imminent | d703c2f868b5091b22ba0a06748225295456b90ec3d0243bb45e6a2187f540f1 | Triage

Submit
Reports

Overview

overview

Static

static

d703c2f868...f1.exe

windows7-x64

d703c2f868...f1.exe

windows10-2004-x64

Sharing

General

Target

d703c2f868b5091b22ba0a06748225295456b90ec3d0243bb45e6a2187f540f1
Size

822KB
Sample

221125-3baawshb5s
MD5

ada53634dc0d87ee227d06e808698e69
SHA1

63c06bf651f923f6a49364c6de036d52b7d549ef
SHA256

d703c2f868b5091b22ba0a06748225295456b90ec3d0243bb45e6a2187f540f1
SHA512

71b15508f1f9fd78cb00c67b894ce46cfbd8feb755d58670e881e3272de0d13b8ab0e6710b5ecfc75416acbdc657cd4d0af4c2d092aae96dfde6e27885473796
SSDEEP

24576:ZOFDDY6pvNgkX/b/L0gZQL0eofNR3rNX1:ZSY6pvNgkjzfaI/NH

Score

10^/10

imminent persistence spyware trojan

Static task

static1

Behavioral task

behavioral1

Sample

d703c2f868b5091b22ba0a06748225295456b90ec3d0243bb45e6a2187f540f1.exe

Resource

win7-20220812-en

imminent persistence spyware trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

d703c2f868b5091b22ba0a06748225295456b90ec3d0243bb45e6a2187f540f1.exe

Resource

win10v2004-20220812-en

imminent persistence spyware trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  d703c2f868b5091b22ba0a06748225295456b90ec3d0243bb45e6a2187f540f1
- Size
  
  822KB
- MD5
  
  ada53634dc0d87ee227d06e808698e69
- SHA1
  
  63c06bf651f923f6a49364c6de036d52b7d549ef
- SHA256
  
  d703c2f868b5091b22ba0a06748225295456b90ec3d0243bb45e6a2187f540f1
- SHA512
  
  71b15508f1f9fd78cb00c67b894ce46cfbd8feb755d58670e881e3272de0d13b8ab0e6710b5ecfc75416acbdc657cd4d0af4c2d092aae96dfde6e27885473796
- SSDEEP
  
  24576:ZOFDDY6pvNgkX/b/L0gZQL0eofNR3rNX1:ZSY6pvNgkjzfaI/NH
Score

10^/10

imminent persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentpersistencespywaretrojan

behavioral2

imminentpersistencespywaretrojan

© 2018-2025

Terms | Privacy