imminent | 895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903

Analysis

max time kernel
151s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 04:24

Target

895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903.exe
Size

627KB
MD5

e5f41562d59a11ac96654c2f7888259f
SHA1

9effc4e509adce2fd0317e919aab0d4711a0a128
SHA256

895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903
SHA512

328119b0539ba9d65ca8fec87d3625f429ec1766645dd1f68bc4742c9563b548def09bc6574d8442ea8ae8a64bfda3ab764796d967edb4266ff22bf2e4107a69
SSDEEP

6144:LBfFq9EHw/p8nhmrzKicsdiXtkYbrtmD01tgNRDXHdFRBYo2uqtgUJLLLLLLLLLL:LBd8capNepztkimIT29HdFRBYoYgU

Score

10^/10

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1968 set thread context of 1760	1968	895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903.exe	27

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1760	895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903.exe
Token: SeDebugPrivilege	1760	895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1760	895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1760	1968	895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903.exe	27
PID 1968 wrote to memory of 1760	1968	895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903.exe	27
PID 1968 wrote to memory of 1760	1968	895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903.exe	27
PID 1968 wrote to memory of 1760	1968	895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903.exe	27
PID 1968 wrote to memory of 1760	1968	895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903.exe	27
PID 1968 wrote to memory of 1760	1968	895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903.exe	27
PID 1968 wrote to memory of 1760	1968	895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903.exe	27
PID 1968 wrote to memory of 1760	1968	895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903.exe	27
PID 1968 wrote to memory of 1760	1968	895fc09741db00a78e931aba1ebe9af803d005d9bb4930639c207e3c76947903.exe	27

memory/1760-61-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/1760-69-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/1760-76-0x00000000742C0000-0x000000007486B000-memory.dmp

Filesize
5.7MB

Download
memory/1760-57-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/1760-58-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/1760-60-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/1760-75-0x00000000742C0000-0x000000007486B000-memory.dmp

Filesize
5.7MB

Download
memory/1760-65-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/1760-72-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/1760-64-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/1968-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1968-74-0x00000000742C0000-0x000000007486B000-memory.dmp

Filesize
5.7MB

Download
memory/1968-55-0x00000000742C0000-0x000000007486B000-memory.dmp

Filesize
5.7MB

Download
memory/1968-56-0x00000000742C0000-0x000000007486B000-memory.dmp

Filesize
5.7MB

Download