imminent | 6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049 | Triage

Sharing

General

Target

6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049
Size

605KB
Sample

220609-qjdbasgdfm
MD5

7b69e3aaba970c25b40fad29a564a0cf
SHA1

6af0a8634ef3003ccbc743c7ed8869ec2c560042
SHA256

6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049
SHA512

bba40d253de3c19f4c2f890c04d7482b0012f872e1198cc03882ccb08be7c0cdca9bf5b3b6a924e7f2ea337d34ee809fd3c10aa12c15bed036d828dea53e0546

Score

10^/10

imminent persistence spyware trojan

Malware Config

Targets

- Target
  
  6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049
- Size
  
  605KB
- MD5
  
  7b69e3aaba970c25b40fad29a564a0cf
- SHA1
  
  6af0a8634ef3003ccbc743c7ed8869ec2c560042
- SHA256
  
  6d51c2ebe467adf6852e4a8b6d456ee696f75a970705c2ad692cb1f1e8b31049
- SHA512
  
  bba40d253de3c19f4c2f890c04d7482b0012f872e1198cc03882ccb08be7c0cdca9bf5b3b6a924e7f2ea337d34ee809fd3c10aa12c15bed036d828dea53e0546
Score

10^/10

imminent persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

imminentpersistencespywaretrojan