imminent | 9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 22:14

Target

9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe
Size

344KB
MD5

e40784ebb640a84d7e6125118e6b8502
SHA1

3d1d2b7d6cfda0b6b13e1376f68adb969ccd13e6
SHA256

9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4
SHA512

69302c11b46edafca59572f1292fb83b9c627ab9b8928922b4ae79754f0873f4f37f3ecf8d2bb472b591d89256189df075b11cf1cb8d767e1f0bedc43ade9baf
SSDEEP

6144:ULwspYdj+0vv7Jj32kKCl9fQ7bfs0shi8vYzQWxPM8:f3jNvvbKKyPfss8vmdxPM

Score

10^/10

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2268 set thread context of 2100	2268	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe	83

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe
File created	C:\Windows\assembly\Desktop.ini	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2100	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe
Token: SeDebugPrivilege	2100	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2100	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2100	2268	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe	83
PID 2268 wrote to memory of 2100	2268	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe	83
PID 2268 wrote to memory of 2100	2268	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe	83
PID 2268 wrote to memory of 2100	2268	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe	83
PID 2268 wrote to memory of 2100	2268	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe	83
PID 2268 wrote to memory of 2100	2268	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe	83
PID 2268 wrote to memory of 2100	2268	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe	83
PID 2268 wrote to memory of 2100	2268	9158941a7304e6a5781097bf6f6ffaf469ac493c22025ede3726f534a1da91c4.exe	83

memory/2100-135-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2100-137-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/2100-138-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/2268-132-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/2268-133-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/2268-136-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download