imminent | 70df0441abc44c367839a1787e56695952fc5ed41f06bbc6b2f8987e02d346ab | Triage

Submit
Reports

Overview

overview

Static

static

70df0441ab...ab.exe

windows7-x64

70df0441ab...ab.exe

windows10-2004-x64

Sharing

General

Target

70df0441abc44c367839a1787e56695952fc5ed41f06bbc6b2f8987e02d346ab
Size

1.3MB
Sample

221119-h7tdesed41
MD5

3505d0472aafece8213cca2b424bcba0
SHA1

5a2ff18430fc6b69b3b64d22233f2fb2f123a3c0
SHA256

70df0441abc44c367839a1787e56695952fc5ed41f06bbc6b2f8987e02d346ab
SHA512

af7cf6c22f783fb29a9dc6db574a2caa95bc10f967bbbb38780b63c5c10f398dd53857179e2573aedd16f351699911a4fbc2dc49058c33068ff370fa54072f52
SSDEEP

24576:TYd5XYMN0+asuQ7bUOOza+q1FSZKkgqXLz/5jHSa087bwCC8fmS1jew9M:TcXu+aXQ1/YRzfpCemqjP9M

Score

10^/10

imminent persistence spyware trojan

Static task

static1

Behavioral task

behavioral1

Sample

70df0441abc44c367839a1787e56695952fc5ed41f06bbc6b2f8987e02d346ab.exe

Resource

win7-20221111-en

imminent persistence spyware trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

70df0441abc44c367839a1787e56695952fc5ed41f06bbc6b2f8987e02d346ab.exe

Resource

win10v2004-20221111-en

imminent persistence spyware trojan

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  70df0441abc44c367839a1787e56695952fc5ed41f06bbc6b2f8987e02d346ab
- Size
  
  1.3MB
- MD5
  
  3505d0472aafece8213cca2b424bcba0
- SHA1
  
  5a2ff18430fc6b69b3b64d22233f2fb2f123a3c0
- SHA256
  
  70df0441abc44c367839a1787e56695952fc5ed41f06bbc6b2f8987e02d346ab
- SHA512
  
  af7cf6c22f783fb29a9dc6db574a2caa95bc10f967bbbb38780b63c5c10f398dd53857179e2573aedd16f351699911a4fbc2dc49058c33068ff370fa54072f52
- SSDEEP
  
  24576:TYd5XYMN0+asuQ7bUOOza+q1FSZKkgqXLz/5jHSa087bwCC8fmS1jew9M:TcXu+aXQ1/YRzfpCemqjP9M
Score

10^/10

imminent persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentpersistencespywaretrojan

behavioral2

imminentpersistencespywaretrojan

© 2018-2025

Terms | Privacy