Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-01-2025 01:39

General

  • Target

    839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14.exe

  • Size

    577KB

  • MD5

    7feb51850825988c38dc04f30f3ac501

  • SHA1

    cb76c0fce19210fcfaed4e1cb9fb6ecb4a317eff

  • SHA256

    839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14

  • SHA512

    086637fe339e52b75920c115c7c9b57895509d605a81e206776fb25b9f8049f0cddad4a4b0cc9b3aa4f6c14ada28ff2a52264fa4170be0f169ac8e4a5fe57ee0

  • SSDEEP

    12288:YbD5arFJwK6hMJ6ZzHFZfc28beMGTfZuqb7b:rBJwdhMJ6ZzHrfcsMGTfZ5Pb

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Imminent family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14.exe
    "C:\Users\Admin\AppData\Local\Temp\839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe
      "C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2020
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:2660

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe

      Filesize

      577KB

      MD5

      dc372045c60199d8ff2f9bb210d4ef1f

      SHA1

      5c29dd4afe29a2b5855be4c54e9e3348ab00c229

      SHA256

      9f33359bb91cd0d8efc37905aa27e48feace6d6fc8984542c7224f6e7cf77f2b

      SHA512

      fb774220b29ab51d56ae56dfc8a00808876947374d5afe8f47f698a757cd2260d6a473a3b26a18c3065c937af390db648c698b9a74c5a2452b71f4009336e548

    • memory/1688-35-0x0000000074100000-0x00000000747EE000-memory.dmp

      Filesize

      6.9MB

    • memory/1688-18-0x0000000074100000-0x00000000747EE000-memory.dmp

      Filesize

      6.9MB

    • memory/1688-17-0x0000000074100000-0x00000000747EE000-memory.dmp

      Filesize

      6.9MB

    • memory/1688-16-0x0000000000070000-0x0000000000104000-memory.dmp

      Filesize

      592KB

    • memory/1688-15-0x000000007410E000-0x000000007410F000-memory.dmp

      Filesize

      4KB

    • memory/2020-19-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/2020-29-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/2020-33-0x00000000004F0000-0x0000000000506000-memory.dmp

      Filesize

      88KB

    • memory/2020-32-0x0000000000720000-0x0000000000748000-memory.dmp

      Filesize

      160KB

    • memory/2020-31-0x0000000005090000-0x000000000513E000-memory.dmp

      Filesize

      696KB

    • memory/2020-30-0x00000000003C0000-0x00000000003D0000-memory.dmp

      Filesize

      64KB

    • memory/2020-27-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/2020-20-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/2020-25-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/2020-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2020-22-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/2020-21-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/2668-0-0x00000000747FE000-0x00000000747FF000-memory.dmp

      Filesize

      4KB

    • memory/2668-5-0x00000000747F0000-0x0000000074EDE000-memory.dmp

      Filesize

      6.9MB

    • memory/2668-2-0x0000000000250000-0x000000000025A000-memory.dmp

      Filesize

      40KB

    • memory/2668-3-0x00000000747F0000-0x0000000074EDE000-memory.dmp

      Filesize

      6.9MB

    • memory/2668-4-0x00000000747FE000-0x00000000747FF000-memory.dmp

      Filesize

      4KB

    • memory/2668-13-0x00000000747F0000-0x0000000074EDE000-memory.dmp

      Filesize

      6.9MB

    • memory/2668-1-0x00000000003D0000-0x0000000000464000-memory.dmp

      Filesize

      592KB