imminent | 5f17ccf190bef7b9dfb860610ebb6db9810682b100d7b431a88e895e2a3e3e08 | Triage

Sharing

General

Target

5f17ccf190bef7b9dfb860610ebb6db9810682b100d7b431a88e895e2a3e3e08
Size

423KB
Sample

221126-w4wahaed68
MD5

f25d6959b6898a8fb13f85ceaf7a032b
SHA1

9562cf9c2bf74940cf095d7e8bc91da47ba8114d
SHA256

5f17ccf190bef7b9dfb860610ebb6db9810682b100d7b431a88e895e2a3e3e08
SHA512

d4916d45d9c1a1e82674b02dff2a3d765889a40d9d87f0c8d99117866a1b75faea97dcc37e0fe23a36445b5a9d495e0c19d1f0b3a2f48d6fb5f5e02fd8da612e
SSDEEP

6144:Ie5g3IgsxCggw7f5a+xtgQnlh71T9JMmoZqR7Xh8po8k43/kLNO:If3IZxCgg20+x5nL71TToZqRhoz38x

Score

10^/10

imminent persistence spyware trojan

Malware Config

Targets

- Target
  
  5f17ccf190bef7b9dfb860610ebb6db9810682b100d7b431a88e895e2a3e3e08
- Size
  
  423KB
- MD5
  
  f25d6959b6898a8fb13f85ceaf7a032b
- SHA1
  
  9562cf9c2bf74940cf095d7e8bc91da47ba8114d
- SHA256
  
  5f17ccf190bef7b9dfb860610ebb6db9810682b100d7b431a88e895e2a3e3e08
- SHA512
  
  d4916d45d9c1a1e82674b02dff2a3d765889a40d9d87f0c8d99117866a1b75faea97dcc37e0fe23a36445b5a9d495e0c19d1f0b3a2f48d6fb5f5e02fd8da612e
- SSDEEP
  
  6144:Ie5g3IgsxCggw7f5a+xtgQnlh71T9JMmoZqR7Xh8po8k43/kLNO:If3IZxCgg20+x5nL71TToZqRhoz38x
Score

10^/10

imminent persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentpersistencespywaretrojan

behavioral2

imminentpersistencespywaretrojan