imminent | f553b4b340bc4e88aefbd43ef3c9078af982ebf5baa16451aad02ad3f706a973 | Triage

Submit
Reports

Overview

overview

Static

static

f553b4b340...73.exe

windows7-x64

f553b4b340...73.exe

windows10-2004-x64

Sharing

General

Target

f553b4b340bc4e88aefbd43ef3c9078af982ebf5baa16451aad02ad3f706a973
Size

613KB
Sample

221126-ncsrasah63
MD5

a482ff02cc9c671882add028df3d6f16
SHA1

acf2184f5689ec3f540f98bc4cdc9341dace0d71
SHA256

f553b4b340bc4e88aefbd43ef3c9078af982ebf5baa16451aad02ad3f706a973
SHA512

1229dca9599660cc4d7194ce1c1e6c082c6b501e4aafbf4bb1acbf0da2163e4640fd21a5b5ffdf1aea99e507567aa0ca5c8fd760050e76bd655900050b6712c7
SSDEEP

12288:7W3lPUgZ/xVjXAIOztFVtx7ShP10VgckaS8:G9Z/bjAI8N8tagczS8

Score

10^/10

imminent persistence spyware trojan

Static task

static1

Behavioral task

behavioral1

Sample

f553b4b340bc4e88aefbd43ef3c9078af982ebf5baa16451aad02ad3f706a973.exe

Resource

win7-20220812-en

imminent persistence spyware trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

f553b4b340bc4e88aefbd43ef3c9078af982ebf5baa16451aad02ad3f706a973.exe

Resource

win10v2004-20220901-en

imminent persistence spyware trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  f553b4b340bc4e88aefbd43ef3c9078af982ebf5baa16451aad02ad3f706a973
- Size
  
  613KB
- MD5
  
  a482ff02cc9c671882add028df3d6f16
- SHA1
  
  acf2184f5689ec3f540f98bc4cdc9341dace0d71
- SHA256
  
  f553b4b340bc4e88aefbd43ef3c9078af982ebf5baa16451aad02ad3f706a973
- SHA512
  
  1229dca9599660cc4d7194ce1c1e6c082c6b501e4aafbf4bb1acbf0da2163e4640fd21a5b5ffdf1aea99e507567aa0ca5c8fd760050e76bd655900050b6712c7
- SSDEEP
  
  12288:7W3lPUgZ/xVjXAIOztFVtx7ShP10VgckaS8:G9Z/bjAI8N8tagczS8
Score

10^/10

imminent persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentpersistencespywaretrojan

behavioral2

imminentpersistencespywaretrojan

© 2018-2025

Terms | Privacy