imminent | b01bde2ab9138e6cae1cffee530554172794ef1abfcc32900a375c30cb16ef48

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 20:48

Target

8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe
Size

493KB
MD5

8f6023fd5cec422fc47889d4f33eadd3
SHA1

d08741776a947dcf5dc04ca778ac5ca995dd4948
SHA256

b01bde2ab9138e6cae1cffee530554172794ef1abfcc32900a375c30cb16ef48
SHA512

dd39aa28108213a7d84fdc7b3a0e827dcceaee6181a6c73de7cf2cd22d018a0cd11fa201d95e5432f54ebb9985d82fdb01be56c0287cdea5510436d38b5554e7
SSDEEP

12288:sMfohPnK0D+Sij8vHNCz3rM7ewkpNjlGjWwjR:sMfoVKXIc87eOR

Score

10^/10

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3168 set thread context of 4708	3168	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	85

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe
File created	C:\Windows\assembly\Desktop.ini	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4708	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe
Token: 33	4708	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4708	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4708	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 4708	3168	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	85
PID 3168 wrote to memory of 4708	3168	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	85
PID 3168 wrote to memory of 4708	3168	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	85
PID 3168 wrote to memory of 4708	3168	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	85
PID 3168 wrote to memory of 4708	3168	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	85
PID 3168 wrote to memory of 4708	3168	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	85
PID 3168 wrote to memory of 4708	3168	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	85
PID 3168 wrote to memory of 4708	3168	8f6023fd5cec422fc47889d4f33eadd3_JaffaCakes118.exe	85

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1368

memory/3168-0-0x00000000752A2000-0x00000000752A3000-memory.dmp

Filesize
4KB

Download
memory/3168-1-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/3168-2-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/3168-8-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/4708-5-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4708-7-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/4708-9-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/4708-10-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/4708-18-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/4708-19-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download