imminent | 3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633 | Triage

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20220414-en
submitted
03-07-2022 16:40

Sharing

Report Analysis Logs

General

Target

3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe
Size

355KB
MD5

57f720eef1ca23cbe2c8c76d723dea2c
SHA1

909a7b18fcf642de26c69d9d5ebbc68a1289facb
SHA256

3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633
SHA512

597bbc4e272be0bab4e6001cda029f2f214bc33e8f8dd67e1bac73119badc170607a71ea17332a3993ab178f9f8155e452e7d644cf3c86a96b87ccab1b636f49

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
960	3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
960	3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe

C:\Users\Admin\AppData\Local\Temp\3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe
"C:\Users\Admin\AppData\Local\Temp\3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-54-0x0000000076571000-0x0000000076573000-memory.dmp

Filesize
8KB

Download
memory/960-55-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download
memory/960-56-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download