Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
25-11-2022 17:21
General
-
Target
ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe
-
Size
357KB
-
MD5
68b2d7330bbf95a56765203725ed3528
-
SHA1
a4ed390ef272f9053835ef18c08a40be53d99875
-
SHA256
ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4
-
SHA512
abef2247c8ec49916c79b32feeaf263606190ad5e3a7207f6a171cfab9a805bf0a708a13e825771005a28c838e5bc050b48e75bcb8a181d99d41fbefd3f8cd00
-
SSDEEP
6144:MnD692gEXOw2actpepRk4r2RNXOA2Vb3xblAXZgrulkd:SDctEXOwemjMNXYVbpMZgr9
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe"C:\Users\Admin\AppData\Local\Temp\ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe"C:\Users\Admin\AppData\Local\Temp\ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
5.7MB