Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
15/02/2024, 01:28
General
- Target 0d74794a5a43e8e2ada19c598f875adbe4a3fb779a7f01bd904650021143ee40.exe
- Size 643KB
- Sample240215-bvs4kaec48
- SHA256 0d74794a5a43e8e2ada19c598f875adbe4a3fb779a7f01bd904650021143ee40
Malware Config
Signatures
- Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d74794a5a43e8e2ada19c598f875adbe4a3fb779a7f01bd904650021143ee40.exe"C:\Users\Admin\AppData\Local\Temp\0d74794a5a43e8e2ada19c598f875adbe4a3fb779a7f01bd904650021143ee40.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Path.dat
memory/2280-6-0x00000000053B0000-0x0000000005442000-memory.dmp
memory/2280-2-0x00000000050B0000-0x00000000050D8000-memory.dmp
memory/2280-3-0x0000000005150000-0x0000000005160000-memory.dmp
memory/2280-4-0x0000000009780000-0x000000000981C000-memory.dmp
memory/2280-5-0x0000000009DD0000-0x000000000A374000-memory.dmp
memory/2280-0-0x00000000005E0000-0x0000000000688000-memory.dmp
memory/2280-7-0x0000000005800000-0x0000000005866000-memory.dmp
memory/2280-8-0x0000000005D50000-0x0000000005D68000-memory.dmp
memory/2280-10-0x0000000005EF0000-0x0000000005F06000-memory.dmp
memory/2280-11-0x00000000060F0000-0x00000000060FA000-memory.dmp
memory/2280-1-0x00000000753B0000-0x0000000075B60000-memory.dmp
memory/2280-36-0x00000000753B0000-0x0000000075B60000-memory.dmp
memory/2280-39-0x0000000005150000-0x0000000005160000-memory.dmp