Overview

overview

10

Static

static

e7c55d26b4...e1.exe

windows7-x64

10

e7c55d26b4...e1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 17:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e7c55d26b4b2539cd43065091b72cd5e66ea434ac364afc4662c59373537bae1.exe

  • Size

    360KB

  • MD5

    a9bc50fbbfd9cdac522d5329b32ffb79

  • SHA1

    bdc1f747d4c4a80a7f23908d14548cecc0eccdd4

  • SHA256

    e7c55d26b4b2539cd43065091b72cd5e66ea434ac364afc4662c59373537bae1

  • SHA512

    8ffee32a84f005b2cddc72837c28e3394cff310e6483f8e8ff18358a479e918a64c9c49dd6709da8bbe3d1fb2ea7709ec4b871256a53789ba6e6377c76f594b3

  • SSDEEP

    6144:kyuEhJdMU9ousBpW6t6VCjlDrarZoUIb+irtjzTUnPMq:PuEhJxShzW6gVCjkFrirtPTUP

Score
10/10
imminentspywaretrojan

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

    trojanspywareimminent
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e7c55d26b4b2539cd43065091b72cd5e66ea434ac364afc4662c59373537bae1.exe
    "C:\Users\Admin\AppData\Local\Temp\e7c55d26b4b2539cd43065091b72cd5e66ea434ac364afc4662c59373537bae1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1556
    • C:\Users\Admin\AppData\Local\Temp\e7c55d26b4b2539cd43065091b72cd5e66ea434ac364afc4662c59373537bae1.exe
      "C:\Users\Admin\AppData\Local\Temp\e7c55d26b4b2539cd43065091b72cd5e66ea434ac364afc4662c59373537bae1.exe"
      2⤵
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1556-132-0x0000000074F40000-0x00000000754F1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1556-133-0x0000000074F40000-0x00000000754F1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1556-136-0x0000000074F40000-0x00000000754F1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/5080-135-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

    Download

  • memory/5080-137-0x0000000074F40000-0x00000000754F1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/5080-138-0x0000000074F40000-0x00000000754F1000-memory.dmp

    Filesize

    5.7MB

    Download