Overview

overview

10

Static

static

1a577736a0...21.exe

windows7_x64

10

1a577736a0...21.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    209s
  • max time network
    230s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    08/06/2022, 03:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1a577736a0bb184745434ef6bf32af83b12eaf51e9d15d346841909afa242e21.exe

  • Size

    835KB

  • MD5

    0afb3a897b5b73b79c49fec0ffa5d768

  • SHA1

    51a256b8113d5652ce04f255386168f3e892ad8c

  • SHA256

    1a577736a0bb184745434ef6bf32af83b12eaf51e9d15d346841909afa242e21

  • SHA512

    8716c14a10bbb9181e879ad3d82324edad98c7374a0e57ef665a3dbcd6d4e6014d69c7d9cce8de159b91e1aeb62fb65bf77a8e4f0cf92571a069d6be6d4da6ae

Score
10/10
imminentspywaretrojan

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

    trojanspywareimminent
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a577736a0bb184745434ef6bf32af83b12eaf51e9d15d346841909afa242e21.exe
    "C:\Users\Admin\AppData\Local\Temp\1a577736a0bb184745434ef6bf32af83b12eaf51e9d15d346841909afa242e21.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Users\Admin\AppData\Local\Temp\1a577736a0bb184745434ef6bf32af83b12eaf51e9d15d346841909afa242e21.exe
      "C:\Users\Admin\AppData\Local\Temp\1a577736a0bb184745434ef6bf32af83b12eaf51e9d15d346841909afa242e21.exe"
      2⤵
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3044
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:5060

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3044-133-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

      Download

    • memory/3044-132-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

      Download

    • memory/3044-134-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

      Download

    • memory/3044-136-0x00000000746A0000-0x0000000074C51000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/3044-138-0x00000000746A0000-0x0000000074C51000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/4928-130-0x00000000746A0000-0x0000000074C51000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/4928-137-0x00000000746A0000-0x0000000074C51000-memory.dmp

      Filesize

      5.7MB

      Download