Analysis
-
max time kernel
157s -
max time network
219s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
25-11-2022 17:02
General
-
Target
a81d9fe3601981b6cd59d6781c651b1897a1b4c9481f1ae7160a45427a3dc590.exe
-
Size
366KB
-
MD5
b927af6dcc20ef96db5c8232195879d6
-
SHA1
db1c7218b260a71ae28af9c3605eae8b0383ae3a
-
SHA256
a81d9fe3601981b6cd59d6781c651b1897a1b4c9481f1ae7160a45427a3dc590
-
SHA512
8c19d6af9975ed0cf0d89f4ef2b787a3d9fb3a320f5a1c57663e9468254903558fde141da6125f171224c30ebe298cde2b1adad0e010b7c24e9f74727f8396ad
-
SSDEEP
6144:Xytl4s54G9qsVG8u+udBQnkB+hB5+bZinz3yLRrAJhEioQnGe6HG:XY6MgdBQnkB+T8yu6/oQN6H
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a81d9fe3601981b6cd59d6781c651b1897a1b4c9481f1ae7160a45427a3dc590.exe"C:\Users\Admin\AppData\Local\Temp\a81d9fe3601981b6cd59d6781c651b1897a1b4c9481f1ae7160a45427a3dc590.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a81d9fe3601981b6cd59d6781c651b1897a1b4c9481f1ae7160a45427a3dc590.exe"C:\Users\Admin\AppData\Local\Temp\a81d9fe3601981b6cd59d6781c651b1897a1b4c9481f1ae7160a45427a3dc590.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
8KB
-
Filesize
5.7MB