imminent | 2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f | Triage

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21/06/2022, 19:31

Sharing

Report Analysis Logs

General

Target

2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe
Size

273KB
MD5

4c61f2bc69fa9a649e106e7f7157d4a8
SHA1

35b86ef56e1113887fb36f1a14884d6c6ff05573
SHA256

2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f
SHA512

b5eb6ffa7ce3bea7fd764b27dcc73542605b6baac29e238bd16ad105cfca222c036ee199f0eae2d5847ec50253b06a9a334b93cb95a180719409e069cff13958

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe
File created	C:\Windows\assembly\Desktop.ini	2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1964	2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1964	2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe

C:\Users\Admin\AppData\Local\Temp\2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe
"C:\Users\Admin\AppData\Local\Temp\2fab9ed1f70faf53129a073e35a50ca0d759ea49d1a9871da2340c426d0f3a2f.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-130-0x0000000074660000-0x0000000074C11000-memory.dmp

Filesize
5.7MB

Download
memory/1964-131-0x0000000074660000-0x0000000074C11000-memory.dmp

Filesize
5.7MB

Download