Analysis
-
max time kernel
202s -
max time network
212s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
25-11-2022 17:48
General
-
Target
4ae269240f7ed879650cc359896acb13d99c53799826c387d42f8e5417b85215.exe
-
Size
360KB
-
MD5
66de3b9be28da2d2d26f95f4ab9d9510
-
SHA1
e2f7999d7270743434f3f354493e0607518f01b9
-
SHA256
4ae269240f7ed879650cc359896acb13d99c53799826c387d42f8e5417b85215
-
SHA512
3fb046ae26f7f6557e838605d8f20de588da97ea6c392554997a21a89745a3278dd3fbcb267348dd1683bdf5f6070d82f7c2e7051a215f316f73d0ee3701de6f
-
SSDEEP
6144:oUseQuDIxAs54xjRRFq2epbNCIGlIULuI1o2J32xv6cKAPMq:oOQuExFaVT/6bELlIULucBx2z
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ae269240f7ed879650cc359896acb13d99c53799826c387d42f8e5417b85215.exe"C:\Users\Admin\AppData\Local\Temp\4ae269240f7ed879650cc359896acb13d99c53799826c387d42f8e5417b85215.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4ae269240f7ed879650cc359896acb13d99c53799826c387d42f8e5417b85215.exe"C:\Users\Admin\AppData\Local\Temp\4ae269240f7ed879650cc359896acb13d99c53799826c387d42f8e5417b85215.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB