Analysis
-
max time kernel
143s -
max time network
176s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
24-11-2022 22:14
General
-
Target
9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe
-
Size
344KB
-
MD5
e40784ebb640a84d7e6125118e6b8502
-
SHA1
3d1d2b7d6cfda0b6b13e1376f68adb969ccd13e6
-
SHA256
9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4
-
SHA512
69302c11b46edafca59572f1292fb83b9c627ab9b8928922b4ae79754f0873f4f37f3ecf8d2bb472b591d89256189df075b11cf1cb8d767e1f0bedc43ade9baf
-
SSDEEP
6144:ULwspYdj+0vv7Jj32kKCl9fQ7bfs0shi8vYzQWxPM8:f3jNvvbKKyPfss8vmdxPM
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe"C:\Users\Admin\AppData\Local\Temp\9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe"C:\Users\Admin\AppData\Local\Temp\9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB