imminent | 3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633 | Triage

Analysis

max time kernel
130s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-07-2022 16:40

Sharing

Report Analysis Logs

General

Target

3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe
Size

355KB
MD5

57f720eef1ca23cbe2c8c76d723dea2c
SHA1

909a7b18fcf642de26c69d9d5ebbc68a1289facb
SHA256

3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633
SHA512

597bbc4e272be0bab4e6001cda029f2f214bc33e8f8dd67e1bac73119badc170607a71ea17332a3993ab178f9f8155e452e7d644cf3c86a96b87ccab1b636f49

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe
File created	C:\Windows\assembly\Desktop.ini	3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2612	3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2612	3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2612	3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe

C:\Users\Admin\AppData\Local\Temp\3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe
"C:\Users\Admin\AppData\Local\Temp\3b5ea011e10d7359c4491366b2bf74ab10f75b4773e000923ad2d734a05b5633.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2612-130-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/2612-131-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download