Analysis
-
max time kernel
152s -
max time network
200s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
24-11-2022 23:37
General
-
Target
76cb03a9a091fabd9fd2041995be05632c35d6e3abb2e565e0e71d146ee70f3d.exe
-
Size
382KB
-
MD5
2930929e3286acd152f2512d2039e61e
-
SHA1
809896ab8f25aca7b34c7572378bbdcec6e5f2ab
-
SHA256
76cb03a9a091fabd9fd2041995be05632c35d6e3abb2e565e0e71d146ee70f3d
-
SHA512
16cbb50f18cb7da8541b6f3f004b2cb2211b737d16a0a71e9a26570f67a3f082568c23ce699970789a3248dd298b9a1732fad03a4dbdad3a5dadb64a2daf1b7c
-
SSDEEP
6144:sEttWuDwUinv7V7c5OSOU3nNrifnzl8rDsMpRc7fRXLAks+E91ErkeMs7:sBbjvRI5Ou3Nrsnz+r7RqhLxI1Erd7
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\76cb03a9a091fabd9fd2041995be05632c35d6e3abb2e565e0e71d146ee70f3d.exe"C:\Users\Admin\AppData\Local\Temp\76cb03a9a091fabd9fd2041995be05632c35d6e3abb2e565e0e71d146ee70f3d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\76cb03a9a091fabd9fd2041995be05632c35d6e3abb2e565e0e71d146ee70f3d.exe"C:\Users\Admin\AppData\Local\Temp\76cb03a9a091fabd9fd2041995be05632c35d6e3abb2e565e0e71d146ee70f3d.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB