Analysis
-
max time kernel
167s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
21-11-2022 23:25
General
-
Target
c68f4298603a06d4dddf276c97b1bd3f87387b63d34d11d18fce8f355013e34c.exe
-
Size
396KB
-
MD5
9b5e2f7cc7a58810e87c12061cfcf919
-
SHA1
8d286513240b480d65d759a6cc796177b7d20f86
-
SHA256
c68f4298603a06d4dddf276c97b1bd3f87387b63d34d11d18fce8f355013e34c
-
SHA512
de0467e5877a2ff1ec6983a83b46551a7b7120025ff53ffd3161c67db1140fa57e0fc71c5aa2eb8555a740068dd5e34fc8f3b064dd100e5ccc8b1acfc4dd1163
-
SSDEEP
6144:BOcSQuH8u2/aCWWNpcUJMSzx0gfL/POgubJoa/58uKN9Vsa21OeEgF:BOcEcuuae6UpxL/2j0uK1samOeL
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c68f4298603a06d4dddf276c97b1bd3f87387b63d34d11d18fce8f355013e34c.exe"C:\Users\Admin\AppData\Local\Temp\c68f4298603a06d4dddf276c97b1bd3f87387b63d34d11d18fce8f355013e34c.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
-
Filesize
5.7MB