imminent | 2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f | Triage

Analysis

max time kernel
152s
max time network
110s
platform
windows7_x64
resource
win7-20220414-en
submitted
21/06/2022, 19:31

Sharing

Report Analysis Logs

General

Target

2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe
Size

273KB
MD5

4c61f2bc69fa9a649e106e7f7157d4a8
SHA1

35b86ef56e1113887fb36f1a14884d6c6ff05573
SHA256

2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f
SHA512

b5eb6ffa7ce3bea7fd764b27dcc73542605b6baac29e238bd16ad105cfca222c036ee199f0eae2d5847ec50253b06a9a334b93cb95a180719409e069cff13958

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2040	2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2040	2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe

C:\Users\Admin\AppData\Local\Temp\2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe
"C:\Users\Admin\AppData\Local\Temp\2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/2040-55-0x0000000074720000-0x0000000074CCB000-memory.dmp

Filesize
5.7MB

Download
memory/2040-56-0x0000000074720000-0x0000000074CCB000-memory.dmp

Filesize
5.7MB

Download