imminent | c0e13fa481c483415d81c519aea6e413eaaaa882a35df5e5fe3af9e4af4ffcbb | Triage

Submit
Reports

Overview

overview

Static

static

c0e13fa481...bb.exe

windows7-x64

c0e13fa481...bb.exe

windows10-2004-x64

Sharing

General

Target

c0e13fa481c483415d81c519aea6e413eaaaa882a35df5e5fe3af9e4af4ffcbb
Size

273KB
Sample

221125-3ftkbsee79
MD5

52049eaba7030119c438c42e8fd984ee
SHA1

2c8b60bbd9f730564546b74b3879de865da59f49
SHA256

c0e13fa481c483415d81c519aea6e413eaaaa882a35df5e5fe3af9e4af4ffcbb
SHA512

d366391764e7065128ea273700a097ca50b81a7495cd1ed6514d645cd0c0deb29c930c94ebf6ccf65c757080abe7ad50bd31d151cd73205585b9b6e9d6a7bde1
SSDEEP

6144:V0oMdZI7fpg2kY0B113e4DzYCSsc4Fcwactlx:HeI1kY0B1Y43Yl+naIx

Score

10^/10

imminent persistence spyware trojan

Static task

static1

Behavioral task

behavioral1

Sample

c0e13fa481c483415d81c519aea6e413eaaaa882a35df5e5fe3af9e4af4ffcbb.exe

Resource

win7-20220812-en

imminent persistence spyware trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

c0e13fa481c483415d81c519aea6e413eaaaa882a35df5e5fe3af9e4af4ffcbb.exe

Resource

win10v2004-20221111-en

imminent persistence spyware trojan

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  c0e13fa481c483415d81c519aea6e413eaaaa882a35df5e5fe3af9e4af4ffcbb
- Size
  
  273KB
- MD5
  
  52049eaba7030119c438c42e8fd984ee
- SHA1
  
  2c8b60bbd9f730564546b74b3879de865da59f49
- SHA256
  
  c0e13fa481c483415d81c519aea6e413eaaaa882a35df5e5fe3af9e4af4ffcbb
- SHA512
  
  d366391764e7065128ea273700a097ca50b81a7495cd1ed6514d645cd0c0deb29c930c94ebf6ccf65c757080abe7ad50bd31d151cd73205585b9b6e9d6a7bde1
- SSDEEP
  
  6144:V0oMdZI7fpg2kY0B113e4DzYCSsc4Fcwactlx:HeI1kY0B1Y43Yl+naIx
Score

10^/10

imminent persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentpersistencespywaretrojan

behavioral2

imminentpersistencespywaretrojan

© 2018-2025

Terms | Privacy