imminent | 114ad38ef50939dbc71a24923dff65aad0167b7679805d3c3a5a2fd4b6925247

General

Target

0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe
Size

693KB
MD5

0a37ecfea5074fff2de431e643e74af0
SHA1

4ff3dfa39ae7fd46772c30ff547ed935e134396f
SHA256

114ad38ef50939dbc71a24923dff65aad0167b7679805d3c3a5a2fd4b6925247
SHA512

7ee5854e7e3cebf76de910b47f427095c420cd27c227d74cd0c62e44f2adfc429c1abb02391cc7ca15df28a99ce471c4912d4a41fc43e234d78029f330f3c33f
SSDEEP

12288:tSIzbMSwyUI2buNNqwfVsQV2wWU4dh2hPnmrTVr5i38VeUbBxjv:tSibMSws2SqwGuZUgz3kXjv

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 2 IoCs

pid	Process
2912	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe
2764	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe
1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\Sample.lnk"	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1304 set thread context of 2764	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe
1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe
1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe
1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe
Token: SeDebugPrivilege	2764	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2608	DllHost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2764	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2372	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	28
PID 1304 wrote to memory of 2372	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	28
PID 1304 wrote to memory of 2372	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	28
PID 1304 wrote to memory of 2372	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	28
PID 1304 wrote to memory of 2544	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	30
PID 1304 wrote to memory of 2544	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	30
PID 1304 wrote to memory of 2544	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	30
PID 1304 wrote to memory of 2544	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	30
PID 1304 wrote to memory of 2912	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	33
PID 1304 wrote to memory of 2912	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	33
PID 1304 wrote to memory of 2912	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	33
PID 1304 wrote to memory of 2912	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	33
PID 1304 wrote to memory of 2764	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2764	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2764	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2764	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2764	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2764	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2764	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2764	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2764	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2764	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2764	1304	0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\CMD.exe
  "CMD"
  2⤵
  PID:2372
- C:\Windows\SysWOW64\CMD.exe
  "CMD"
  2⤵
  PID:2544
- C:\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2764

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
273b26e5749d4eb967426eba7c24c084

SHA1
dc18e7f072bb8269ebb1112154d6f39da3f35ed5

SHA256
ea01ad49555ac88d1eb1d6fb966b7a7e5c200353149a6371a760684cf98ffaf0

SHA512
2450fac14ea347d3709092ceb84fbde8b5230196a2a932c6f49321aadfe9da2bb767cdc2be4233fc3d6f191060708f75737d73494f7d891acc1a3ebe7ea91a84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3E29.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\small13.jpg

Filesize
18KB

MD5
80fb8abb9c3accd6a5040f9d35c4cfba

SHA1
856cf9162631fb5b1c3118560b0d20340d95d4a0

SHA256
6a81e3a9a8591ac8b6db2636cd0a130b033212848a6118b0217b4e8f1d6d6cee

SHA512
d962aaf75641d936da2d532479434ad6452a688859cd38000af51aad72e4a08d4b0c9d618e2ba38aef4316957d47a51049abe988f10f8c077d8de74f2bd39ec8

Download Submit
\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0_JaffaCakes118.exe

Filesize
693KB

MD5
0a37ecfea5074fff2de431e643e74af0

SHA1
4ff3dfa39ae7fd46772c30ff547ed935e134396f

SHA256
114ad38ef50939dbc71a24923dff65aad0167b7679805d3c3a5a2fd4b6925247

SHA512
7ee5854e7e3cebf76de910b47f427095c420cd27c227d74cd0c62e44f2adfc429c1abb02391cc7ca15df28a99ce471c4912d4a41fc43e234d78029f330f3c33f

Download Submit
memory/1304-51-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/1304-19-0x0000000004A00000-0x0000000004A02000-memory.dmp

Filesize
8KB

Download
memory/1304-15-0x0000000000930000-0x0000000000A30000-memory.dmp

Filesize
1024KB

Download
memory/1304-52-0x0000000000930000-0x0000000000A30000-memory.dmp

Filesize
1024KB

Download
memory/1304-13-0x0000000000930000-0x0000000000A30000-memory.dmp

Filesize
1024KB

Download
memory/1304-1-0x0000000000260000-0x00000000002A0000-memory.dmp

Filesize
256KB

Download
memory/1304-50-0x0000000000260000-0x00000000002A0000-memory.dmp

Filesize
256KB

Download
memory/1304-2-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/1304-0-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/1304-47-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/2608-20-0x0000000000120000-0x0000000000122000-memory.dmp

Filesize
8KB

Download
memory/2764-36-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2764-26-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2764-24-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2764-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2764-33-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2764-35-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2764-28-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2764-30-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads