Analysis

  • max time kernel
    151s
  • max time network
    188s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12-06-2022 22:29

General

  • Target

    1e1394309a44fe57f7dc501902112987bf6a5d6a3e180758bfb1cd9928fe04fe.exe

  • Size

    574KB

  • MD5

    c567544f04e0e104ef71bf7ffd110629

  • SHA1

    d184d4d7b3fad6a8a014637d66d8ab52f0e516c1

  • SHA256

    1e1394309a44fe57f7dc501902112987bf6a5d6a3e180758bfb1cd9928fe04fe

  • SHA512

    c04616198f7c88070eb95fe965ccc8033b32d0dd9925b84cfd5489aa2d429cc4d8ce8b3c8b0b6abc2f52c9cdc8cf44b94021859f7bdef28a1a3461af8fcb7ebe

Score
10/10

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e1394309a44fe57f7dc501902112987bf6a5d6a3e180758bfb1cd9928fe04fe.exe
    "C:\Users\Admin\AppData\Local\Temp\1e1394309a44fe57f7dc501902112987bf6a5d6a3e180758bfb1cd9928fe04fe.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Users\Admin\AppData\Local\Temp\1e1394309a44fe57f7dc501902112987bf6a5d6a3e180758bfb1cd9928fe04fe.exe
      "{path}"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1116
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:2004

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/756-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

      Filesize

      8KB

    • memory/756-55-0x0000000074F10000-0x00000000754BB000-memory.dmp

      Filesize

      5.7MB

    • memory/756-68-0x0000000074F10000-0x00000000754BB000-memory.dmp

      Filesize

      5.7MB

    • memory/1116-61-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1116-59-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1116-60-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1116-57-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1116-62-0x0000000000451D3E-mapping.dmp

    • memory/1116-64-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1116-66-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1116-56-0x0000000000400000-0x0000000000456000-memory.dmp

      Filesize

      344KB

    • memory/1116-69-0x0000000074F10000-0x00000000754BB000-memory.dmp

      Filesize

      5.7MB

    • memory/1116-70-0x0000000074F10000-0x00000000754BB000-memory.dmp

      Filesize

      5.7MB