imminent | e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87

Analysis

max time kernel
138s
max time network
148s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 17:45

Target

e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87.exe
Size

357KB
MD5

5d33a85ccd32c26cea63271d7d497699
SHA1

48390a5adfdba3b019f6ae4e26244e69fcf3e7df
SHA256

e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87
SHA512

2a8120747b3a9de486749f9c51cd1143040729d3081cc5004c7d328091953e9b0cea2f2682e19f8246526548c84ffecc603fe05053b2e16bc0a21a832c74d9a2
SSDEEP

6144:DOkup+5C3nhWVKktZDsb2ia/ANgzo8Ts2Bjl9sIWZgSSBUIxnvGHg1kDv7xrfUL:DjupKC3cgOZwbUYGz3sYlmBI/cg1kXGL

Score

10^/10

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1204 set thread context of 1464	1204	e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87.exe	27

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1464	e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87.exe
Token: SeDebugPrivilege	1464	e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1464	e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1464	1204	e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87.exe	27
PID 1204 wrote to memory of 1464	1204	e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87.exe	27
PID 1204 wrote to memory of 1464	1204	e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87.exe	27
PID 1204 wrote to memory of 1464	1204	e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87.exe	27
PID 1204 wrote to memory of 1464	1204	e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87.exe	27
PID 1204 wrote to memory of 1464	1204	e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87.exe	27
PID 1204 wrote to memory of 1464	1204	e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87.exe	27
PID 1204 wrote to memory of 1464	1204	e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87.exe	27
PID 1204 wrote to memory of 1464	1204	e54c74deca5eeff06fccd04fb65ce844c85c99e3c04edac8e84af3d2484e7e87.exe	27

memory/1204-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1204-55-0x0000000074030000-0x00000000745DB000-memory.dmp

Filesize
5.7MB

Download
memory/1204-56-0x0000000074030000-0x00000000745DB000-memory.dmp

Filesize
5.7MB

Download
memory/1204-69-0x0000000074030000-0x00000000745DB000-memory.dmp

Filesize
5.7MB

Download
memory/1464-61-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1464-60-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1464-58-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1464-62-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1464-65-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1464-67-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1464-57-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1464-70-0x0000000074030000-0x00000000745DB000-memory.dmp

Filesize
5.7MB

Download
memory/1464-71-0x0000000074030000-0x00000000745DB000-memory.dmp

Filesize
5.7MB

Download