imminent | 20bbb3f029a157dfb72a4ff3c8c004d036c387409239d424d8acef7590d80d3a

General

Target

95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe
Size

375KB
MD5

95c13c093af79e225282384aeaf654fe
SHA1

318e3cbbbdeb0c2dadebd96fa926a185d2338415
SHA256

20bbb3f029a157dfb72a4ff3c8c004d036c387409239d424d8acef7590d80d3a
SHA512

b5b66e6d32b9988f521e499f6aa85ffc1ff9a3b01dbeb2e71ceedfef8105048c114566f6497316e696a28202db0fb3b44f0afb0fa1a31fb02f1465cfc41f23b2
SSDEEP

6144:OT7TokKC82Vj/aqda+4q3c/bofNVNMbINgKg0LNTUrxj2nCvDI:gvo3C80j5SdDofNVabISKgETUtjeCvD

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 1 IoCs

pid	Process
1736	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1936	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1936 set thread context of 1736	1936	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	28

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1736	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe
Token: SeDebugPrivilege	1736	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe
Token: 33	1736	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1736	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1736	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1736	1936	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1736	1936	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1736	1936	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1736	1936	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1736	1936	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1736	1936	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1736	1936	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1736	1936	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1736	1936	95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1736

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\95c13c093af79e225282384aeaf654fe_JaffaCakes118.exe

Filesize
375KB

MD5
95c13c093af79e225282384aeaf654fe

SHA1
318e3cbbbdeb0c2dadebd96fa926a185d2338415

SHA256
20bbb3f029a157dfb72a4ff3c8c004d036c387409239d424d8acef7590d80d3a

SHA512
b5b66e6d32b9988f521e499f6aa85ffc1ff9a3b01dbeb2e71ceedfef8105048c114566f6497316e696a28202db0fb3b44f0afb0fa1a31fb02f1465cfc41f23b2

Download Submit
memory/1736-6-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1736-25-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download
memory/1736-22-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download
memory/1736-7-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1736-30-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download
memory/1736-18-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1736-21-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download
memory/1736-17-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1736-31-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download
memory/1736-9-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1736-23-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download
memory/1736-5-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1736-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1736-11-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1936-0-0x0000000074A81000-0x0000000074A82000-memory.dmp

Filesize
4KB

Download
memory/1936-1-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download
memory/1936-2-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download
memory/1936-20-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download
memory/1936-19-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download
memory/1936-3-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing