Analysis
- max time kernel
98s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
14/06/2023, 06:39
General
- Target Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe
- Size 30.3MB
- Sample230614-hen81adf33
- SHA256 ad162bcde5f5a77253c20d7c2e331db6607c7aa666e57a5a74be75d3cdd8c783
Score
10/10
Malware Config
Signatures
- Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe"C:\Users\Admin\AppData\Local\Temp\Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe"C:\Users\Admin\AppData\Local\Temp\Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe.log
memory/2028-133-0x0000000000FD0000-0x0000000001050000-memory.dmp
memory/2028-134-0x0000000005E90000-0x0000000006434000-memory.dmp
memory/2028-135-0x00000000059D0000-0x0000000005A6C000-memory.dmp
memory/3676-137-0x0000000000400000-0x0000000000456000-memory.dmp
memory/3676-140-0x0000000006A70000-0x0000000006B02000-memory.dmp
memory/3676-141-0x0000000007460000-0x00000000074C6000-memory.dmp
memory/3676-142-0x0000000005410000-0x0000000005420000-memory.dmp
memory/3676-143-0x0000000007B60000-0x0000000007B6A000-memory.dmp
memory/3676-149-0x0000000005410000-0x0000000005420000-memory.dmp