Analysis
-
max time kernel
151s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
26-11-2022 01:46
General
-
Target
8c6248232f3baf7fa15858674b0dabcd2da039ecfb20221b4e3c1d7142ba1e5b.exe
-
Size
541KB
-
MD5
f692c41c0fc7101bfcf92d0672b51390
-
SHA1
f1ab2395241709115a3aab1cbddb14893f86ff22
-
SHA256
8c6248232f3baf7fa15858674b0dabcd2da039ecfb20221b4e3c1d7142ba1e5b
-
SHA512
9badc4051654f8d8e3f0ea808969b0ee70519825737fbb5835a3f28e43e1427c1b87a6aa1672859b6ecb60917c0f74cef4f4d4839d3c3b2988fd7fc9c6789a01
-
SSDEEP
12288:GLqXFm5azVB/YTVUWu0MGAtm8d37DGrTaGqKY:GmU5azVBgTVUGAkEHBV
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Drops file in Drivers directory 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c6248232f3baf7fa15858674b0dabcd2da039ecfb20221b4e3c1d7142ba1e5b.exe"C:\Users\Admin\AppData\Local\Temp\8c6248232f3baf7fa15858674b0dabcd2da039ecfb20221b4e3c1d7142ba1e5b.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
68KB
-
Filesize
68KB