Analysis
-
max time kernel
188s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
25-11-2022 00:28
General
-
Target
66d0edeb120cfd683168489e9ea73c46d68ba7802d89155bb2b6ea9317a564d3.exe
-
Size
360KB
-
MD5
44efc9de6edc60517a544eb815a96688
-
SHA1
f5f4fda330c0551a0590fd265d9fe5ccaf6a2a8c
-
SHA256
66d0edeb120cfd683168489e9ea73c46d68ba7802d89155bb2b6ea9317a564d3
-
SHA512
3b6ca401816e1a27d80cd49b1f7dd48da959c422ac5d9af1c1b62976441fdbdc7b7edd153cc1b39c6b03c1bbce147c6ad38b4bec694ac0070bda75cf800443c1
-
SSDEEP
6144:TTj9GGl4KGYoD+AcO0fG7krC8NK9mkP3rhtWLXPMq:TPhlvroKM0J49fP96
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66d0edeb120cfd683168489e9ea73c46d68ba7802d89155bb2b6ea9317a564d3.exe"C:\Users\Admin\AppData\Local\Temp\66d0edeb120cfd683168489e9ea73c46d68ba7802d89155bb2b6ea9317a564d3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\66d0edeb120cfd683168489e9ea73c46d68ba7802d89155bb2b6ea9317a564d3.exe"C:\Users\Admin\AppData\Local\Temp\66d0edeb120cfd683168489e9ea73c46d68ba7802d89155bb2b6ea9317a564d3.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
5.7MB