Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-11-2024 19:14
General
-
Target
03bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490.exe
-
Size
442KB
-
MD5
48a52bf6785639698f907abd05e40f84
-
SHA1
6de2644a5742e53fe497be30388e952455833713
-
SHA256
03bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490
-
SHA512
6605fddd77733550bbdbf5772b3718444717c420281ebcb3a3f1fb9155c3ae5aa6cea9c87381a0866fb59098a08397f6c02ac0f11a879265d331e4948d843574
-
SSDEEP
12288:gO3nzR81/CPPYYg8btjp5lQ6GGb2I+ON3BVHLIcgwazbXkZ:5zO1/mYYg85N5lB2PEzOU
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Imminent family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\03bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490.exe"C:\Users\Admin\AppData\Local\Temp\03bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\03bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490.exe"C:\Users\Admin\AppData\Local\Temp\03bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\03bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490\03bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490.exe"C:\Users\Admin\AppData\Local\Temp\03bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490\03bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\03bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490\03bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490.exe"C:\Users\Admin\AppData\Local\Temp\03bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490\03bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490.exe"4⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\03bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490.exe"3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10004⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
400B
MD50a9b4592cd49c3c21f6767c2dabda92f
SHA1f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA5126b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307
-
Filesize
442KB
MD548a52bf6785639698f907abd05e40f84
SHA16de2644a5742e53fe497be30388e952455833713
SHA25603bab0daf2e3285f26ced738fc0fd010404cf07513a2135b9f2fd8f894a15490
SHA5126605fddd77733550bbdbf5772b3718444717c420281ebcb3a3f1fb9155c3ae5aa6cea9c87381a0866fb59098a08397f6c02ac0f11a879265d331e4948d843574
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
360KB
-
Filesize
5.7MB
-
Filesize
360KB
-
Filesize
360KB
-
Filesize
5.7MB