imminent | 1be9caff1315381ba21e41585023b4027566943f8ad49dad9138eaafcb0884ce | Triage

Sharing

General

Target

1be9caff1315381ba21e41585023b4027566943f8ad49dad9138eaafcb0884ce
Size

513KB
Sample

220607-vqwhnshhak
MD5

4cf248bd0710ef55dc447532c0d37e91
SHA1

1b37a85da089be0cffe173bd32519d56147ad383
SHA256

1be9caff1315381ba21e41585023b4027566943f8ad49dad9138eaafcb0884ce
SHA512

10ed0a991c51bbfdba5d0246d33f5a7823a5c3ad80be8b528f05adfff21002997e0af7b6fe11f562ce9136ab5bbfc372baef179d5f9265007c669571ccc9f6ab

Score

10^/10

imminent persistence spyware trojan

Malware Config

Targets

- Target
  
  1be9caff1315381ba21e41585023b4027566943f8ad49dad9138eaafcb0884ce
- Size
  
  513KB
- MD5
  
  4cf248bd0710ef55dc447532c0d37e91
- SHA1
  
  1b37a85da089be0cffe173bd32519d56147ad383
- SHA256
  
  1be9caff1315381ba21e41585023b4027566943f8ad49dad9138eaafcb0884ce
- SHA512
  
  10ed0a991c51bbfdba5d0246d33f5a7823a5c3ad80be8b528f05adfff21002997e0af7b6fe11f562ce9136ab5bbfc372baef179d5f9265007c669571ccc9f6ab
Score

10^/10

imminent persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentpersistencespywaretrojan

behavioral2

imminentpersistencespywaretrojan