Analysis
-
max time kernel
134s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26-12-2023 07:35
General
-
Target
5cdd03e8e53429c22f46ce41ae406d06.exe
-
Size
354KB
-
MD5
5cdd03e8e53429c22f46ce41ae406d06
-
SHA1
a2670c96f331f146c125f8eea81b03aaa1ccdbdd
-
SHA256
9b74f7badba83335183324f9d1f19cbc16de16e4df0d2b8a6b98f41f49b7c487
-
SHA512
0c60c1a9495f1e3c150aec8bf0394ae3011344f17c89fb28081ec37ed08aa811f595ae3535ded1c49f135a0031d137e6a9076d2151c7e15df0672c5250186e87
-
SSDEEP
3072:swi51kpjgUdkY8NvIKq7BexmKWWVcXKiB9n5qa4bScysIVkMmL9N0g9zWfwabXlj:IopjgUqY86BtWVo5VRIeY/QvDROyEQJ
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cdd03e8e53429c22f46ce41ae406d06.exe"C:\Users\Admin\AppData\Local\Temp\5cdd03e8e53429c22f46ce41ae406d06.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD590f2ffc1a3fd2305dd15911cbe17b87c
SHA1c3618ae54941e6ebb5a9481915415d4649eb2099
SHA2568a785776156d3c062f4677e54d737ec6ab48cf8994f5bc3b6b0e2efd734b32f2
SHA512df95d46bb66e4d507b3f30f1a20561e2e8aef907480d71247ec6b5f06eefc8139aefcebb9e3985d0a26a87c45e1f9219283757a447a34577727c10c35581c005
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB