imminent | 88524f717ebc55d29998e05aaab0423af4be4617435086f9cef71bcbad819c45

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe
Size

529KB
MD5

587e2bf883c6fbb146097e58de903cd1
SHA1

d6bef496d9070cf7c67f524ecbba1f15ba2f7c1d
SHA256

88524f717ebc55d29998e05aaab0423af4be4617435086f9cef71bcbad819c45
SHA512

126eb038803afe5074e788982e36a86121306dee2cf61263a41106e90f8cd4c27d1a746cda7ec7875cc7a10be837839d7658169b43af0920bbb8a0b5b0f51e40
SSDEEP

12288:G0UkdQ5ZGS4meNdQZguDTiljYvF5YlWAl7O8ojlaRe1ULsWSbyCOoSgW+rs415AF:G0UL5UN/NdQZgh+zHI

Score

10^/10

imminent spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2440 set thread context of 2608	2440	587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe	28

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2608	587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe
Token: 33	2608	587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2608	587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2608	587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2608	2440	587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe	28
PID 2440 wrote to memory of 2608	2440	587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe	28
PID 2440 wrote to memory of 2608	2440	587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe	28
PID 2440 wrote to memory of 2608	2440	587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe	28
PID 2440 wrote to memory of 2608	2440	587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe	28
PID 2440 wrote to memory of 2608	2440	587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe	28
PID 2440 wrote to memory of 2608	2440	587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe	28
PID 2440 wrote to memory of 2608	2440	587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe	28
PID 2440 wrote to memory of 2608	2440	587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\587e2bf883c6fbb146097e58de903cd1_JaffaCakes118.exe
  "{path}"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2608

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2440-0-0x0000000074F81000-0x0000000074F82000-memory.dmp

Filesize
4KB

Download
memory/2440-1-0x0000000074F80000-0x000000007552B000-memory.dmp

Filesize
5.7MB

Download
memory/2440-2-0x0000000074F80000-0x000000007552B000-memory.dmp

Filesize
5.7MB

Download
memory/2440-18-0x0000000074F80000-0x000000007552B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-3-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2608-19-0x0000000074F80000-0x000000007552B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-7-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2608-5-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2608-15-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2608-13-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2608-11-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2608-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2608-4-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2608-17-0x0000000074F80000-0x000000007552B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-16-0x0000000074F80000-0x000000007552B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-20-0x0000000074F80000-0x000000007552B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-26-0x0000000074F80000-0x000000007552B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-27-0x0000000074F80000-0x000000007552B000-memory.dmp

Filesize
5.7MB

Download