imminent | 3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e

Analysis

max time kernel
148s
max time network
182s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 17:32

Target

3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe
Size

374KB
MD5

6723039c71e423dbefe78960044d7863
SHA1

32687c57e32c7bba1276a48129cbc2c56b0052a2
SHA256

3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e
SHA512

8af094bf38a092798916c8c0cca0dc0e5b1e132003dcb2269050974ae614fccfbfeabfd0eb1380ebad6159193a55fc00b16fdd938918bb78e65354eb615d5d98
SSDEEP

6144:tVjuFAud6TbN+QerACcyIkBxhDRtmBkgiC6HyimWCQV2b2X5gYsXFw:tVjcd6Tb0N0TVkztmBvAL2b2JUFw

Score

10^/10

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 952	1976	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	28

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
952	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe
Token: SeDebugPrivilege	952	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
952	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 952	1976	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	28
PID 1976 wrote to memory of 952	1976	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	28
PID 1976 wrote to memory of 952	1976	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	28
PID 1976 wrote to memory of 952	1976	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	28
PID 1976 wrote to memory of 952	1976	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	28
PID 1976 wrote to memory of 952	1976	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	28
PID 1976 wrote to memory of 952	1976	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	28
PID 1976 wrote to memory of 952	1976	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	28
PID 1976 wrote to memory of 952	1976	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	28

memory/952-61-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/952-71-0x0000000074CE0000-0x000000007528B000-memory.dmp

Filesize
5.7MB

Download
memory/952-57-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/952-58-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/952-60-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/952-70-0x0000000074CE0000-0x000000007528B000-memory.dmp

Filesize
5.7MB

Download
memory/952-62-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/952-67-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/952-65-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1976-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1976-69-0x0000000074CE0000-0x000000007528B000-memory.dmp

Filesize
5.7MB

Download
memory/1976-55-0x0000000074CE0000-0x000000007528B000-memory.dmp

Filesize
5.7MB

Download
memory/1976-56-0x0000000074CE0000-0x000000007528B000-memory.dmp

Filesize
5.7MB

Download