imminent | 5b1a883fc342ab1654912c119190f04771ae47477f1a006b932150129675134c

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3941105d7c81e962f92d2023da9ec9e6.exe
Size

580KB
MD5

3941105d7c81e962f92d2023da9ec9e6
SHA1

4046440a3417519401e23a0997d4c4a6d74a047b
SHA256

45f343e693bd7d3e4292206cd974ab4d06a353ffaf590afec19b1c01a2554802
SHA512

287e611104381367a7a4212ece8da1a6f3c68c86506b43d6721ab590ea89d42846cf77b58669fabdb69510f9b56a2d64c99378a4684ff1f379a529010e04dcdb
SSDEEP

12288:YbD5arFJwK6hMJ6ZzHFZfc28beMGTfZuqb7o:rBJwdhMJ6ZzHrfcsMGTfZ5Po

Score

10^/10

imminent discovery persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent
Imminent family
imminent

Executes dropped EXE 1 IoCs

pid	Process
3036	Webfrequency.exe

Loads dropped DLL 1 IoCs

pid	Process
1584	3941105d7c81e962f92d2023da9ec9e6.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\Webdevelop = "C:\\Users\\Admin\\AppData\\Roaming\\Webdevelop\\Webfrequency.exe"	3941105d7c81e962f92d2023da9ec9e6.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3036 set thread context of 1516	3036	Webfrequency.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3941105d7c81e962f92d2023da9ec9e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Webfrequency.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	RegAsm.exe
Token: 33	1516	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1516	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1516	RegAsm.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 3036	1584	3941105d7c81e962f92d2023da9ec9e6.exe	31
PID 1584 wrote to memory of 3036	1584	3941105d7c81e962f92d2023da9ec9e6.exe	31
PID 1584 wrote to memory of 3036	1584	3941105d7c81e962f92d2023da9ec9e6.exe	31
PID 1584 wrote to memory of 3036	1584	3941105d7c81e962f92d2023da9ec9e6.exe	31
PID 3036 wrote to memory of 1516	3036	Webfrequency.exe	32
PID 3036 wrote to memory of 1516	3036	Webfrequency.exe	32
PID 3036 wrote to memory of 1516	3036	Webfrequency.exe	32
PID 3036 wrote to memory of 1516	3036	Webfrequency.exe	32
PID 3036 wrote to memory of 1516	3036	Webfrequency.exe	32
PID 3036 wrote to memory of 1516	3036	Webfrequency.exe	32
PID 3036 wrote to memory of 1516	3036	Webfrequency.exe	32
PID 3036 wrote to memory of 1516	3036	Webfrequency.exe	32
PID 3036 wrote to memory of 1516	3036	Webfrequency.exe	32
PID 3036 wrote to memory of 1516	3036	Webfrequency.exe	32
PID 3036 wrote to memory of 1516	3036	Webfrequency.exe	32
PID 3036 wrote to memory of 1516	3036	Webfrequency.exe	32

C:\Users\Admin\AppData\Local\Temp\3941105d7c81e962f92d2023da9ec9e6.exe
"C:\Users\Admin\AppData\Local\Temp\3941105d7c81e962f92d2023da9ec9e6.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe
  "C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1516

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe

Filesize
580KB

MD5
160c77f712002018e8bb3b47fd76201a

SHA1
ce4618455c030cd1cf31ff36cad7479d81e1b169

SHA256
ea5b2aa316a701a7f61757badb34cbc7634b2ab791984c9c0f3fa657a72351f8

SHA512
36dfd999c51709d0576deae591535931541d3d2b5b91d04caede67fb04324d0b015d2dbb6186953723fdcbc0a82e7e5501efa1fd59d4531fbe62fa3cce9a2ee0

Download Submit
memory/1516-24-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1516-30-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1516-36-0x00000000009E0000-0x00000000009F6000-memory.dmp

Filesize
88KB

Download
memory/1516-35-0x0000000000460000-0x0000000000488000-memory.dmp

Filesize
160KB

Download
memory/1516-22-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1516-33-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/1516-28-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1516-32-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1516-25-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1516-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1516-20-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1516-34-0x0000000001210000-0x00000000012BE000-memory.dmp

Filesize
696KB

Download
memory/1584-5-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/1584-14-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/1584-3-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/1584-2-0x00000000005C0000-0x00000000005CA000-memory.dmp

Filesize
40KB

Download
memory/1584-1-0x0000000000310000-0x00000000003A4000-memory.dmp

Filesize
592KB

Download
memory/1584-0-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

Filesize
4KB

Download
memory/1584-4-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

Filesize
4KB

Download
memory/3036-19-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-18-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-17-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-16-0x0000000000CB0000-0x0000000000D44000-memory.dmp

Filesize
592KB

Download
memory/3036-15-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-37-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads