imminent | fd1916a392220cd992581702e90a710dbf320009d585e64e7b982ab1b946f93f | Triage

Sharing

General

Target

fd1916a392220cd992581702e90a710dbf320009d585e64e7b982ab1b946f93f
Size

1.1MB
Sample

221123-ps96ysfc8w
MD5

f1986f6f9c557cba0ddd74907fe9a10f
SHA1

e1a7082eba81f783f3802b694d7eb81f6f5eb9d6
SHA256

fd1916a392220cd992581702e90a710dbf320009d585e64e7b982ab1b946f93f
SHA512

5780aa0de7feb6113f91d71d1e6d931faa410f082754c73de5b3aebb986b094c69c2c925cec837e7e62279bf6b100622403755666442fbf27ecf8dd28da86626
SSDEEP

24576:ct24U3gipfnsa5Yu0KPRjez8l+OSgLphaZ3etWrv:mSd0Cu8hm3vv

Score

10^/10

imminent persistence spyware trojan

Malware Config

Targets

- Target
  
  fd1916a392220cd992581702e90a710dbf320009d585e64e7b982ab1b946f93f
- Size
  
  1.1MB
- MD5
  
  f1986f6f9c557cba0ddd74907fe9a10f
- SHA1
  
  e1a7082eba81f783f3802b694d7eb81f6f5eb9d6
- SHA256
  
  fd1916a392220cd992581702e90a710dbf320009d585e64e7b982ab1b946f93f
- SHA512
  
  5780aa0de7feb6113f91d71d1e6d931faa410f082754c73de5b3aebb986b094c69c2c925cec837e7e62279bf6b100622403755666442fbf27ecf8dd28da86626
- SSDEEP
  
  24576:ct24U3gipfnsa5Yu0KPRjez8l+OSgLphaZ3etWrv:mSd0Cu8hm3vv
Score

10^/10

imminent persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentpersistencespywaretrojan

behavioral2