Analysis
-
max time kernel
146s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-11-2022 11:53
General
-
Target
a496aea476645af1b6540ec2a0ec1bdee7b6386bc06f07c6987e11728aa62edf.exe
-
Size
271KB
-
MD5
ed2da115bc010c70e0cf1b073379d1d0
-
SHA1
58c12070b7f8129016c723702af658f08bc99937
-
SHA256
a496aea476645af1b6540ec2a0ec1bdee7b6386bc06f07c6987e11728aa62edf
-
SHA512
654c022c98916573d680c0f108fe981db7956a6ef83f98a582ea1785a47b64bd5b7a203c9f4609bb2a4be242be7d598078d677c6748feeca114c58b88eabac7c
-
SSDEEP
6144:6x9p+Y7h/pHM7eBUrgbKj18T6ZkvepBkV6TesALFx1Qn5c2cctl7V:UF7h/SVf5HeABkV6ma5cXIB
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a496aea476645af1b6540ec2a0ec1bdee7b6386bc06f07c6987e11728aa62edf.exe"C:\Users\Admin\AppData\Local\Temp\a496aea476645af1b6540ec2a0ec1bdee7b6386bc06f07c6987e11728aa62edf.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB