Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/03/2025, 00:03 UTC

General

  • Target

    3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe

  • Size

    803KB

  • MD5

    d9088a749f3b68662c2773eb637b0b6b

  • SHA1

    907d48cbda81f3e4d9cd724154605f0657935ef8

  • SHA256

    3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea

  • SHA512

    ac27136531285dc2292d1ca8604955c0460f4d481f33857e72ab77d09cb89d0929c1bd4a624cf39c94fe87353ca201af4f914edf74fe2fd1a72c22d2688e2e73

  • SSDEEP

    24576:bkGvM/P1U4bBTOKr26GU5OYsnXgxvrQrAnuIw9:b2/P1UOtOKC6GrYsgxTQTIG

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Imminent family
  • Executes dropped EXE 2 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe
    "C:\Users\Admin\AppData\Local\Temp\3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1840
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1564
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn NgcIso /tr "C:\Users\Admin\advpack\refsutil.exe" /sc minute /mo 1 /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2936
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:1232
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {12563DD0-A3C7-4E60-9797-A7D181D927E6} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Users\Admin\advpack\refsutil.exe
        C:\Users\Admin\advpack\refsutil.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:328
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:792
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\SysWOW64\schtasks.exe" /create /tn NgcIso /tr "C:\Users\Admin\advpack\refsutil.exe" /sc minute /mo 1 /F
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1096
      • C:\Users\Admin\advpack\refsutil.exe
        C:\Users\Admin\advpack\refsutil.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1700
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3064
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\SysWOW64\schtasks.exe" /create /tn NgcIso /tr "C:\Users\Admin\advpack\refsutil.exe" /sc minute /mo 1 /F
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2328

    Network

      No results found
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      104 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      96 B
      2
    • 107.173.207.168:389
      RegAsm.exe
      52 B
      1
    No results found

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\advpack\refsutil.exe

      Filesize

      803KB

      MD5

      23d6c2932761c53ee3aa216a2717fcd4

      SHA1

      158bff81c905c0de242746bd78200049ad9b3a5e

      SHA256

      8dde4430b58fa190cf43c0e236d1441dbbfb242ae3bd8209bfe6bec1a4285f36

      SHA512

      f1368a21668ff7e439fc43b7eca5b9363bb4d83d24f71b1f43770c79e4dbf5a3e7248ae421b45098c2205aa12da12fe4f51572f8c0e9004d7c0dd16b1f301ac5

    • memory/328-35-0x0000000001320000-0x00000000014A8000-memory.dmp

      Filesize

      1.5MB

    • memory/328-24-0x0000000001320000-0x00000000014A8000-memory.dmp

      Filesize

      1.5MB

    • memory/1564-10-0x0000000000090000-0x00000000000E6000-memory.dmp

      Filesize

      344KB

    • memory/1564-4-0x0000000000090000-0x00000000000E6000-memory.dmp

      Filesize

      344KB

    • memory/1564-2-0x0000000000090000-0x00000000000E6000-memory.dmp

      Filesize

      344KB

    • memory/1564-15-0x0000000073E92000-0x0000000073E94000-memory.dmp

      Filesize

      8KB

    • memory/1564-21-0x0000000073E92000-0x0000000073E94000-memory.dmp

      Filesize

      8KB

    • memory/1564-11-0x0000000000090000-0x00000000000E6000-memory.dmp

      Filesize

      344KB

    • memory/1564-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1700-38-0x0000000000060000-0x00000000001E8000-memory.dmp

      Filesize

      1.5MB

    • memory/1700-50-0x0000000000060000-0x00000000001E8000-memory.dmp

      Filesize

      1.5MB

    • memory/1840-0-0x00000000010B0000-0x0000000001238000-memory.dmp

      Filesize

      1.5MB

    • memory/1840-14-0x00000000010B0000-0x0000000001238000-memory.dmp

      Filesize

      1.5MB

    • memory/1840-1-0x0000000000160000-0x0000000000161000-memory.dmp

      Filesize

      4KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.