imminent | 39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81

General

Target

39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81.exe
Size

452KB
MD5

58d8e45e2efdbbdd4e385eef528618c5
SHA1

ebc61fb36088873979b103cf0784655f419f92a3
SHA256

39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81
SHA512

6985214a0b3261e38d5b970768a6daf635975ee45199ba1f0d610b38d86cc512590c3908f85f4f6e141d61ad8a43d5c85ef05730c81b2eb625d5f3ace7aa581d

Score

10^/10

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 1576	1932	39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81.exe	27

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1576	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	RegAsm.exe
Token: 33	1576	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1576	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1576	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1576	1932	39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81.exe	27
PID 1932 wrote to memory of 1576	1932	39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81.exe	27
PID 1932 wrote to memory of 1576	1932	39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81.exe	27
PID 1932 wrote to memory of 1576	1932	39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81.exe	27
PID 1932 wrote to memory of 1576	1932	39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81.exe	27
PID 1932 wrote to memory of 1576	1932	39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81.exe	27
PID 1932 wrote to memory of 1576	1932	39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81.exe	27
PID 1932 wrote to memory of 1576	1932	39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81.exe	27
PID 1932 wrote to memory of 1576	1932	39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81.exe	27
PID 1932 wrote to memory of 1576	1932	39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81.exe	27
PID 1932 wrote to memory of 1576	1932	39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81.exe	27
PID 1932 wrote to memory of 1576	1932	39a8e99be721b0cf5e73c955f8ae71ed0f8695be2f56c46e0f33c6ffca9d3e81.exe	27

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:928

memory/1576-55-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1576-56-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1576-58-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1576-59-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1576-60-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1576-63-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1576-65-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1576-68-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/1576-69-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/1932-54-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/1932-67-0x00000000740E0000-0x000000007468B000-memory.dmp

Filesize
5.7MB

Download