imminent | bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335

Analysis

max time kernel
196s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 17:32

Target

bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe
Size

374KB
MD5

1d349bfb15bfeacedb29cb6aec238523
SHA1

41e87212a301d34867af430d25e37d770ff42866
SHA256

bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335
SHA512

7f0808cb82f7dabf40fcfa13836cac86ba452d736e70c686932fd2ca51c59d8eaf67ec85833dc399221a7d8e29c0718c7c7bfbee4317b70158a53e4e22367d38
SSDEEP

6144:kpap8BEPlo4WAJ68KifybrsOYT2oL1WPvqYsXFw:zmBENLWi68KiqbrPoLYOFw

Score

10^/10

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4260 set thread context of 3156	4260	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe	86

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe
File created	C:\Windows\assembly\Desktop.ini	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3156	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4260	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe
Token: SeDebugPrivilege	3156	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3156	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 3156	4260	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe	86
PID 4260 wrote to memory of 3156	4260	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe	86
PID 4260 wrote to memory of 3156	4260	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe	86
PID 4260 wrote to memory of 3156	4260	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe	86
PID 4260 wrote to memory of 3156	4260	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe	86
PID 4260 wrote to memory of 3156	4260	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe	86
PID 4260 wrote to memory of 3156	4260	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe	86
PID 4260 wrote to memory of 3156	4260	bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe	86

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\bfd632256a8506c3c588c12619baf8f6b63f663cf6acad1a606f912d610a7335.exe.log

Filesize
496B

MD5
cb76b18ebed3a9f05a14aed43d35fba6

SHA1
836a4b4e351846fca08b84149cb734cb59b8c0d6

SHA256
8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

SHA512
7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

Download Submit
memory/3156-136-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3156-139-0x0000000074710000-0x0000000074CC1000-memory.dmp

Filesize
5.7MB

Download
memory/3156-140-0x0000000074710000-0x0000000074CC1000-memory.dmp

Filesize
5.7MB

Download
memory/4260-133-0x0000000074710000-0x0000000074CC1000-memory.dmp

Filesize
5.7MB

Download
memory/4260-134-0x0000000074710000-0x0000000074CC1000-memory.dmp

Filesize
5.7MB

Download
memory/4260-138-0x0000000074710000-0x0000000074CC1000-memory.dmp

Filesize
5.7MB

Download