imminent | d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed

Analysis

max time kernel
154s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 11:27

Target

d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe
Size

356KB
MD5

d76ce9c8be6e1ea3456657ef0be28560
SHA1

1037941781b3bf339eaa4308b7858eb8cfc8b5e6
SHA256

d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed
SHA512

111a14f24ff9f7515c9e6119c25de24e99e058deaf9590421a566671978b74f9cad4a1edf8fc236f5ec16ac812867317daa20d4ad4c3a98110de960147232c5c
SSDEEP

6144:zLoVTnO0gDG81tPmdDJnpnew51EN/2k4lnJX/WzyhozzBWzhoSp4UtnljuHrJ:PoVTO0giEID9lew5UOk4lJPWzyhoZWha

Score

10^/10

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 3284	4460	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe	82

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe
File created	C:\Windows\assembly\Desktop.ini	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3284	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe
Token: SeDebugPrivilege	3284	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3284	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 3284	4460	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe	82
PID 4460 wrote to memory of 3284	4460	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe	82
PID 4460 wrote to memory of 3284	4460	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe	82
PID 4460 wrote to memory of 3284	4460	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe	82
PID 4460 wrote to memory of 3284	4460	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe	82
PID 4460 wrote to memory of 3284	4460	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe	82
PID 4460 wrote to memory of 3284	4460	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe	82
PID 4460 wrote to memory of 3284	4460	d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe	82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\d989c364f26257ea7054db436ddd741fed02beb08c18774397fdb0fa6d3429ed.exe.log

Filesize
607B

MD5
f7ad994488d67d114896eb2b00df518b

SHA1
c7889ecb59e9a6cc4a30c900bba199b65a3d1be6

SHA256
11528062b8a5c775ecc682c7923384b34d9d74bb38473615550b50748b434a3b

SHA512
ee1faba797120cdda67872d422b0aa5bc47cd1760b65fd9d6940eb877d6826c30a8a1e40fd91d0dd63e736a019200c47a1dd6479732509380fb4b7420edb8ba3

Download Submit
memory/3284-135-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3284-138-0x0000000074E40000-0x00000000753F1000-memory.dmp

Filesize
5.7MB

Download
memory/3284-139-0x0000000074E40000-0x00000000753F1000-memory.dmp

Filesize
5.7MB

Download
memory/4460-132-0x0000000074E40000-0x00000000753F1000-memory.dmp

Filesize
5.7MB

Download
memory/4460-133-0x0000000074E40000-0x00000000753F1000-memory.dmp

Filesize
5.7MB

Download
memory/4460-137-0x0000000074E40000-0x00000000753F1000-memory.dmp

Filesize
5.7MB

Download