imminent | f56221012c021d03c1afe39e507e6a71f3204e870579859a9450755d18c56586 | Triage

Sharing

General

Target

9a8b9618327be00cc39b5e592a1ee2ba_JaffaCakes118
Size

760KB
Sample

240815-sn3g4ashqn
MD5

9a8b9618327be00cc39b5e592a1ee2ba
SHA1

bf16c27fa814d3b418f90668d769bb4b4bb6b48b
SHA256

f56221012c021d03c1afe39e507e6a71f3204e870579859a9450755d18c56586
SHA512

04450c5bc9d954b6b2ea059eb249ac344d98d5860135f851a7c7e162a710516e9c61748f6e5e0432d1e47b115a64af0a6fc771b9b554dada00fa42fc86370180
SSDEEP

12288:xDj9wSCOI6shw5iqo7bK0rrd6s3q6qLblPgn896CxrMRi4Ik5ioz0oi9qNkT5Mqi:xDj9XFj8w5ihZJ6s3Ubsqx41t9z/iqNZ

Score

10^/10

imminent discovery persistence spyware trojan

Malware Config

Targets

- Target
  
  9a8b9618327be00cc39b5e592a1ee2ba_JaffaCakes118
- Size
  
  760KB
- MD5
  
  9a8b9618327be00cc39b5e592a1ee2ba
- SHA1
  
  bf16c27fa814d3b418f90668d769bb4b4bb6b48b
- SHA256
  
  f56221012c021d03c1afe39e507e6a71f3204e870579859a9450755d18c56586
- SHA512
  
  04450c5bc9d954b6b2ea059eb249ac344d98d5860135f851a7c7e162a710516e9c61748f6e5e0432d1e47b115a64af0a6fc771b9b554dada00fa42fc86370180
- SSDEEP
  
  12288:xDj9wSCOI6shw5iqo7bK0rrd6s3q6qLblPgn896CxrMRi4Ik5ioz0oi9qNkT5Mqi:xDj9XFj8w5ihZJ6s3Ubsqx41t9z/iqNZ
Score

10^/10

imminent discovery persistence spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentdiscoverypersistencespywaretrojan

behavioral2

imminentdiscoverypersistencespywaretrojan