imminent | 5da412b5aa207548d68fa0f885f3d84a724695068d2870e805620b2d1b73e3ae

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Installation/Dashboard.exe
Size

797KB
MD5

c6bceda41c1b91a41580266791040953
SHA1

71e6a1ae130d59544c6d5aa55d93f2c3f2a43ec9
SHA256

c00aee7d19d7b5c2ca9d010fb1880393355f94a68431a5b53e974522d503f43e
SHA512

13e59fb257bf0fa79d30c76cb62a3578314e6f4eb145bee63cda76a30682c9129c3330102d1cd50d39eb401966ba950cdf34c2dfee2e04d9356822b10ce162fb
SSDEEP

12288:eWeEpn1XaCGOntOyRxso93CVOp667avGD52:eK0CPhQG3CT6IGD5

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Dashboard.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation Dashboard.exe
Drops desktop.ini file(s) 2 IoCs

Processes:

Dashboard.exe

description ioc process

File created C:\Windows\assembly\Desktop.ini Dashboard.exe
File opened for modification C:\Windows\assembly\Desktop.ini Dashboard.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Dashboard.exe

description pid process target process

PID 3228 set thread context of 4796 3228 Dashboard.exe Dashboard.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Dashboard.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	Dashboard.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	Dashboard.exe

description	pid	process	target process
PID 3228 set thread context of 4796	3228	Dashboard.exe	Dashboard.exe

Drops file in Windows directory 3 IoCs

Processes:

Dashboard.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	Dashboard.exe
File created	C:\Windows\assembly\Desktop.ini	Dashboard.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	Dashboard.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4404 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Dashboard.exe

pid process

3228 Dashboard.exe
3228 Dashboard.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Dashboard.exe

pid process

4796 Dashboard.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Dashboard.exeDashboard.exe

description pid process

Token: SeDebugPrivilege 3228 Dashboard.exe
Token: SeDebugPrivilege 4796 Dashboard.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Dashboard.exe

pid process

4796 Dashboard.exe

pid	process
4404	schtasks.exe

pid	process
3228	Dashboard.exe
3228	Dashboard.exe

pid	process
4796	Dashboard.exe

description	pid	process
Token: SeDebugPrivilege	3228	Dashboard.exe
Token: SeDebugPrivilege	4796	Dashboard.exe

pid	process
4796	Dashboard.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Dashboard.exe

description	pid	process	target process
PID 3228 wrote to memory of 4404	3228	Dashboard.exe	schtasks.exe
PID 3228 wrote to memory of 4404	3228	Dashboard.exe	schtasks.exe
PID 3228 wrote to memory of 4404	3228	Dashboard.exe	schtasks.exe
PID 3228 wrote to memory of 4796	3228	Dashboard.exe	Dashboard.exe
PID 3228 wrote to memory of 4796	3228	Dashboard.exe	Dashboard.exe
PID 3228 wrote to memory of 4796	3228	Dashboard.exe	Dashboard.exe
PID 3228 wrote to memory of 4796	3228	Dashboard.exe	Dashboard.exe
PID 3228 wrote to memory of 4796	3228	Dashboard.exe	Dashboard.exe
PID 3228 wrote to memory of 4796	3228	Dashboard.exe	Dashboard.exe
PID 3228 wrote to memory of 4796	3228	Dashboard.exe	Dashboard.exe
PID 3228 wrote to memory of 4796	3228	Dashboard.exe	Dashboard.exe

C:\Users\Admin\AppData\Local\Temp\Installation\Dashboard.exe
"C:\Users\Admin\AppData\Local\Temp\Installation\Dashboard.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3228

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ybdSmleEklbl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFC71.tmp"
2⤵
- Creates scheduled task(s)
PID:4404

C:\Users\Admin\AppData\Local\Temp\Installation\Dashboard.exe
"C:\Users\Admin\AppData\Local\Temp\Installation\Dashboard.exe"
2⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4796

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Dashboard.exe.log
Filesize
408B

MD5
9357aeac30c60e6624d070a03e2e36a3

SHA1
d9f1d068b3f6b0dbd4cec72753c761a5efd8ba25

SHA256
154998d6f0471484664b21526bc884c78593aad632d0ee0f4b29ace1946026cf

SHA512
859c74948e8b6c6a3a23f09248177bff7ea6f6c5f6a331f075751a5f569845eb3d58c10e05935bfafd2fd73e5f3d0734aa6a9dce8380cc7d7023d6ca6f7d4c4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFC71.tmp
Filesize
1KB

MD5
22a5b5fae75d2c644c3a679150d61874

SHA1
3760070851dcb2bb0e03d593e8725499645c57af

SHA256
c0dd7edecf20f0407e382706e827acda4a0d5771b6954a7be0333fd0c5d76da7

SHA512
87c55375aac1702cf1a1605c4c54a57a703fd04c8acd0dca353fe1a0e1330f11c6a515d96f12f4608a0f8525e0b6edde415c4bd3018a1fef165a3ff492ad675d

Download Submit
memory/3228-0-0x0000000074D92000-0x0000000074D93000-memory.dmp

Filesize
4KB

Download
memory/3228-1-0x0000000074D90000-0x0000000075341000-memory.dmp

Filesize
5.7MB

Download
memory/3228-2-0x0000000074D90000-0x0000000075341000-memory.dmp

Filesize
5.7MB

Download
memory/3228-3-0x0000000074D92000-0x0000000074D93000-memory.dmp

Filesize
4KB

Download
memory/3228-4-0x0000000074D90000-0x0000000075341000-memory.dmp

Filesize
5.7MB

Download
memory/3228-13-0x0000000074D90000-0x0000000075341000-memory.dmp

Filesize
5.7MB

Download
memory/4796-15-0x0000000074D90000-0x0000000075341000-memory.dmp

Filesize
5.7MB

Download
memory/4796-29-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/4796-17-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/4796-16-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/4796-14-0x0000000074D90000-0x0000000075341000-memory.dmp

Filesize
5.7MB

Download
memory/4796-37-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/4796-35-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/4796-34-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/4796-32-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/4796-18-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/4796-28-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/4796-26-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/4796-24-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/4796-23-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/4796-22-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/4796-21-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/4796-19-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/4796-20-0x0000000074D90000-0x0000000075341000-memory.dmp

Filesize
5.7MB

Download
memory/4796-43-0x0000000074D90000-0x0000000075341000-memory.dmp

Filesize
5.7MB

Download