Analysis
-
max time kernel
165s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
25-11-2022 17:02
General
-
Target
a82609ea6c361908692aff359d2c629657e2b39f89c15dbe05d12e1d0bf8812d.exe
-
Size
367KB
-
MD5
bac911dc477269bc8deaa16a4b8d2b07
-
SHA1
0889238a0a5dc0f2f18c4cb51ae6c2e9634711d6
-
SHA256
a82609ea6c361908692aff359d2c629657e2b39f89c15dbe05d12e1d0bf8812d
-
SHA512
8bf085fcb38b799ee714de199039f060a1591216fd606deb2c02a5f2e9297d54d8eccbb23143037eb2c792f287148c68e4c09b1eb074e3a96ac0530da334495c
-
SSDEEP
6144:TMgFQPShgX2JkO362vyGZPI8ZWsvFAOn/UxKjvoyGjJ8PU+79bVQPp+xlyJwGj5n:jGPShgXcn6zmfZWsvJjgyG98PNno
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a82609ea6c361908692aff359d2c629657e2b39f89c15dbe05d12e1d0bf8812d.exe"C:\Users\Admin\AppData\Local\Temp\a82609ea6c361908692aff359d2c629657e2b39f89c15dbe05d12e1d0bf8812d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a82609ea6c361908692aff359d2c629657e2b39f89c15dbe05d12e1d0bf8812d.exe"C:\Users\Admin\AppData\Local\Temp\a82609ea6c361908692aff359d2c629657e2b39f89c15dbe05d12e1d0bf8812d.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB