imminent | 4fea5be10a901186a28d2c818c1a264265b22440c8c2f62611f5a28dd907ae8a | Triage

Sharing

General

Target

4fea5be10a901186a28d2c818c1a264265b22440c8c2f62611f5a28dd907ae8a
Size

499KB
Sample

220719-xwxn2aaccp
MD5

dc4da9510376798fd121ae2f94cf531e
SHA1

41db50963d36fae816864cf3d58a9bb730c291f5
SHA256

4fea5be10a901186a28d2c818c1a264265b22440c8c2f62611f5a28dd907ae8a
SHA512

d2b66346c180ed4f932292c25073b2c89d2e0645ebf347fa027d3051ea5c224151605d6bad5298285b3951a73541929963d9513a2bb47fe5be32ca5bff34526c

Score

10^/10

imminent persistence spyware trojan

Malware Config

Targets

- Target
  
  4fea5be10a901186a28d2c818c1a264265b22440c8c2f62611f5a28dd907ae8a
- Size
  
  499KB
- MD5
  
  dc4da9510376798fd121ae2f94cf531e
- SHA1
  
  41db50963d36fae816864cf3d58a9bb730c291f5
- SHA256
  
  4fea5be10a901186a28d2c818c1a264265b22440c8c2f62611f5a28dd907ae8a
- SHA512
  
  d2b66346c180ed4f932292c25073b2c89d2e0645ebf347fa027d3051ea5c224151605d6bad5298285b3951a73541929963d9513a2bb47fe5be32ca5bff34526c
Score

10^/10

imminent persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentpersistencespywaretrojan

behavioral2