Analysis
-
max time kernel
219s -
max time network
309s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
24-11-2022 20:07
General
-
Target
bad1f74b34f725e70334afe75aef7d080079bfd572903bb1c8dd1f5fee7a3266.exe
-
Size
369KB
-
MD5
c68248c714a8848d6835aa7e722f3efc
-
SHA1
76c1e13d6137940726d5ef9e163208158757fbf5
-
SHA256
bad1f74b34f725e70334afe75aef7d080079bfd572903bb1c8dd1f5fee7a3266
-
SHA512
3449dc734ba965dbb290d13a04427ff0a3f4ba0e0d0738759ee99a8bb9b3d8fca7fa54b0bf6c091207994c973d7e802627ca84807c6acda6507a297cd9992b2f
-
SSDEEP
6144:A3lbAOjwo9JmeZEsqZTeLShiZzZ54OD5pzCVuetU2M:A1bvwNeZEdTPA0ODTz4uetx
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bad1f74b34f725e70334afe75aef7d080079bfd572903bb1c8dd1f5fee7a3266.exe"C:\Users\Admin\AppData\Local\Temp\bad1f74b34f725e70334afe75aef7d080079bfd572903bb1c8dd1f5fee7a3266.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bad1f74b34f725e70334afe75aef7d080079bfd572903bb1c8dd1f5fee7a3266.exe"C:\Users\Admin\AppData\Local\Temp\bad1f74b34f725e70334afe75aef7d080079bfd572903bb1c8dd1f5fee7a3266.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB