imminent | 2ca4803498d7d375a61bfab2a3a4cf7e0eec41d116e50a838791a55b164e0f8c

max time kernel
897s
max time network
900s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
16/01/2025, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Malware-1-master/Software.exe
Size 1.6MB
Sample250116-p2cbaasjam
SHA256 e7f04e85236f0caafe518bd96369313021969077dba1c4a6d42e694498dab04f
MD5 db056b8fa628b67e11bd626192939d6b
SHA1 248ca50f39de6b6180265d19fb6eedc68bf25afc
SHA512 bca1856b4bb8342c0f6d5ee19edcb420c70e6b272f087d3f8f73daa00842fa00037840a5eb5655e1445af8d578d304874323b2889f75b27136df9366df596336
SSDEEP 24576:ytb20pkaCqT5TBWgNQ7ayEYyM63uUOyok0ceJZwd/w9mML9eu4MaMUp46A:/Vg5tQ7ayExZO9k0waPLR4Ma25
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

imminent discovery spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent
Imminent family
imminent

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MAmOR.com.url	Software.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfc011.dat	WmiApSrv.exe
File created	C:\Windows\system32\perfc007.dat	WmiApSrv.exe
File created	C:\Windows\system32\perfc009.dat	WmiApSrv.exe
File created	C:\Windows\system32\perfh009.dat	WmiApSrv.exe
File created	C:\Windows\system32\perfc00C.dat	WmiApSrv.exe
File created	C:\Windows\system32\perfh00C.dat	WmiApSrv.exe
File created	C:\Windows\system32\perfc010.dat	WmiApSrv.exe
File created	C:\Windows\system32\perfh010.dat	WmiApSrv.exe
File created	C:\Windows\system32\PerfStringBackup.TMP	WmiApSrv.exe
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WmiApSrv.exe
File created	C:\Windows\system32\perfh007.dat	WmiApSrv.exe
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	WmiApSrv.exe
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WmiApSrv.exe
File created	C:\Windows\system32\perfh011.dat	WmiApSrv.exe
File created	C:\Windows\system32\perfc00A.dat	WmiApSrv.exe
File created	C:\Windows\system32\perfh00A.dat	WmiApSrv.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2912 set thread context of 2792	2912	Software.exe	30

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WmiApSrv.exe
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WmiApSrv.exe
File created	C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Software.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2792	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	InstallUtil.exe
Token: 33	2792	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2792	InstallUtil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2792	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2792	2912	Software.exe	30
PID 2912 wrote to memory of 2792	2912	Software.exe	30
PID 2912 wrote to memory of 2792	2912	Software.exe	30
PID 2912 wrote to memory of 2792	2912	Software.exe	30
PID 2912 wrote to memory of 2792	2912	Software.exe	30
PID 2912 wrote to memory of 2792	2912	Software.exe	30
PID 2912 wrote to memory of 2792	2912	Software.exe	30
PID 2912 wrote to memory of 2792	2912	Software.exe	30
PID 2912 wrote to memory of 2792	2912	Software.exe	30
PID 2912 wrote to memory of 2792	2912	Software.exe	30
PID 2912 wrote to memory of 2792	2912	Software.exe	30
PID 2912 wrote to memory of 2792	2912	Software.exe	30

C:\Users\Admin\AppData\Local\Temp\Malware-1-master\Software.exe
"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\Software.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2792

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TempMgtWS.bmp

Path C:\Users\Admin\AppData\Local\TempMgtWS.bmp
Size 322KB
SHA256 00ca0571f9aea13daba403b1a514e87a250ed555e097002260bdc88a844212e3
MD5 67d0ccbe9439616cfa416f33906874e7
SHA1 7a64de6020b77767a19ce5ba6a425076f1e84183
SHA512 7b4fce8374b56f418957d396104ac59f0262820bc90defb86485c3a166ad4e5002405bb62d01c2934c1deab634f86414a26fd1fa634b3223389367a88514e8d3
SSDEEP 6144:+sHkNe4sshJ8lV5OlXaB0YbrViIqwvuDdEdqqkLceNhow8ecL:+sHkcf6J45OlXaB0orYIqDnLc0how8eg
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc007.dat

Path C:\Windows\System32\perfc007.dat
Size 141KB
SHA256 dfad62e3372760d303f7337fe290e4cb28e714caadd3c59294b77968d81fe460
MD5 0f3d76321f0a7986b42b25a3aa554f82
SHA1 7036bba62109cc25da5d6a84d22b6edb954987c0
SHA512 bb02a3f14d47d233fbda046f61bbf5612ebc6213b156af9c47f56733a03df1bb484d1c3576569eb4499d7b378eb01f4d6e906c36c6f71738482584c2e84b47d0
SSDEEP 768:5Kb+j2tTFyuhttrBq2azmYxTXjvOXZODr9Tc/RUo:5Kb+j2tTPhttdq2g7OXZODr9Ti
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc00A.dat

Path C:\Windows\System32\perfc00A.dat
Size 154KB
SHA256 cfa293532a1b865b95093437d82bf8b682132aa335957f0c6d95edfbcc372324
MD5 f0ecfbfa3e3e59fd02197018f7e9cb84
SHA1 961e9367a4ef3a189466c0a0a186faf8958bdbc4
SHA512 116e648cb3b591a6a94da5ef11234778924a2ff9e0b3d7f6f00310d8a58914d12f5ee1b63c2f88701bb00538ad0e42ae2561575333c5a1d63bb8c86863ac6294
SSDEEP 768:jLLxU1GSWnWRIV9t1N2r+BA6GabCOcxyxePC5rcLtY4NcgBqL6QenMfQZU61lyAv:jLLxUBWn92k6W3py
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc00C.dat

Path C:\Windows\System32\perfc00C.dat
Size 145KB
SHA256 68d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31
MD5 ce233fa5dc5adcb87a5185617a0ff6ac
SHA1 2e2747284b1204d3ab08733a29fdbabdf8dc55b9
SHA512 1e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2
SSDEEP 3072:Sk/cq2lPtwvg0KS9mI+EP5YVcbuo3jfz2F/cKuEF2Dsy:SQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc010.dat

Path C:\Windows\System32\perfc010.dat
Size 142KB
SHA256 9de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57
MD5 d73172c6cb697755f87cd047c474cf91
SHA1 abc5c7194abe32885a170ca666b7cce8251ac1d6
SHA512 7c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6
SSDEEP 768:0hCx4l7JXlrCE3eAGua2eSXrAxmI4yYf4w91Nw+vB2U++P+pmij4Vh6TzoqAbqGB:0Axo7JX9E2hH+eQy
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc011.dat

Path C:\Windows\System32\perfc011.dat
Size 114KB
SHA256 1665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea
MD5 1f998386566e5f9b7f11cc79254d1820
SHA1 e1da5fe1f305099b94de565d06bc6f36c6794481
SHA512 a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f
SSDEEP 768:BwwR1fQRDl6VE3qG2T/YULhOdQfUwe6RzqgX2rIfwUKTzWPTryQiIAMyOf7:X1i33qG2JRzqgX2VWi9NnOf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh007.dat

Path C:\Windows\System32\perfh007.dat
Size 680KB
SHA256 24c81302014118e07ed97eaac0819ecf191e0cc3d69c02b16ecda60ac4718625
MD5 b69ab3aeddb720d6ef8c05ff88c23b38
SHA1 d830c2155159656ed1806c7c66cae2a54a2441fa
SHA512 4c7a99d45fb6e90c206439dcdd7cd198870ea5397a6584bb666eed53a8dc36faaac0b9cfc786a3ab4ecbbecc3a4ddd91560246d83b3319f2e37c1ed4bdbec32d
SSDEEP 3072:chpwBxTEsmVdxOpM88RMgfQuRx+PYZ1XrcPDtzcSx2A8q1JuqaB32rSrSVCxls/4:/PZmiDDnKofxM
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh009.dat

Path C:\Windows\System32\perfh009.dat
Size 634KB
SHA256 2d168ab31836a08d8ca00aab9685f040aac4052a7f10fbbf0c28e9f880a79dd3
MD5 1c678ee06bd02b5d9e4d51c3a4ec2d2b
SHA1 90aa7fdfaaa37fb4f2edfc8efc3994871087dedb
SHA512 ec665d7a20f27b2a0fe2475883009c6d34615cc2046d096de447ef57bcac9da0ae842be0556f5736f42d9c1c601fb8629896a2444990e508f7c573165088ab32
SSDEEP 3072:PdGEJowE4j0kRZnLOlMZ8M6d0UHjYnWB7BxLh0okf9zQdcpM7q3TBQpsAMXV7c9G:j8M6d0SZ9W1l
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh00A.dat

Path C:\Windows\System32\perfh00A.dat
Size 727KB
SHA256 ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879
MD5 7d0bac4e796872daa3f6dc82c57f4ca8
SHA1 b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a
SHA512 145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e
SSDEEP 3072:2f57F17Fetjvtx1tTSam86nAgnjXSn5EBGP5pNxXoTbMd4Xn8BoMjHArzThBOZnz:Ntjvtx1tTS3n3jXCP5XZnUOh
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh00C.dat

Path C:\Windows\System32\perfh00C.dat
Size 727KB
SHA256 2e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c
MD5 5f684ce126de17a7d4433ed2494c5ca9
SHA1 ce1a30a477daa1bac2ec358ce58731429eafe911
SHA512 4d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b
SSDEEP 3072:8S0+6JpGytgViPIiy4auTs62gdDIefsnnSRRDwcBRKZNtflhHZneBZoVoZfMdtBi:mTsIrCeJqq
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh010.dat

Path C:\Windows\System32\perfh010.dat
Size 722KB
SHA256 eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349
MD5 4623482c106cf6cc1bac198f31787b65
SHA1 5abb0decf7b42ef5daf7db012a742311932f6dad
SHA512 afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f
SSDEEP 3072:gd8gxHwjkUXx5q8d8tj/v9GLcxcx8oEpvnLB+aVGul9oLim4dDXBnZdQTKSBf1TJ:oHj/v9GLnaVGuEkB4Bf/
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh011.dat

Path C:\Windows\System32\perfh011.dat
Size 406KB
SHA256 646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5
MD5 54c674d19c0ff72816402f66f6c3d37c
SHA1 2dcc0269545a213648d59dc84916d9ec2d62a138
SHA512 4d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f
SSDEEP 3072:Ej83gD6HfgO/235TjhpoMnkrBI4BHvjxiBzBDVTooFosWbEh3KlpsOdciKXEqB3e:o83r/23hLDfcHyKK8BOFi
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApRpl.h

Path C:\Windows\System32\wbem\Performance\WmiApRpl.h
Size 3KB
SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
MD5 b133a676d139032a27de3d9619e70091
SHA1 1248aa89938a13640252a79113930ede2f26f1fa
SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
MD5 SHA1 SHA512

Submit Download

WmiApRpl.ini

Path C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Size 27KB
SHA256 5b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
MD5 46d08e3a55f007c523ac64dce6dcf478
SHA1 62edf88697e98d43f32090a2197bead7e7244245
SHA512 b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42
SSDEEP 384:eso3V1/z21+byTLVh4+rCop/g4kg4491T91XFrw4G4xvrtZ9dyu+2VVNuDu:esoW/g4kg4oG4F
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2792-50-0x0000000074F90000-0x00000000750A0000-memory.dmp

Download

memory/2792-61-0x0000000074F90000-0x00000000750A0000-memory.dmp

Download

memory/2792-60-0x0000000074F90000-0x00000000750A0000-memory.dmp

Download

memory/2792-54-0x00000000006C0000-0x00000000006D6000-memory.dmp

Download

memory/2792-53-0x0000000000540000-0x0000000000568000-memory.dmp

Download

memory/2792-52-0x00000000041B0000-0x000000000425E000-memory.dmp

Download

memory/2792-51-0x00000000004D0000-0x00000000004E0000-memory.dmp

Download

memory/2792-49-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2792-47-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2792-40-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2912-14-0x000000007501E000-0x000000007501F000-memory.dmp

Download

memory/2912-9-0x000000007DE70000-0x000000007DFF0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads