imminent | ee485630c7d062d58cda6b5cf11375bff1ba8137a7bac5965645f0f2c6b8d0bb | Triage

Sharing

General

Target

ee485630c7d062d58cda6b5cf11375bff1ba8137a7bac5965645f0f2c6b8d0bb
Size

1.1MB
Sample

221126-wlxqlsda88
MD5

1243a29740ecb429476b44651cc29408
SHA1

11581943aae80fbe3c9f7841372f6864b0cea90f
SHA256

ee485630c7d062d58cda6b5cf11375bff1ba8137a7bac5965645f0f2c6b8d0bb
SHA512

34f94e0bda8c907466f08d186d07c2bb86fe86ffbd1830ef1ff0871ad6d913d19daa734266a25498172133cc4adfbd82c782cfe385b20bc04b035cef3cd8e141
SSDEEP

24576:st24ofv5yEEbW0+pNPKqZilRAu7IXmF+OSgLpz4T3eJGi:WonbEtEVKmu7q8cT3zi

Score

10^/10

imminent persistence spyware trojan

Malware Config

Targets

- Target
  
  ee485630c7d062d58cda6b5cf11375bff1ba8137a7bac5965645f0f2c6b8d0bb
- Size
  
  1.1MB
- MD5
  
  1243a29740ecb429476b44651cc29408
- SHA1
  
  11581943aae80fbe3c9f7841372f6864b0cea90f
- SHA256
  
  ee485630c7d062d58cda6b5cf11375bff1ba8137a7bac5965645f0f2c6b8d0bb
- SHA512
  
  34f94e0bda8c907466f08d186d07c2bb86fe86ffbd1830ef1ff0871ad6d913d19daa734266a25498172133cc4adfbd82c782cfe385b20bc04b035cef3cd8e141
- SSDEEP
  
  24576:st24ofv5yEEbW0+pNPKqZilRAu7IXmF+OSgLpz4T3eJGi:WonbEtEVKmu7q8cT3zi
Score

10^/10

imminent persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentpersistencespywaretrojan

behavioral2