imminent | 1aabeaf72f2af76b774252e1d0bd599c03a7217ffa77974d1a7afeb6025e0ec3

General

Target

3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe
Size

322KB
MD5

3dedb531c23d2f97dfef2f55f5755375
SHA1

0c5141964e9b293ddcd9288d5b11cc7c012865b0
SHA256

1aabeaf72f2af76b774252e1d0bd599c03a7217ffa77974d1a7afeb6025e0ec3
SHA512

1e4df34ee6c25c7ffffd8cba64ecd6447974c74ce246bf137e3a983a5a830f293ef4a6d1f1b6146089c10e927dbc5ffee537ce8f1b6515968ddc2ece00e25c85
SSDEEP

6144:2Wo5kzR/8WzGM6npfk8dyjlA9xq5YznuXu6kmOrnzX6qi:29kdFGzB3bBJb7Li

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Deletes itself 1 IoCs

pid	Process
2452	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2848	3dedb531c23d2f97dfef2f55f5755375_jaffacakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1704	3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Users\\Admin\\AppData\\Roaming\\1\\.exe"	3dedb531c23d2f97dfef2f55f5755375_jaffacakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2588	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1704	3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe
1704	3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe
1704	3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe
2848	3dedb531c23d2f97dfef2f55f5755375_jaffacakes118.exe
2848	3dedb531c23d2f97dfef2f55f5755375_jaffacakes118.exe
2848	3dedb531c23d2f97dfef2f55f5755375_jaffacakes118.exe
2848	3dedb531c23d2f97dfef2f55f5755375_jaffacakes118.exe
2848	3dedb531c23d2f97dfef2f55f5755375_jaffacakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2848	3dedb531c23d2f97dfef2f55f5755375_jaffacakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe
Token: SeDebugPrivilege	2848	3dedb531c23d2f97dfef2f55f5755375_jaffacakes118.exe
Token: 33	2848	3dedb531c23d2f97dfef2f55f5755375_jaffacakes118.exe
Token: SeIncBasePriorityPrivilege	2848	3dedb531c23d2f97dfef2f55f5755375_jaffacakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2848	3dedb531c23d2f97dfef2f55f5755375_jaffacakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2848	1704	3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe	29
PID 1704 wrote to memory of 2848	1704	3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe	29
PID 1704 wrote to memory of 2848	1704	3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe	29
PID 1704 wrote to memory of 2848	1704	3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe	29
PID 1704 wrote to memory of 2452	1704	3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe	30
PID 1704 wrote to memory of 2452	1704	3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe	30
PID 1704 wrote to memory of 2452	1704	3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe	30
PID 1704 wrote to memory of 2452	1704	3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe	30
PID 2452 wrote to memory of 2588	2452	cmd.exe	32
PID 2452 wrote to memory of 2588	2452	cmd.exe	32
PID 2452 wrote to memory of 2588	2452	cmd.exe	32
PID 2452 wrote to memory of 2588	2452	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\3dedb531c23d2f97dfef2f55f5755375_jaffacakes118\3dedb531c23d2f97dfef2f55f5755375_jaffacakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3dedb531c23d2f97dfef2f55f5755375_jaffacakes118\3dedb531c23d2f97dfef2f55f5755375_jaffacakes118.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\3dedb531c23d2f97dfef2f55f5755375_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 1000
    3⤵
    - Runs ping.exe
    PID:2588

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Imminent\Path.dat

Filesize
37B

MD5
67bee7be011fecee896a8ff29278d5da

SHA1
f7a019970bfd6d6da7bdb83995a32f6bd53a85af

SHA256
7f1762a1b085b766367bbdeccfffece4ee6318a86148b2004917dac97eec7851

SHA512
b9096ba8eb77534e6ffee2e5048856ae763b4b05aed51c372f1b1630fadc66d0866767be5b6964bbc0467a4f030d2f105fde36695d33525d510897062978d55f

Download Submit
\Users\Admin\AppData\Local\Temp\3dedb531c23d2f97dfef2f55f5755375_jaffacakes118\3dedb531c23d2f97dfef2f55f5755375_jaffacakes118.exe

Filesize
322KB

MD5
3dedb531c23d2f97dfef2f55f5755375

SHA1
0c5141964e9b293ddcd9288d5b11cc7c012865b0

SHA256
1aabeaf72f2af76b774252e1d0bd599c03a7217ffa77974d1a7afeb6025e0ec3

SHA512
1e4df34ee6c25c7ffffd8cba64ecd6447974c74ce246bf137e3a983a5a830f293ef4a6d1f1b6146089c10e927dbc5ffee537ce8f1b6515968ddc2ece00e25c85

Download Submit
memory/1704-3-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/1704-0-0x00000000745EE000-0x00000000745EF000-memory.dmp

Filesize
4KB

Download
memory/1704-4-0x0000000000B60000-0x0000000000C0E000-memory.dmp

Filesize
696KB

Download
memory/1704-5-0x0000000000490000-0x00000000004B8000-memory.dmp

Filesize
160KB

Download
memory/1704-2-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/1704-15-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/1704-1-0x00000000010D0000-0x0000000001126000-memory.dmp

Filesize
344KB

Download
memory/2848-13-0x0000000000330000-0x0000000000386000-memory.dmp

Filesize
344KB

Download
memory/2848-14-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/2848-17-0x0000000001E30000-0x0000000001E38000-memory.dmp

Filesize
32KB

Download
memory/2848-16-0x0000000001E00000-0x0000000001E10000-memory.dmp

Filesize
64KB

Download
memory/2848-19-0x0000000004010000-0x0000000004026000-memory.dmp

Filesize
88KB

Download
memory/2848-46-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads