imminent | f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0

Analysis

max time kernel
140s
max time network
146s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 17:33

Target

f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0.exe
Size

363KB
MD5

e84f342a090732aec78b584c19f4e64c
SHA1

32af2c1be6b40d38bf36503c567c5fed82dc6db7
SHA256

f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0
SHA512

d2ca9cbd5d706c0395105761491bcde1aedfe7e2b50d2e530836c5e92a0ca6c407e9445589468b87b1e35983d2e1d06447345f0f1ff22691588b34f71e86c5a3
SSDEEP

6144:IA49Vopf6DwK2iXL1Jk7pOlkk9qrOeUZDHbDzHXbzXozxtzgNdvjDFH1G5LHICLC:IHVopfPaXLeOlkK0pwj3bzItszvjDF13

Score

10^/10

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 932	1640	f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0.exe	27

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
932	f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0.exe
Token: SeDebugPrivilege	932	f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
932	f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 932	1640	f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0.exe	27
PID 1640 wrote to memory of 932	1640	f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0.exe	27
PID 1640 wrote to memory of 932	1640	f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0.exe	27
PID 1640 wrote to memory of 932	1640	f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0.exe	27
PID 1640 wrote to memory of 932	1640	f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0.exe	27
PID 1640 wrote to memory of 932	1640	f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0.exe	27
PID 1640 wrote to memory of 932	1640	f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0.exe	27
PID 1640 wrote to memory of 932	1640	f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0.exe	27
PID 1640 wrote to memory of 932	1640	f5ddee064faafc1ff92e6c0d473dd1f85bfef7e2137b8cc62ae02d828a7373a0.exe	27

memory/932-62-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/932-71-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/932-57-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/932-58-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/932-61-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/932-70-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/932-60-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/932-67-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/932-65-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1640-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1640-69-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/1640-55-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/1640-56-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download