Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
28/11/2022, 18:03
General
-
Target
1b9df1699b15f4ca68044c1ceb327e65c5da4eb0abd3cf4a1074132c11a021b5.exe
-
Size
273KB
-
MD5
6242bbac174723fa03ec0abdec5a76ec
-
SHA1
fa9610bb54e67821155539d3de572c4ae8c4056a
-
SHA256
1b9df1699b15f4ca68044c1ceb327e65c5da4eb0abd3cf4a1074132c11a021b5
-
SHA512
2c7f8c0f18863cbd207a9f7627ac830f75de5aad84b00fc52f7463962f007c64baf656c280308443d36acf6c33576945ab226fdb73c46887dd4d3d119f4b9b3c
-
SSDEEP
6144:ucDvodP/v4nyn9vCZ+hiLRKABbH77BZIUuxr5HNV818ctlKd:tQQnynJCZ+hiLZaUuhZ8eIKd
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b9df1699b15f4ca68044c1ceb327e65c5da4eb0abd3cf4a1074132c11a021b5.exe"C:\Users\Admin\AppData\Local\Temp\1b9df1699b15f4ca68044c1ceb327e65c5da4eb0abd3cf4a1074132c11a021b5.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB