Analysis
-
max time kernel
165s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24-11-2022 20:05
General
-
Target
bb79ba3ae3ea4f63d06f5949c207ba98ba49680fcf08175073b712349b471ce3.exe
-
Size
360KB
-
MD5
05913e5289fc594fa0310c18ea3bf5ea
-
SHA1
ac22cfda659d5b3b82ae722a80267e98c783bace
-
SHA256
bb79ba3ae3ea4f63d06f5949c207ba98ba49680fcf08175073b712349b471ce3
-
SHA512
9eaf659a3a716d1c1d7749806fb7f05e5ce9dd9d73e39ff7e39141f9adb0423faddc36a361cc43942561919bd74dbf11a531c1252ce2b5ce64ed68dd8f36e468
-
SSDEEP
6144:FxRJhefWh/iWtRrDYETct/ph68Gpfz4t/riXBfuBdAPMq:hJtRr8XH6D741OxGvI
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb79ba3ae3ea4f63d06f5949c207ba98ba49680fcf08175073b712349b471ce3.exe"C:\Users\Admin\AppData\Local\Temp\bb79ba3ae3ea4f63d06f5949c207ba98ba49680fcf08175073b712349b471ce3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bb79ba3ae3ea4f63d06f5949c207ba98ba49680fcf08175073b712349b471ce3.exe"C:\Users\Admin\AppData\Local\Temp\bb79ba3ae3ea4f63d06f5949c207ba98ba49680fcf08175073b712349b471ce3.exe"2⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
5.7MB