imminent | 8004e7a720dba922a3fa5a956bfef9d8189b02ff2f72d1a66421ececd8245811

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe
Size

1.5MB
MD5

0b028c59462504f316fdd978e96ca852
SHA1

221e13e8770f55e45fb12ed9c6249a37b2c82f9a
SHA256

8004e7a720dba922a3fa5a956bfef9d8189b02ff2f72d1a66421ececd8245811
SHA512

dd89c41f6eb9a2a34bc0ad540f87979f3578a643f20a2c3d8609ee9ce739a83819b0e0fd5f008870c9504f3072523ca074b85fc1cae0c06a41d6bf6fac0a6b43
SSDEEP

12288:iLWzQWmzgFsw/vf8uzFwxCyEFKFHeSJ7zdGT0Lb2ZoF9Mt8:iL0pYgF7E0FOCyGKNeSJ7zdGgXIt8

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmrtAdpt.lnk	SmrtAdpt.exe

Executes dropped EXE 3 IoCs

pid	Process
2592	mshtemp.exe
2312	SmrtAdpt.exe
2740	SmrtAdpt.exe

Loads dropped DLL 3 IoCs

pid	Process
1888	cmd.exe
2312	SmrtAdpt.exe
2312	SmrtAdpt.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2312 set thread context of 2740	2312	SmrtAdpt.exe	50

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NTFS ADS 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SmrtAdpt.exe:Zone.Identifier	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SmrtAdpt.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\AppData\Local\Temp\0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe:Zone.Identifier	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe:Zone.Identifier	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\mshtemp.exe:Zone.Identifier	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\mshtemp.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SmrtAdpt.exe\:Zone.Identifier:$DATA	cmd.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1556	0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe
Token: SeDebugPrivilege	2592	mshtemp.exe
Token: SeDebugPrivilege	2312	SmrtAdpt.exe
Token: SeDebugPrivilege	2740	SmrtAdpt.exe
Token: 33	2740	SmrtAdpt.exe
Token: SeIncBasePriorityPrivilege	2740	SmrtAdpt.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2740	SmrtAdpt.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 3044	1556	0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe	30
PID 1556 wrote to memory of 3044	1556	0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe	30
PID 1556 wrote to memory of 3044	1556	0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe	30
PID 1556 wrote to memory of 3044	1556	0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe	30
PID 1556 wrote to memory of 1800	1556	0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe	32
PID 1556 wrote to memory of 1800	1556	0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe	32
PID 1556 wrote to memory of 1800	1556	0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe	32
PID 1556 wrote to memory of 1800	1556	0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe	32
PID 1556 wrote to memory of 2096	1556	0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe	34
PID 1556 wrote to memory of 2096	1556	0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe	34
PID 1556 wrote to memory of 2096	1556	0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe	34
PID 1556 wrote to memory of 2096	1556	0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe	34
PID 2096 wrote to memory of 2592	2096	cmd.exe	36
PID 2096 wrote to memory of 2592	2096	cmd.exe	36
PID 2096 wrote to memory of 2592	2096	cmd.exe	36
PID 2096 wrote to memory of 2592	2096	cmd.exe	36
PID 2592 wrote to memory of 1428	2592	mshtemp.exe	37
PID 2592 wrote to memory of 1428	2592	mshtemp.exe	37
PID 2592 wrote to memory of 1428	2592	mshtemp.exe	37
PID 2592 wrote to memory of 1428	2592	mshtemp.exe	37
PID 2592 wrote to memory of 2404	2592	mshtemp.exe	39
PID 2592 wrote to memory of 2404	2592	mshtemp.exe	39
PID 2592 wrote to memory of 2404	2592	mshtemp.exe	39
PID 2592 wrote to memory of 2404	2592	mshtemp.exe	39
PID 2592 wrote to memory of 2392	2592	mshtemp.exe	41
PID 2592 wrote to memory of 2392	2592	mshtemp.exe	41
PID 2592 wrote to memory of 2392	2592	mshtemp.exe	41
PID 2592 wrote to memory of 2392	2592	mshtemp.exe	41
PID 2592 wrote to memory of 1888	2592	mshtemp.exe	43
PID 2592 wrote to memory of 1888	2592	mshtemp.exe	43
PID 2592 wrote to memory of 1888	2592	mshtemp.exe	43
PID 2592 wrote to memory of 1888	2592	mshtemp.exe	43
PID 1888 wrote to memory of 2312	1888	cmd.exe	45
PID 1888 wrote to memory of 2312	1888	cmd.exe	45
PID 1888 wrote to memory of 2312	1888	cmd.exe	45
PID 1888 wrote to memory of 2312	1888	cmd.exe	45
PID 2312 wrote to memory of 1720	2312	SmrtAdpt.exe	46
PID 2312 wrote to memory of 1720	2312	SmrtAdpt.exe	46
PID 2312 wrote to memory of 1720	2312	SmrtAdpt.exe	46
PID 2312 wrote to memory of 1720	2312	SmrtAdpt.exe	46
PID 2312 wrote to memory of 908	2312	SmrtAdpt.exe	48
PID 2312 wrote to memory of 908	2312	SmrtAdpt.exe	48
PID 2312 wrote to memory of 908	2312	SmrtAdpt.exe	48
PID 2312 wrote to memory of 908	2312	SmrtAdpt.exe	48
PID 2312 wrote to memory of 2740	2312	SmrtAdpt.exe	50
PID 2312 wrote to memory of 2740	2312	SmrtAdpt.exe	50
PID 2312 wrote to memory of 2740	2312	SmrtAdpt.exe	50
PID 2312 wrote to memory of 2740	2312	SmrtAdpt.exe	50
PID 2312 wrote to memory of 2740	2312	SmrtAdpt.exe	50
PID 2312 wrote to memory of 2740	2312	SmrtAdpt.exe	50
PID 2312 wrote to memory of 2740	2312	SmrtAdpt.exe	50
PID 2312 wrote to memory of 2740	2312	SmrtAdpt.exe	50
PID 2312 wrote to memory of 2740	2312	SmrtAdpt.exe	50

C:\Users\Admin\AppData\Local\Temp\0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe:Zone.Identifier"
  2⤵
  - NTFS ADS
  PID:3044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\0b028c59462504f316fdd978e96ca852_JaffaCakes118.exe:Zone.Identifier"
  2⤵
  - NTFS ADS
  PID:1800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\Temp\mshtemp.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Users\Admin\AppData\Local\Temp\mshtemp.exe
    "C:\Users\Admin\AppData\Local\Temp\mshtemp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\mshtemp.exe:Zone.Identifier"
      4⤵
      NTFS ADS
      PID:1428
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\mshtemp.exe:Zone.Identifier"
      4⤵
      NTFS ADS
      PID:2404
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\mshtemp.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SmrtAdpt.exe"
      4⤵
      NTFS ADS
      PID:2392
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SmrtAdpt.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1888
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SmrtAdpt.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SmrtAdpt.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2312
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SmrtAdpt.exe:Zone.Identifier"
        6⤵
        NTFS ADS
        
        PID:1720
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SmrtAdpt.exe:Zone.Identifier"
        6⤵
        NTFS ADS
        
        PID:908
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SmrtAdpt.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SmrtAdpt.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2740

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mshtemp.exe

Filesize
1.5MB

MD5
0b028c59462504f316fdd978e96ca852

SHA1
221e13e8770f55e45fb12ed9c6249a37b2c82f9a

SHA256
8004e7a720dba922a3fa5a956bfef9d8189b02ff2f72d1a66421ececd8245811

SHA512
dd89c41f6eb9a2a34bc0ad540f87979f3578a643f20a2c3d8609ee9ce739a83819b0e0fd5f008870c9504f3072523ca074b85fc1cae0c06a41d6bf6fac0a6b43

Download Submit
memory/1556-0-0x0000000000CD0000-0x0000000000E4A000-memory.dmp

Filesize
1.5MB

Download
memory/1556-1-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download
memory/1556-2-0x00000000003B0000-0x00000000003DC000-memory.dmp

Filesize
176KB

Download
memory/1556-3-0x0000000004940000-0x0000000004980000-memory.dmp

Filesize
256KB

Download
memory/1556-4-0x0000000000910000-0x000000000091A000-memory.dmp

Filesize
40KB

Download
memory/1556-5-0x0000000000C20000-0x0000000000C2C000-memory.dmp

Filesize
48KB

Download
memory/1556-6-0x0000000000CA0000-0x0000000000CA6000-memory.dmp

Filesize
24KB

Download
memory/1556-8-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download
memory/2312-18-0x0000000004340000-0x000000000434C000-memory.dmp

Filesize
48KB

Download
memory/2312-15-0x0000000000AC0000-0x0000000000C3A000-memory.dmp

Filesize
1.5MB

Download
memory/2740-29-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2740-22-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2740-25-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2740-26-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2740-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2740-20-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2740-32-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2740-31-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2740-33-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/2740-34-0x0000000004C80000-0x0000000004D2E000-memory.dmp

Filesize
696KB

Download
memory/2740-35-0x0000000000500000-0x0000000000528000-memory.dmp

Filesize
160KB

Download
memory/2740-36-0x0000000000590000-0x00000000005A6000-memory.dmp

Filesize
88KB

Download