Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
19-01-2024 09:08
General
-
Target
477452a05820a5412b7776fb9e1f9deba37f505c60b6826fd5f19815c18b2aec.exe
-
Size
322KB
-
MD5
59ac350b071b6fac37ca371be5fb0146
-
SHA1
95439872f36d6822191fa3a79a8214149b22013d
-
SHA256
477452a05820a5412b7776fb9e1f9deba37f505c60b6826fd5f19815c18b2aec
-
SHA512
8eb3cab09d4e479159f9ba28425f25adcc5221dfa4407f137cbe9d6aeb4d0b7a383e311ac2d3c4cf18e55dd69e8f163324cdfa5598069e77aef71a9430638c6f
-
SSDEEP
6144:td0Xed7HqjyeJbmfKRLtamCg8NiijKkmFTOwwRznwFl3h3vSv:td0XeUdJbmfwJamCg8HGLCOD
Score
10/10
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\477452a05820a5412b7776fb9e1f9deba37f505c60b6826fd5f19815c18b2aec.exe"C:\Users\Admin\AppData\Local\Temp\477452a05820a5412b7776fb9e1f9deba37f505c60b6826fd5f19815c18b2aec.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB