imminent | 16b1ecffa1868d2bd5f399f1330aa5d3ff9daa9df7d6f007f3531796c29ac8c4 | Triage

Submit
Reports

Overview

overview

Static

static

16b1ecffa1...c4.exe

windows7-x64

16b1ecffa1...c4.exe

windows10-2004-x64

Sharing

General

Target

16b1ecffa1868d2bd5f399f1330aa5d3ff9daa9df7d6f007f3531796c29ac8c4
Size

271KB
Sample

221122-x1aeasec23
MD5

bf79bcb858172d7b45623fb4362f8aff
SHA1

93a6aaf0430e4d002969ed10a38d09703c1341b5
SHA256

16b1ecffa1868d2bd5f399f1330aa5d3ff9daa9df7d6f007f3531796c29ac8c4
SHA512

59dd8f660cec0843eb01a420fd6efb765651022f5bb9c21c0515e7292cfda9d40ae347227934aa74f33a8961a3959364be415bca74e6d807b39a2e8b6d0f26b4
SSDEEP

6144:u5DGQqIssXA5FU2mQrBj+FkpcYIysOSvHaeWqLr2A4ctlO:sJ7D2xlctdfOgaeWqLaLIO

Score

10^/10

imminent persistence spyware trojan

Static task

static1

Behavioral task

behavioral1

Sample

16b1ecffa1868d2bd5f399f1330aa5d3ff9daa9df7d6f007f3531796c29ac8c4.exe

Resource

win7-20221111-en

imminent persistence spyware trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

16b1ecffa1868d2bd5f399f1330aa5d3ff9daa9df7d6f007f3531796c29ac8c4.exe

Resource

win10v2004-20221111-en

imminent persistence spyware trojan

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  16b1ecffa1868d2bd5f399f1330aa5d3ff9daa9df7d6f007f3531796c29ac8c4
- Size
  
  271KB
- MD5
  
  bf79bcb858172d7b45623fb4362f8aff
- SHA1
  
  93a6aaf0430e4d002969ed10a38d09703c1341b5
- SHA256
  
  16b1ecffa1868d2bd5f399f1330aa5d3ff9daa9df7d6f007f3531796c29ac8c4
- SHA512
  
  59dd8f660cec0843eb01a420fd6efb765651022f5bb9c21c0515e7292cfda9d40ae347227934aa74f33a8961a3959364be415bca74e6d807b39a2e8b6d0f26b4
- SSDEEP
  
  6144:u5DGQqIssXA5FU2mQrBj+FkpcYIysOSvHaeWqLr2A4ctlO:sJ7D2xlctdfOgaeWqLaLIO
Score

10^/10

imminent persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentpersistencespywaretrojan

behavioral2

imminentpersistencespywaretrojan

© 2018-2025

Terms | Privacy