imminent | 7ad17a294bc535c8e1d5c3033bd131d1fdc49fe03d7900c61ba64835f640652f | Triage

Sharing

General

Target

7ad17a294bc535c8e1d5c3033bd131d1fdc49fe03d7900c61ba64835f640652f
Size

318KB
Sample

221122-w72xfsda39
MD5

82d802a6ac29df8fe6be7a80669da4d5
SHA1

c80de466261ca7a0a5ebba3f349845cf8aee8535
SHA256

7ad17a294bc535c8e1d5c3033bd131d1fdc49fe03d7900c61ba64835f640652f
SHA512

d3bcabc05e0df8aaef55d33cbbf09fa673dbe58caa446a5f4decb8bc03add26e58b198853459c894c069e39a56180ac026ccce9f84e4875fff2b6e5b9eed7295
SSDEEP

6144:qe03LBlo3Y+4SAMEarbE4XT72juSTxBAEC7U0HGNC1xHuoDxi+PRUTS:qeS+1A0raHjnCQ0HY0Oou

Score

10^/10

imminent persistence spyware trojan

Malware Config

Targets

- Target
  
  7ad17a294bc535c8e1d5c3033bd131d1fdc49fe03d7900c61ba64835f640652f
- Size
  
  318KB
- MD5
  
  82d802a6ac29df8fe6be7a80669da4d5
- SHA1
  
  c80de466261ca7a0a5ebba3f349845cf8aee8535
- SHA256
  
  7ad17a294bc535c8e1d5c3033bd131d1fdc49fe03d7900c61ba64835f640652f
- SHA512
  
  d3bcabc05e0df8aaef55d33cbbf09fa673dbe58caa446a5f4decb8bc03add26e58b198853459c894c069e39a56180ac026ccce9f84e4875fff2b6e5b9eed7295
- SSDEEP
  
  6144:qe03LBlo3Y+4SAMEarbE4XT72juSTxBAEC7U0HGNC1xHuoDxi+PRUTS:qeS+1A0raHjnCQ0HY0Oou
Score

10^/10

imminent persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Modifies WinLogon for persistence
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentpersistencespywaretrojan

behavioral2

imminentpersistencespywaretrojan