imminent | d9a35e4493b187726d129d1406521a902daffc1f50a75ad022975a5b796505cd | Triage

Sharing

General

Target

d9a35e4493b187726d129d1406521a902daffc1f50a75ad022975a5b796505cd
Size

902KB
Sample

220609-qjdbasgdfn
MD5

1bc52faf563eeda4207272d8c57f27cb
SHA1

3cd4a821c82f388ece2b847af087c79868ea903b
SHA256

d9a35e4493b187726d129d1406521a902daffc1f50a75ad022975a5b796505cd
SHA512

239b792ce0649b7fd37954635145f0dfa81cc69708602730ed6e2ac18048f85ed658676a0701a9d6c0058fd3f2ebd8154c48e45e65d2b95a78337f1631466d95

Score

10^/10

imminent persistence spyware trojan

Malware Config

Targets

- Target
  
  d9a35e4493b187726d129d1406521a902daffc1f50a75ad022975a5b796505cd
- Size
  
  902KB
- MD5
  
  1bc52faf563eeda4207272d8c57f27cb
- SHA1
  
  3cd4a821c82f388ece2b847af087c79868ea903b
- SHA256
  
  d9a35e4493b187726d129d1406521a902daffc1f50a75ad022975a5b796505cd
- SHA512
  
  239b792ce0649b7fd37954635145f0dfa81cc69708602730ed6e2ac18048f85ed658676a0701a9d6c0058fd3f2ebd8154c48e45e65d2b95a78337f1631466d95
Score

10^/10

persistence imminent spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

imminentpersistencespywaretrojan