imminent | 454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d | Triage

Submit
Reports

Overview

overview

Static

static

454f9af37f...1d.exe

windows7-x64

454f9af37f...1d.exe

windows10-2004-x64

Sharing

General

Target

454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d
Size

385KB
Sample

221123-rsw1fahd74
MD5

04cfc2135b1bf2061b5893d826536a23
SHA1

af152c1d257812a315c4e36bb71b871f09bfa47c
SHA256

454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d
SHA512

b364b7f53eeeee263a7f1687cb1a55428ec5d2d99b5698d05cc0f67b674314a693bd9b49f4b122f3d333354a978f81d109345b1d074737f30aadbb7067834335
SSDEEP

6144:g5GxLm5HeuV6VeAJiGE5+I6e2aD+4B6htvOi/+k/Igk2b3LQlwkGnTLELguh9NbE:ikLIHFLAMGEBUq+uluggkC7QifTLULbE

Score

10^/10

imminent persistence spyware trojan

Static task

static1

Behavioral task

behavioral1

Sample

454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d.exe

Resource

win7-20220901-en

imminent persistence spyware trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d.exe

Resource

win10v2004-20221111-en

imminent persistence spyware trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d
- Size
  
  385KB
- MD5
  
  04cfc2135b1bf2061b5893d826536a23
- SHA1
  
  af152c1d257812a315c4e36bb71b871f09bfa47c
- SHA256
  
  454f9af37fe145ffc233b3e24eec3e43098e1d0186ac2deadffbae2addb05a1d
- SHA512
  
  b364b7f53eeeee263a7f1687cb1a55428ec5d2d99b5698d05cc0f67b674314a693bd9b49f4b122f3d333354a978f81d109345b1d074737f30aadbb7067834335
- SSDEEP
  
  6144:g5GxLm5HeuV6VeAJiGE5+I6e2aD+4B6htvOi/+k/Igk2b3LQlwkGnTLELguh9NbE:ikLIHFLAMGEBUq+uluggkC7QifTLULbE
Score

10^/10

imminent persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentpersistencespywaretrojan

behavioral2

imminentpersistencespywaretrojan

© 2018-2025

Terms | Privacy