Overview

overview

10

Static

static

1135e0a27a...7f.exe

windows7-x64

10

1135e0a27a...7f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    153s
  • max time network
    188s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-11-2022 18:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1135e0a27afc2adb83e04f461941f7c1ebed8154e0adcd56a2bd124f9b5c207f.exe

  • Size

    935KB

  • MD5

    d62357289be1e500937f593579008f71

  • SHA1

    564517291f9c8bfb58bdc274d2be6588d6cb09b2

  • SHA256

    1135e0a27afc2adb83e04f461941f7c1ebed8154e0adcd56a2bd124f9b5c207f

  • SHA512

    378ac4a887b3a99f971660e0600539bdd2c259932b4339e9aa5a008d6eb71c6b01f39cef93b108c802437654c26000aed715daa590d9f1718e71a945c7b3e90b

  • SSDEEP

    12288:1QRelylTFh+HSCaAuPSteQ005fXEmj4Wi/yRVSUnz6ojLUrA/c4qVg5RClL:1Qh+yCSS/005vyWCwOm44cjO5RCl

Score
10/10
imminentspywaretrojan

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

    trojanspywareimminent
  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1135e0a27afc2adb83e04f461941f7c1ebed8154e0adcd56a2bd124f9b5c207f.exe
    "C:\Users\Admin\AppData\Local\Temp\1135e0a27afc2adb83e04f461941f7c1ebed8154e0adcd56a2bd124f9b5c207f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Users\Admin\AppData\Local\Temp\svhost.exe
      C:\Users\Admin\AppData\Local\Temp\svhost.exe
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\svhost.exe
    Filesize

    52KB

    MD5

    a64daca3cfbcd039df3ec29d3eddd001

    SHA1

    eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3

    SHA256

    403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36

    SHA512

    b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\svhost.exe
    Filesize

    52KB

    MD5

    a64daca3cfbcd039df3ec29d3eddd001

    SHA1

    eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3

    SHA256

    403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36

    SHA512

    b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479

    Download Submit

  • memory/544-135-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

    Download

  • memory/544-138-0x0000000074A00000-0x0000000074FB1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/544-139-0x0000000074A00000-0x0000000074FB1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1048-132-0x0000000074A00000-0x0000000074FB1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1048-133-0x0000000074A00000-0x0000000074FB1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1048-140-0x0000000074A00000-0x0000000074FB1000-memory.dmp

    Filesize

    5.7MB

    Download