Analysis
-
max time kernel
98s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
14-06-2023 06:39
General
-
Target
Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe
-
Size
30.3MB
-
MD5
9464e7ccf6f949e5bcd412250ace1ae1
-
SHA1
c69b38a6289ec2d722b26c7248b77ed055e19b94
-
SHA256
ad162bcde5f5a77253c20d7c2e331db6607c7aa666e57a5a74be75d3cdd8c783
-
SHA512
f40eebc9d5d7ee15d640e8eab3d4dc271f6324aa520bea38b9b3f4fe226844fe5fb0966deab1bc01d3cb55641f3b3d36b382e875c54bd198b938fd92a5f7e672
-
SSDEEP
6144:T3T3CN57+SBHljnXVS1B9yjEMv3hE3N+hAD08JwsYptahCdLlfi5NvuaMGsgL7G:TD3ABHIX94EYxQst4nUtahUhMZ/nG
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe"C:\Users\Admin\AppData\Local\Temp\Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe"C:\Users\Admin\AppData\Local\Temp\Sony.Loops.For.Aci d.Essential.Sounds .Vol.2.Sonic.Found ry.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
418B
MD598eea38457c9976c0ec48b5a70964041
SHA1281ec6ada096be89ade13852ca86edfe42ffe3c1
SHA2564a7455429d6f3c7390f97bc406d0bcc7d64ddff6bee5ffa9e88c5a75f806bfcf
SHA512adb7bb4e1434d743932890aede4daa55c6e9f091415292775313dd172949fbd415f124c97e017a8204aab530b6184f196ab5cce005781b0853ffccc620f07530
-
Filesize
512KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
344KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
64KB