Analysis
-
max time kernel
141s -
max time network
189s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
27-11-2022 01:22
General
-
Target
ff679525cf9498daebda1da378886debfc8a7ba78d4002e700e7ac13ed0c77d8.exe
-
Size
391KB
-
MD5
4da9a2f0cee46c2cdabf1f42f48168f0
-
SHA1
1ffbe18950f3e9ebcdcc84fa3ff1a146e6095693
-
SHA256
ff679525cf9498daebda1da378886debfc8a7ba78d4002e700e7ac13ed0c77d8
-
SHA512
d2a7552f68f2490bbcd5a660f101b2d55bd40bff1e2c6e33ff57ace29821cb88a030f1c45709fff9e293305ef2ddfd696a2ff4c0562218651a0b3c58babd29cb
-
SSDEEP
6144:nbUgoY8fGQ5vXmur0M6VSJ0yxXfX8BzC63iqyfqXxP5PBuNw:nbUClQ5vbr0M6VSm4PXh66qXxP5PBuy
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff679525cf9498daebda1da378886debfc8a7ba78d4002e700e7ac13ed0c77d8.exe"C:\Users\Admin\AppData\Local\Temp\ff679525cf9498daebda1da378886debfc8a7ba78d4002e700e7ac13ed0c77d8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ff679525cf9498daebda1da378886debfc8a7ba78d4002e700e7ac13ed0c77d8.exe"C:\Users\Admin\AppData\Local\Temp\ff679525cf9498daebda1da378886debfc8a7ba78d4002e700e7ac13ed0c77d8.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
8KB