Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    25-11-2022 23:22

General

  • Target

    d170f7e9f87ae991688c4ae52d24a861addbf9ae3a776b5eaae1dbf78730daae.exe

  • Size

    273KB

  • MD5

    6943d9f15a9bade2400f2f5de929e1c5

  • SHA1

    03178f1d367b688a9859af292722de0abc4f416b

  • SHA256

    d170f7e9f87ae991688c4ae52d24a861addbf9ae3a776b5eaae1dbf78730daae

  • SHA512

    e13ef6432598c199ce0dcf0c5d95f9bfcc126e1c9c230190b0432d4ee88280b1701b8d6f042345e2a783e69e85ab6e3b47251b0915c498b7567ece01baba98bf

  • SSDEEP

    6144:VrclSNA8mH2P01sqByeWkYX447JxqJ//e+6+l4pC8X1p70ctlTf:VYT8mH2JcYX97Ly//eo/8X1pgIj

Score
10/10

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d170f7e9f87ae991688c4ae52d24a861addbf9ae3a776b5eaae1dbf78730daae.exe
    "C:\Users\Admin\AppData\Local\Temp\d170f7e9f87ae991688c4ae52d24a861addbf9ae3a776b5eaae1dbf78730daae.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/992-54-0x0000000076561000-0x0000000076563000-memory.dmp
    Filesize

    8KB

  • memory/992-55-0x0000000074AA0000-0x000000007504B000-memory.dmp
    Filesize

    5.7MB

  • memory/992-56-0x0000000074AA0000-0x000000007504B000-memory.dmp
    Filesize

    5.7MB