imminent | ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 17:21

Target

ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe
Size

357KB
MD5

68b2d7330bbf95a56765203725ed3528
SHA1

a4ed390ef272f9053835ef18c08a40be53d99875
SHA256

ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4
SHA512

abef2247c8ec49916c79b32feeaf263606190ad5e3a7207f6a171cfab9a805bf0a708a13e825771005a28c838e5bc050b48e75bcb8a181d99d41fbefd3f8cd00
SSDEEP

6144:MnD692gEXOw2actpepRk4r2RNXOA2Vb3xblAXZgrulkd:SDctEXOwemjMNXYVbpMZgr9

Score

10^/10

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4356 set thread context of 4136	4356	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe	84

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe
File created	C:\Windows\assembly\Desktop.ini	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4136	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe
Token: SeDebugPrivilege	4136	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4136	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 4136	4356	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe	84
PID 4356 wrote to memory of 4136	4356	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe	84
PID 4356 wrote to memory of 4136	4356	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe	84
PID 4356 wrote to memory of 4136	4356	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe	84
PID 4356 wrote to memory of 4136	4356	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe	84
PID 4356 wrote to memory of 4136	4356	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe	84
PID 4356 wrote to memory of 4136	4356	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe	84
PID 4356 wrote to memory of 4136	4356	ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe	84

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\ed526f89ed5a4820c928766ae6ab385385ab1e151028657315b3502d427406f4.exe.log

Filesize
496B

MD5
cb76b18ebed3a9f05a14aed43d35fba6

SHA1
836a4b4e351846fca08b84149cb734cb59b8c0d6

SHA256
8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

SHA512
7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

Download Submit
memory/4136-135-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4136-138-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/4136-139-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/4356-132-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/4356-133-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/4356-137-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download