imminent | 8f3a70a81ad568eaca0e3fa287d3a1200e0cc903da0a412d58b39debe71abc6c | Triage

Sharing

General

Target

8f3a70a81ad568eaca0e3fa287d3a1200e0cc903da0a412d58b39debe71abc6c
Size

361KB
Sample

221127-sygy5sce2t
MD5

b8fba572714a6893023bed66cab6bae2
SHA1

bc8115ddb106759cbdb5f8b6c43191b6f9a532dd
SHA256

8f3a70a81ad568eaca0e3fa287d3a1200e0cc903da0a412d58b39debe71abc6c
SHA512

a7fe776edb5d0010946699852034e034be77413460ac3ceacb3f58b14546255be6283888dfce79c8f577004c38987a0b09d8de2afae794e635a7f0e7f1c29807
SSDEEP

6144:a991cll5gT62NsqHScpguMLAJvWR5BUTnKmLDyVEzwWyuJ35Zk9Rn:KhnNsSSgguj5cSTnHa/LuJ35Zk9R

Score

10^/10

imminent persistence spyware trojan

Malware Config

Targets

- Target
  
  8f3a70a81ad568eaca0e3fa287d3a1200e0cc903da0a412d58b39debe71abc6c
- Size
  
  361KB
- MD5
  
  b8fba572714a6893023bed66cab6bae2
- SHA1
  
  bc8115ddb106759cbdb5f8b6c43191b6f9a532dd
- SHA256
  
  8f3a70a81ad568eaca0e3fa287d3a1200e0cc903da0a412d58b39debe71abc6c
- SHA512
  
  a7fe776edb5d0010946699852034e034be77413460ac3ceacb3f58b14546255be6283888dfce79c8f577004c38987a0b09d8de2afae794e635a7f0e7f1c29807
- SSDEEP
  
  6144:a991cll5gT62NsqHScpguMLAJvWR5BUTnKmLDyVEzwWyuJ35Zk9Rn:KhnNsSSgguj5cSTnHa/LuJ35Zk9R
Score

10^/10

imminent persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentpersistencespywaretrojan

behavioral2

imminentspywaretrojan