imminent | 3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e

Analysis

max time kernel
133s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 17:32

Target

3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe
Size

374KB
MD5

6723039c71e423dbefe78960044d7863
SHA1

32687c57e32c7bba1276a48129cbc2c56b0052a2
SHA256

3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e
SHA512

8af094bf38a092798916c8c0cca0dc0e5b1e132003dcb2269050974ae614fccfbfeabfd0eb1380ebad6159193a55fc00b16fdd938918bb78e65354eb615d5d98
SSDEEP

6144:tVjuFAud6TbN+QerACcyIkBxhDRtmBkgiC6HyimWCQV2b2X5gYsXFw:tVjcd6Tb0N0TVkztmBvAL2b2JUFw

Score

10^/10

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3868 set thread context of 1536	3868	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	82

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe
File opened for modification	C:\Windows\assembly	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1536	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3868	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe
Token: SeDebugPrivilege	1536	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1536	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 1536	3868	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	82
PID 3868 wrote to memory of 1536	3868	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	82
PID 3868 wrote to memory of 1536	3868	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	82
PID 3868 wrote to memory of 1536	3868	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	82
PID 3868 wrote to memory of 1536	3868	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	82
PID 3868 wrote to memory of 1536	3868	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	82
PID 3868 wrote to memory of 1536	3868	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	82
PID 3868 wrote to memory of 1536	3868	3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe	82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\3ecee2617185702e5a06621d2a6d7a17a9c416893cf12a752d6c51ecebf9398e.exe.log

Filesize
496B

MD5
cb76b18ebed3a9f05a14aed43d35fba6

SHA1
836a4b4e351846fca08b84149cb734cb59b8c0d6

SHA256
8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

SHA512
7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

Download Submit
memory/1536-135-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1536-138-0x0000000074750000-0x0000000074D01000-memory.dmp

Filesize
5.7MB

Download
memory/1536-139-0x0000000074750000-0x0000000074D01000-memory.dmp

Filesize
5.7MB

Download
memory/3868-132-0x0000000074750000-0x0000000074D01000-memory.dmp

Filesize
5.7MB

Download
memory/3868-133-0x0000000074750000-0x0000000074D01000-memory.dmp

Filesize
5.7MB

Download
memory/3868-137-0x0000000074750000-0x0000000074D01000-memory.dmp

Filesize
5.7MB

Download