imminent | ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1

Analysis

max time kernel
148s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 19:11 UTC

Target

ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1.exe
Size

477KB
MD5

504e94b83c1e8cb6e9d784a5740b0660
SHA1

89517ff4c8221c55db9e22a46989ac53fabe4691
SHA256

ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1
SHA512

488bad05a87baf98e91607b2cce4be3cf5083e11c1f88625b3492378b03dd6d0364f94fc550eb81a75bae12b9a58908320ff312f6d7e9940ea4db01c90af4c9d
SSDEEP

6144:qfipT+Jlo+zm7USrJXcNbXtnLvw4xMgQfqg1ywbTSuv:IwElJmxFKbxxMgeqET

Score

10^/10

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 908 set thread context of 1924	908	ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1.exe	27

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1924	ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	908	ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1.exe
Token: SeDebugPrivilege	1924	ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1924	ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1924	908	ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1.exe	27
PID 908 wrote to memory of 1924	908	ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1.exe	27
PID 908 wrote to memory of 1924	908	ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1.exe	27
PID 908 wrote to memory of 1924	908	ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1.exe	27
PID 908 wrote to memory of 1924	908	ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1.exe	27
PID 908 wrote to memory of 1924	908	ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1.exe	27
PID 908 wrote to memory of 1924	908	ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1.exe	27
PID 908 wrote to memory of 1924	908	ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1.exe	27
PID 908 wrote to memory of 1924	908	ab2c66d1522a521c09dfa5e494bff8f41ffecd1d4d8ca0c8f97a606f1faf2db1.exe	27

memory/908-54-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/908-55-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/908-68-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/1924-61-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1924-59-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1924-60-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1924-57-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1924-64-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1924-66-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1924-56-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1924-69-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/1924-70-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download