Analysis
-
max time kernel
203s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08/06/2022, 03:34
General
-
Target
1a577736a0bb184745434ef6bf32af83b12eaf51e9d15d346841909afa242e21.exe
-
Size
835KB
-
MD5
0afb3a897b5b73b79c49fec0ffa5d768
-
SHA1
51a256b8113d5652ce04f255386168f3e892ad8c
-
SHA256
1a577736a0bb184745434ef6bf32af83b12eaf51e9d15d346841909afa242e21
-
SHA512
8716c14a10bbb9181e879ad3d82324edad98c7374a0e57ef665a3dbcd6d4e6014d69c7d9cce8de159b91e1aeb62fb65bf77a8e4f0cf92571a069d6be6d4da6ae
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a577736a0bb184745434ef6bf32af83b12eaf51e9d15d346841909afa242e21.exe"C:\Users\Admin\AppData\Local\Temp\1a577736a0bb184745434ef6bf32af83b12eaf51e9d15d346841909afa242e21.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1a577736a0bb184745434ef6bf32af83b12eaf51e9d15d346841909afa242e21.exe"C:\Users\Admin\AppData\Local\Temp\1a577736a0bb184745434ef6bf32af83b12eaf51e9d15d346841909afa242e21.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
5.7MB
-
Filesize
5.7MB