Overview

overview

10

Static

static

3

ee74dcfc2c...23.exe

windows7-x64

10

ee74dcfc2c...23.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-12-2024 01:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe

  • Size

    680KB

  • MD5

    de14f5adcd20b19b6b221647507c7c09

  • SHA1

    74a3dad2deeffa26a21f643273089847df606f3f

  • SHA256

    ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923

  • SHA512

    72f3950a43bac271ddd9290bfcbf4d26072abb584f9d643d90b0a98ae2e05da2649b193336d826412f8b130fd1854d76ffba9c4464f9993640154e97e4cc12c3

  • SSDEEP

    12288:PWvWgQsk97ZQjoOi1dkxVU6S8HWK/a1KPesnWwNnuFBbSEWEEEHnmfY5JdutJRMf:4v7k7ii1yUiH0

Score
10/10
imminentdiscoverypersistencespywaretrojan

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

    trojanspywareimminent
  • Imminent family
    imminent
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe
    "C:\Users\Admin\AppData\Local\Temp\ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2680
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:2908

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Imminent\Path.dat
      Filesize

      42B

      MD5

      abd0f6e13501f347e54ae6060f0e61eb

      SHA1

      f94cacf144b2c1f798667eb85dca532f6746d4a7

      SHA256

      7f9e5bed5bb2b25e2c0d9b235005df5fa388650f47c1c9743e0d226bc4dcb615

      SHA512

      4786455d7ea5b3508027bcbdf4e5e278e3fc90bb162ff6714256e53b9ac971b3e7a128d1040e15cd8eeb8e4fb4d60d1a1383bee0371b721d35c6425bd6d8f7e4

      Download Submit

    • \Users\Admin\AppData\Local\Temp\ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923.exe
      Filesize

      680KB

      MD5

      de14f5adcd20b19b6b221647507c7c09

      SHA1

      74a3dad2deeffa26a21f643273089847df606f3f

      SHA256

      ee74dcfc2c793e31464765575b88a36906aecb3daf685932abc3231e30cd8923

      SHA512

      72f3950a43bac271ddd9290bfcbf4d26072abb584f9d643d90b0a98ae2e05da2649b193336d826412f8b130fd1854d76ffba9c4464f9993640154e97e4cc12c3

      Download Submit

    • memory/3012-0-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3012-1-0x0000000000D20000-0x0000000000DD0000-memory.dmp

      Filesize

      704KB

      Download

    • memory/3012-2-0x0000000000510000-0x0000000000538000-memory.dmp

      Filesize

      160KB

      Download

    • memory/3012-3-0x0000000073EF0000-0x00000000745DE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/3012-6-0x0000000000B90000-0x0000000000BA6000-memory.dmp

      Filesize

      88KB

      Download

    • memory/3012-21-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3012-23-0x0000000073EF0000-0x00000000745DE000-memory.dmp

      Filesize

      6.9MB

      Download