Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
15-02-2024 01:28
General
-
Target
0d74794a5a43e8e2ada19c598f875adbe4a3fb779a7f01bd904650021143ee40.exe
-
Size
643KB
-
MD5
bb669ac948dc0c703d1d47d0af2a0741
-
SHA1
e7e958077f9a49736640a0180b16ba8ba306fc3e
-
SHA256
0d74794a5a43e8e2ada19c598f875adbe4a3fb779a7f01bd904650021143ee40
-
SHA512
7451e4d703060b1e5ba77b682c914f739c288ba9f2428d04f72fe1065e18a8b86599bc763059be673658952eb047128ab95b42e46708218cec0a107b4cf32c56
-
SSDEEP
12288:bWvWgQs09rZOS6QiyRAkwU6S8HWK/a1KPesnWwNnuFBbSEWEEEHnmfY5JdutJRMD:sv70r9iyO0iHk
Malware Config
Signatures
-
Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d74794a5a43e8e2ada19c598f875adbe4a3fb779a7f01bd904650021143ee40.exe"C:\Users\Admin\AppData\Local\Temp\0d74794a5a43e8e2ada19c598f875adbe4a3fb779a7f01bd904650021143ee40.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD5e172e93fca6824a721eaf1fd7cdd036b
SHA16cf0ab5cc7e8ab516a279eeaed0922a596ef8d19
SHA2569ede04cc565f44249495c2e54d105667eff2926345d0df20c9fe3a9f04f5d29e
SHA512c1c7d98fa05596159f82f4543b4c1c67603a9ba68318c314f28ce8febe9a7f64ffa9466e09604777d27bb5f0ac3a1b21f0ed76d9d3c1b51c018f93610ab9da8e
-
Filesize
672KB
-
Filesize
6.9MB
-
Filesize
160KB
-
Filesize
256KB
-
Filesize
88KB
-
Filesize
6.9MB
-
Filesize
256KB