Analysis
-
max time kernel
171s -
max time network
186s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
25-11-2022 03:17
General
-
Target
2eb9887dc649408a645ccc57dea01aca4230f7fa0bc47e30a0d7d55cff93fe9f.exe
-
Size
357KB
-
MD5
80dd03f508003c60443bd5e1bd6eaeeb
-
SHA1
17abf8151a75aa86fd5dcf480f4924899c2949c4
-
SHA256
2eb9887dc649408a645ccc57dea01aca4230f7fa0bc47e30a0d7d55cff93fe9f
-
SHA512
ec3eb7a37eb307fa78176b5978f2e611a150546c2b4ed550560aee2a102bdf35ede6d0e091523e4885853e2faee17ff6c29e01c49d8487400aeb0fd92c7fbd26
-
SSDEEP
6144:PiBmh+e3nsEgl71xN+4JbSyxF3pFOAG+mtAfQ0gyF0v8HZB9Ih0LPJ2tPHQtmAx:Pvkl7VdVSoF3p0H+hfQ0gG0wD9I4BwPM
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eb9887dc649408a645ccc57dea01aca4230f7fa0bc47e30a0d7d55cff93fe9f.exe"C:\Users\Admin\AppData\Local\Temp\2eb9887dc649408a645ccc57dea01aca4230f7fa0bc47e30a0d7d55cff93fe9f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2eb9887dc649408a645ccc57dea01aca4230f7fa0bc47e30a0d7d55cff93fe9f.exe"C:\Users\Admin\AppData\Local\Temp\2eb9887dc649408a645ccc57dea01aca4230f7fa0bc47e30a0d7d55cff93fe9f.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB