Analysis
-
max time kernel
178s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
25-11-2022 23:22
General
-
Target
d170f7e9f87ae991688c4ae52d24a861addbf9ae3a776b5eaae1dbf78730daae.exe
-
Size
273KB
-
MD5
6943d9f15a9bade2400f2f5de929e1c5
-
SHA1
03178f1d367b688a9859af292722de0abc4f416b
-
SHA256
d170f7e9f87ae991688c4ae52d24a861addbf9ae3a776b5eaae1dbf78730daae
-
SHA512
e13ef6432598c199ce0dcf0c5d95f9bfcc126e1c9c230190b0432d4ee88280b1701b8d6f042345e2a783e69e85ab6e3b47251b0915c498b7567ece01baba98bf
-
SSDEEP
6144:VrclSNA8mH2P01sqByeWkYX447JxqJ//e+6+l4pC8X1p70ctlTf:VYT8mH2JcYX97Ly//eo/8X1pgIj
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d170f7e9f87ae991688c4ae52d24a861addbf9ae3a776b5eaae1dbf78730daae.exe"C:\Users\Admin\AppData\Local\Temp\d170f7e9f87ae991688c4ae52d24a861addbf9ae3a776b5eaae1dbf78730daae.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2128-132-0x00000000748D0000-0x0000000074E81000-memory.dmpFilesize
5.7MB
-
memory/2128-133-0x00000000748D0000-0x0000000074E81000-memory.dmpFilesize
5.7MB