Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2025, 04:13

General

  • Target

    a0e0881d4b8a8410a88e232674cb0a0a56823ca1aeb0c4ebf3f191b0a03d9272.exe

  • Size

    579KB

  • MD5

    f263a47f4438d83b0ee49453e41d6c54

  • SHA1

    16d7e1db40d61bfcd5a2597bd1594085cd8e7890

  • SHA256

    a0e0881d4b8a8410a88e232674cb0a0a56823ca1aeb0c4ebf3f191b0a03d9272

  • SHA512

    d15bf611bc97a47b74d6d297c75f2ff20016aeb6cf90069492b78df09f978907c4fd84fdb8d6d46d99331a5dcfcfc89ba9e8ed366e5164c2ecb138d6f088088f

  • SSDEEP

    12288:YbD5arFJwK6hMJ6ZzHFZfc28beMGTfZuqb79:rBJwdhMJ6ZzHrfcsMGTfZ5P9

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Imminent family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0e0881d4b8a8410a88e232674cb0a0a56823ca1aeb0c4ebf3f191b0a03d9272.exe
    "C:\Users\Admin\AppData\Local\Temp\a0e0881d4b8a8410a88e232674cb0a0a56823ca1aeb0c4ebf3f191b0a03d9272.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe
      "C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1532
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:2864

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe

      Filesize

      579KB

      MD5

      2663ede69bced28109a848bc2071279a

      SHA1

      efee9721c84c42db461cc40bde05745071427393

      SHA256

      b141c5fc03daa1616810ace93e0436dfc715701e86810f91d55ed85653221a20

      SHA512

      9bd7128ca858526c99cfe3a11399d977f045b4f10dbf595f7872cdeb8da9768aafef87b0fb16e0420277ab025434bc82cf638db4d56bd89e0026e83f2b4e655c

    • memory/1088-19-0x0000000074E90000-0x000000007557E000-memory.dmp

      Filesize

      6.9MB

    • memory/1088-14-0x0000000074E90000-0x000000007557E000-memory.dmp

      Filesize

      6.9MB

    • memory/1088-40-0x0000000074E90000-0x000000007557E000-memory.dmp

      Filesize

      6.9MB

    • memory/1088-18-0x0000000074E90000-0x000000007557E000-memory.dmp

      Filesize

      6.9MB

    • memory/1088-16-0x0000000074E90000-0x000000007557E000-memory.dmp

      Filesize

      6.9MB

    • memory/1088-15-0x0000000000D40000-0x0000000000DD4000-memory.dmp

      Filesize

      592KB

    • memory/1532-36-0x0000000002640000-0x00000000026EE000-memory.dmp

      Filesize

      696KB

    • memory/1532-24-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1532-38-0x00000000008C0000-0x00000000008D6000-memory.dmp

      Filesize

      88KB

    • memory/1532-37-0x00000000007F0000-0x0000000000818000-memory.dmp

      Filesize

      160KB

    • memory/1532-22-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1532-35-0x0000000000470000-0x0000000000480000-memory.dmp

      Filesize

      64KB

    • memory/1532-32-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1532-30-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1532-20-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1532-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1532-26-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1532-34-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1996-2-0x00000000002C0000-0x00000000002CA000-memory.dmp

      Filesize

      40KB

    • memory/1996-1-0x0000000001060000-0x00000000010F4000-memory.dmp

      Filesize

      592KB

    • memory/1996-0-0x0000000074E9E000-0x0000000074E9F000-memory.dmp

      Filesize

      4KB

    • memory/1996-4-0x0000000074E9E000-0x0000000074E9F000-memory.dmp

      Filesize

      4KB

    • memory/1996-17-0x0000000074E90000-0x000000007557E000-memory.dmp

      Filesize

      6.9MB

    • memory/1996-5-0x0000000074E90000-0x000000007557E000-memory.dmp

      Filesize

      6.9MB

    • memory/1996-3-0x0000000074E90000-0x000000007557E000-memory.dmp

      Filesize

      6.9MB