imminent | 713e444e051aa99a28c92d9224139f60902efaf8172742f61d4904b7993f16a1

Analysis

max time kernel
150s
max time network
164s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/03/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-03-24_4f26f9916db5ddebcc6f9ab54a16446c_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
Size 54.7MB
Sample260324-vtbbxaav3p
SHA256 713e444e051aa99a28c92d9224139f60902efaf8172742f61d4904b7993f16a1
MD5 4f26f9916db5ddebcc6f9ab54a16446c
SHA1 b3fc9589c1e8b5356fe9b6fcb78accbbc6b7d34f
SHA512 e4109d6be248ed70cc84929c7b68065d11960ca6915704bda1f204c9e39bd52d521cf8390e02d19f64de459bd1bfa4190a9216e88e95a1eeb82f39228f9ab17b
SSDEEP 49152:Uh+ZkldoPK8YaXVh+ZkldoPK8YacVwlqUkeH:l2cPK882cPK8RB
TLSH
T12AC7CFCAD16E44D2DC053FD9A8142AC78B2547328A7400283A7F7D899F775FEC05EEA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent
Imminent family
imminent

Executes dropped EXE 4 IoCs

pid	Process
5716	service.exe
1584	jhi_service.exe
2408	jhi_service.exe
2924	jhi_service.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x001a00000002b4c1-4.dat	autoit_exe
behavioral2/files/0x001900000002b4ce-46.dat	autoit_exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2660 set thread context of 6040	2660	2026-03-24_4f26f9916db5ddebcc6f9ab54a16446c_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	80
PID 5716 set thread context of 2720	5716	service.exe	81
PID 1584 set thread context of 6024	1584	jhi_service.exe	92
PID 2408 set thread context of 5976	2408	jhi_service.exe	96
PID 2924 set thread context of 1268	2924	jhi_service.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-03-24_4f26f9916db5ddebcc6f9ab54a16446c_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhi_service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhi_service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhi_service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5484	schtasks.exe
2272	schtasks.exe
2540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2660	2026-03-24_4f26f9916db5ddebcc6f9ab54a16446c_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
2660	2026-03-24_4f26f9916db5ddebcc6f9ab54a16446c_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
2660	2026-03-24_4f26f9916db5ddebcc6f9ab54a16446c_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
2660	2026-03-24_4f26f9916db5ddebcc6f9ab54a16446c_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2720	RegSvcs.exe
Token: 33	2720	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	2720	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2720	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 5716	2660	2026-03-24_4f26f9916db5ddebcc6f9ab54a16446c_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	79
PID 2660 wrote to memory of 6040	2660	2026-03-24_4f26f9916db5ddebcc6f9ab54a16446c_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	80
PID 2660 wrote to memory of 6040	2660	2026-03-24_4f26f9916db5ddebcc6f9ab54a16446c_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	80
PID 5716 wrote to memory of 2720	5716	service.exe	81
PID 5716 wrote to memory of 2720	5716	service.exe	81
PID 5716 wrote to memory of 2540	5716	service.exe	88
PID 1584 wrote to memory of 6024	1584	jhi_service.exe	92
PID 1584 wrote to memory of 6024	1584	jhi_service.exe	92
PID 1584 wrote to memory of 5484	1584	jhi_service.exe	93
PID 2408 wrote to memory of 5976	2408	jhi_service.exe	96
PID 2408 wrote to memory of 5976	2408	jhi_service.exe	96
PID 2408 wrote to memory of 2272	2408	jhi_service.exe	97
PID 2924 wrote to memory of 1268	2924	jhi_service.exe	100
PID 2924 wrote to memory of 1268	2924	jhi_service.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-03-24_4f26f9916db5ddebcc6f9ab54a16446c_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-03-24_4f26f9916db5ddebcc6f9ab54a16446c_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Roaming\service.exe
  "C:\Users\Admin\AppData\Roaming\service.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2720
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn IntelCorporation /tr "C:\Users\Admin\AppData\Roaming\IntelCorporation\jhi_service.exe" /sc minute /mo 1 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2540
- C:\Users\Admin\AppData\Local\Temp\2026-03-24_4f26f9916db5ddebcc6f9ab54a16446c_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-03-24_4f26f9916db5ddebcc6f9ab54a16446c_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
  2⤵
  PID:6040

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2004

C:\Users\Admin\AppData\Roaming\IntelCorporation\jhi_service.exe
C:\Users\Admin\AppData\Roaming\IntelCorporation\jhi_service.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6024
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn IntelCorporation /tr "C:\Users\Admin\AppData\Roaming\IntelCorporation\jhi_service.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5484

C:\Users\Admin\AppData\Roaming\IntelCorporation\jhi_service.exe
C:\Users\Admin\AppData\Roaming\IntelCorporation\jhi_service.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5976
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn IntelCorporation /tr "C:\Users\Admin\AppData\Roaming\IntelCorporation\jhi_service.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2272

C:\Users\Admin\AppData\Roaming\IntelCorporation\jhi_service.exe
C:\Users\Admin\AppData\Roaming\IntelCorporation\jhi_service.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RegSvcs.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log
Size 507B
SHA256 f4fe84e767222c528e36ca64fef1f52a0d4c3dd7ca1e1e70d851e1c7267bcf32
MD5 ce9dc6a7d6c5376db7aeb0143b8c4008
SHA1 47598ae7a3988c013c2605473144648b748c49a8
SHA512 3029275fbec4c5dfac60e9f70bef8d16865479f696e31b7254053cc2f6580e1626d988e6b310acd0922530a6e64dd2b27581c962884a3d6091fe3e2f536a8fd9
TLSH
T100F027303232A4D90D122F950C197ECA92EF074ABBB8DF5C6655235DCD35497E7210E3
MD5 SHA1 SHA512 TLSH

Submit Download

jhi_service.exe

Path C:\Users\Admin\AppData\Roaming\IntelCorporation\jhi_service.exe
Size 1.6MB
SHA256 47cfe709cab3e43e70585ca4570a5f7842225fca10e1a6b5dfb6ff18821b8ba2
MD5 69c5dac73c6bab4bfbfeeef5ba26919d
SHA1 3fcaa01765bcd8864e7469345ac7a0584b11bed8
SHA512 2af1c7f5ecaee4b0edea5ef01f618dddef37e742fb34780cfa7a20d5660be517d86369dafcd6e26c761af0c0bb87f96468f210a45013ddaadf220a8c04d26144
SSDEEP 24576:+AHnh+eWsN3skA4RV1Hom2KXMmHaSmsQxB2RG8XC5sVb25N:ph+ZkldoPK8YacVwN
TLSH
T1C575C082A3A7C0E2FE5666B35F147687477C6D3141334C2E23993DA8BD724B1426DBA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.exe

Path C:\Users\Admin\AppData\Roaming\service.exe
Size 1.6MB
SHA256 d6c2d98de3ec44ac985ecb67556f343e041c1286c042b7d7bffc1cdf70541fce
MD5 8e16d36c84b67142354354a406af4493
SHA1 f41c09f509d7b18285174e31b3cfdea3a8f7e60c
SHA512 073925633ec89b5b6bcaec3fb3649e6d700242cf9f638c961e66a529ee716e25130aebb3ae1fcb0736a8f134672cb8f935c31eb3c220afe6a6167ddced6ee9f6
SSDEEP 24576:+AHnh+eWsN3skA4RV1Hom2KXMmHaSmsQxB2RG8XC5sVb259:ph+ZkldoPK8YacVw9
TLSH
T10C75C082A3A7C0E2FE5666B35F147687477C6D3141334C2E23993DA8BD724B1426DBA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2720-30-0x00000000069C0000-0x0000000006A52000-memory.dmp

Download

memory/2720-32-0x00000000074E0000-0x00000000074F8000-memory.dmp

Download

memory/2720-27-0x0000000005130000-0x0000000005158000-memory.dmp

Download

memory/2720-28-0x00000000067D0000-0x000000000686C000-memory.dmp

Download

memory/2720-29-0x0000000006E20000-0x00000000073C6000-memory.dmp

Download

memory/2720-25-0x0000000002B60000-0x0000000002B70000-memory.dmp

Download

memory/2720-31-0x00000000073D0000-0x0000000007436000-memory.dmp

Download

memory/2720-26-0x0000000005350000-0x00000000053FE000-memory.dmp

Download

memory/2720-33-0x0000000007A90000-0x0000000007AA6000-memory.dmp

Download

memory/2720-34-0x0000000005440000-0x000000000544A000-memory.dmp

Download

memory/2720-42-0x0000000007470000-0x0000000007494000-memory.dmp

Download

memory/2720-41-0x0000000007460000-0x000000000746B000-memory.dmp

Download

memory/2720-40-0x0000000007440000-0x0000000007459000-memory.dmp

Download

memory/2720-20-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/6024-48-0x0000000000790000-0x00000000007E6000-memory.dmp

Download

memory/6040-12-0x0000000004630000-0x0000000006086000-memory.dmp

Download