imminent | d03009ce65db3582f0c9f046d58d7449b30c1e7a6241b76fbeb2656ac11a188a

Analysis

max time kernel
151s
max time network
174s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08-10-2023 16:29

Target

NEAS.68abb76bc5690517ec41168a16789b80_JC.exe
Size

476KB
MD5

68abb76bc5690517ec41168a16789b80
SHA1

ad3cc14d5d84320233ffd97af4fc826979c8903e
SHA256

d03009ce65db3582f0c9f046d58d7449b30c1e7a6241b76fbeb2656ac11a188a
SHA512

693f2db2fa39d84d7401148c54749673be5d6d41d6818694892629c793bcb285a590462d33374bc02c0ef0f93e6f20b80651e771991d8e95d4d9ddd25b2c35ea
SSDEEP

12288:tntoifIwkqdVQocSJXaa6r11lN1SP9hC/43h:FmifIVqv+SJXaa6r113Il

Score

10^/10

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gcg.vbe	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1068 set thread context of 2596	1068	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	30

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2596	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe
Token: 33	2596	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe
Token: SeIncBasePriorityPrivilege	2596	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1068	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe
2596	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2596	1068	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	30
PID 1068 wrote to memory of 2596	1068	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	30
PID 1068 wrote to memory of 2596	1068	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	30
PID 1068 wrote to memory of 2596	1068	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	30
PID 1068 wrote to memory of 2596	1068	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	30
PID 1068 wrote to memory of 2596	1068	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	30
PID 1068 wrote to memory of 2596	1068	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	30
PID 1068 wrote to memory of 2596	1068	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	30
PID 1068 wrote to memory of 2596	1068	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	30
PID 1068 wrote to memory of 2596	1068	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	30
PID 1068 wrote to memory of 2596	1068	NEAS.68abb76bc5690517ec41168a16789b80_JC.exe	30

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1076

memory/1068-0-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/1068-3-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/1068-5-0x00000000002A0000-0x00000000002A7000-memory.dmp

Filesize
28KB

Download
memory/2596-8-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2596-11-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2596-12-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2596-13-0x0000000074210000-0x00000000747BB000-memory.dmp

Filesize
5.7MB

Download
memory/2596-14-0x0000000074210000-0x00000000747BB000-memory.dmp

Filesize
5.7MB

Download
memory/2596-15-0x0000000001FC0000-0x0000000002000000-memory.dmp

Filesize
256KB

Download
memory/2596-16-0x0000000001FC0000-0x0000000002000000-memory.dmp

Filesize
256KB

Download
memory/2596-18-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2596-19-0x0000000074210000-0x00000000747BB000-memory.dmp

Filesize
5.7MB

Download
memory/2596-20-0x0000000074210000-0x00000000747BB000-memory.dmp

Filesize
5.7MB

Download
memory/2596-23-0x0000000001FC0000-0x0000000002000000-memory.dmp

Filesize
256KB

Download
memory/2596-25-0x0000000001FC0000-0x0000000002000000-memory.dmp

Filesize
256KB

Download