imminent | 5da412b5aa207548d68fa0f885f3d84a724695068d2870e805620b2d1b73e3ae

Analysis

max time kernel
138s
max time network
148s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Installation/Dashboard.exe
Size

797KB
MD5

c6bceda41c1b91a41580266791040953
SHA1

71e6a1ae130d59544c6d5aa55d93f2c3f2a43ec9
SHA256

c00aee7d19d7b5c2ca9d010fb1880393355f94a68431a5b53e974522d503f43e
SHA512

13e59fb257bf0fa79d30c76cb62a3578314e6f4eb145bee63cda76a30682c9129c3330102d1cd50d39eb401966ba950cdf34c2dfee2e04d9356822b10ce162fb
SSDEEP

12288:eWeEpn1XaCGOntOyRxso93CVOp667avGD52:eK0CPhQG3CT6IGD5

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent
Suspicious use of SetThreadContext 1 IoCs

Processes:

Dashboard.exe

description pid process target process

PID 2920 set thread context of 2420 2920 Dashboard.exe Dashboard.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2716 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Dashboard.exe

pid process

2920 Dashboard.exe
2920 Dashboard.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Dashboard.exe

pid process

2420 Dashboard.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Dashboard.exeDashboard.exe

description pid process

Token: SeDebugPrivilege 2920 Dashboard.exe
Token: SeDebugPrivilege 2420 Dashboard.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Dashboard.exe

pid process

2420 Dashboard.exe

description	pid	process	target process
PID 2920 set thread context of 2420	2920	Dashboard.exe	Dashboard.exe

pid	process
2716	schtasks.exe

pid	process
2920	Dashboard.exe
2920	Dashboard.exe

pid	process
2420	Dashboard.exe

description	pid	process
Token: SeDebugPrivilege	2920	Dashboard.exe
Token: SeDebugPrivilege	2420	Dashboard.exe

pid	process
2420	Dashboard.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Dashboard.exe

description	pid	process	target process
PID 2920 wrote to memory of 2716	2920	Dashboard.exe	schtasks.exe
PID 2920 wrote to memory of 2716	2920	Dashboard.exe	schtasks.exe
PID 2920 wrote to memory of 2716	2920	Dashboard.exe	schtasks.exe
PID 2920 wrote to memory of 2716	2920	Dashboard.exe	schtasks.exe
PID 2920 wrote to memory of 2420	2920	Dashboard.exe	Dashboard.exe
PID 2920 wrote to memory of 2420	2920	Dashboard.exe	Dashboard.exe
PID 2920 wrote to memory of 2420	2920	Dashboard.exe	Dashboard.exe
PID 2920 wrote to memory of 2420	2920	Dashboard.exe	Dashboard.exe
PID 2920 wrote to memory of 2420	2920	Dashboard.exe	Dashboard.exe
PID 2920 wrote to memory of 2420	2920	Dashboard.exe	Dashboard.exe
PID 2920 wrote to memory of 2420	2920	Dashboard.exe	Dashboard.exe
PID 2920 wrote to memory of 2420	2920	Dashboard.exe	Dashboard.exe
PID 2920 wrote to memory of 2420	2920	Dashboard.exe	Dashboard.exe

C:\Users\Admin\AppData\Local\Temp\Installation\Dashboard.exe
"C:\Users\Admin\AppData\Local\Temp\Installation\Dashboard.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ybdSmleEklbl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDD16.tmp"
2⤵
- Creates scheduled task(s)
PID:2716

C:\Users\Admin\AppData\Local\Temp\Installation\Dashboard.exe
"C:\Users\Admin\AppData\Local\Temp\Installation\Dashboard.exe"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2420

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpDD16.tmp
Filesize
1KB

MD5
0005d0262dd86da96bdc7e37137db6e6

SHA1
96c7bcf80880e9680e91b267ff6d24e0e500a2df

SHA256
f522b086aa0da995ad06c384e394a56ebc60240cbb3dbc6c4ff959a8bcb2cc30

SHA512
5e026253c49b3945b5e5def707513cbc01c48a427d25a77ab380d72b76897efafd99d6e4ebb37114a974dae4c7bc1dc28cf28d595567b29b04e885711fcf1275

Download Submit
memory/2420-11-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-27-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-41-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-48-0x00000000743A0000-0x000000007494B000-memory.dmp

Filesize
5.7MB

Download
memory/2420-44-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-21-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-19-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-23-0x00000000743A0000-0x000000007494B000-memory.dmp

Filesize
5.7MB

Download
memory/2420-29-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-17-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2420-42-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-13-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-30-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-31-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-9-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-14-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-39-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-36-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-35-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-33-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-28-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-25-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2420-26-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2920-2-0x00000000743A0000-0x000000007494B000-memory.dmp

Filesize
5.7MB

Download
memory/2920-3-0x00000000743A0000-0x000000007494B000-memory.dmp

Filesize
5.7MB

Download
memory/2920-0-0x00000000743A1000-0x00000000743A2000-memory.dmp

Filesize
4KB

Download
memory/2920-22-0x00000000743A0000-0x000000007494B000-memory.dmp

Filesize
5.7MB

Download
memory/2920-1-0x00000000743A0000-0x000000007494B000-memory.dmp

Filesize
5.7MB

Download