imminent | 08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 17:04

Target

08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe
Size

365KB
MD5

c87e717ab8c0a67c9e5ac5b730f6cfef
SHA1

d370bf5bdbdfc8cfd1d012a3f6b69798861624b2
SHA256

08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa
SHA512

921e58067cbe2a589ac071c36160221ce57d96203c8f8305490d99291af7961d3647fbd66a933b887fcf3ebdc73b7061084e7762e001835abeaa2ebf8972d334
SSDEEP

6144:2kjfj2GZ1spU20rtnHf/VxV7bte6Y9qToVV4GR7HN/bYG/bKjPuxHhs1DJkOT:f2GZ1sebH3Vnsn9qcVV4QJv+jPuhhQJk

Score

10^/10

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2080 set thread context of 2412	2080	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe	86

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe
File opened for modification	C:\Windows\assembly	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe
File created	C:\Windows\assembly\Desktop.ini	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2412	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe
Token: SeDebugPrivilege	2412	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2412	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2412	2080	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe	86
PID 2080 wrote to memory of 2412	2080	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe	86
PID 2080 wrote to memory of 2412	2080	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe	86
PID 2080 wrote to memory of 2412	2080	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe	86
PID 2080 wrote to memory of 2412	2080	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe	86
PID 2080 wrote to memory of 2412	2080	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe	86
PID 2080 wrote to memory of 2412	2080	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe	86
PID 2080 wrote to memory of 2412	2080	08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe	86

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\08e47e936f449f68b069d46ab09ba1c663d8db03a5c8959704acc1321545e6aa.exe.log

Filesize
496B

MD5
cb76b18ebed3a9f05a14aed43d35fba6

SHA1
836a4b4e351846fca08b84149cb734cb59b8c0d6

SHA256
8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

SHA512
7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

Download Submit
memory/2080-132-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download
memory/2080-133-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download
memory/2080-137-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download
memory/2412-135-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2412-138-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download
memory/2412-139-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download