

Filesize
64KB

Download
memory/5096-49-0x0000000073440000-0x00000000739F0000-memory.dmp

Filesize
5.7MB

Download
memory/5096-12-0x0000000073440000-0x00000000739F0000-memory.dmp

Filesize
5.7MB

Download
memory/5096-10-0x0000000002640000-0x0000000002650000-memory.dmp

Filesize
64KB

Download
memory/5096-9-0x0000000073440000-0x00000000739F0000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads