imminent | 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba | Triage

Sharing

General

Target

8b6b7954f840329e2b0f67fb851ea9a6_JaffaCakes118
Size

507KB
Sample

240811-wqpkss1brk
MD5

8b6b7954f840329e2b0f67fb851ea9a6
SHA1

f62ec7c3ea1ef8d185b5f083813315e0b09a5f5f
SHA256

8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba
SHA512

01036290f9cc7d637c8d1d3cca9c2201ef273596bd5bb64d7089c88f5ce68086bba955fcb4624346102bc91651eb9331824176c0bbc8c84d12fae2d33eaf9be8
SSDEEP

6144:g4xJwZlYV28hU9K+SRhj+dBsWHuKCRnNrMmv1IH/V0MgraPWGuLfcwSpb1H78i+w:GNikBsKPVZwa+2J7p55Uh+1

Score

10^/10

imminent discovery persistence spyware trojan

Malware Config

Targets

- Target
  
  8b6b7954f840329e2b0f67fb851ea9a6_JaffaCakes118
- Size
  
  507KB
- MD5
  
  8b6b7954f840329e2b0f67fb851ea9a6
- SHA1
  
  f62ec7c3ea1ef8d185b5f083813315e0b09a5f5f
- SHA256
  
  8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba
- SHA512
  
  01036290f9cc7d637c8d1d3cca9c2201ef273596bd5bb64d7089c88f5ce68086bba955fcb4624346102bc91651eb9331824176c0bbc8c84d12fae2d33eaf9be8
- SSDEEP
  
  6144:g4xJwZlYV28hU9K+SRhj+dBsWHuKCRnNrMmv1IH/V0MgraPWGuLfcwSpb1H78i+w:GNikBsKPVZwa+2J7p55Uh+1
Score

10^/10

imminent discovery persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentdiscoverypersistencespywaretrojan

behavioral2

imminentdiscoverypersistencespywaretrojan