imminent | 4ffb7cec59276bc2e1fcbdf462b23fbfda1ebae6b0d388dbaaeed6a0cc706f88

Resubmissions

16/08/2026, 16:16

260816-tq1lysssft

07/08/2026, 19:22

260807-x3d59shf97

27/07/2026, 21:53

260727-1rpdmsdd9610

Analysis

user interaction
yes
max time kernel
150s
max time network
195s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 21:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Red-Flaged/4ffb7cec59276bc2e1fcbdf462b23fbfda1ebae6b0d388dbaaeed6a0cc706f88.exe
Size 6.8MB
Sample260727-1rpdmsdd96
SHA256 4ffb7cec59276bc2e1fcbdf462b23fbfda1ebae6b0d388dbaaeed6a0cc706f88
MD5 ab3ea47e165ee24fa664a8133135aa23
SHA1 abc5806553b502a97124c06eabc1eff372c33525
SHA512 33ffac15adcf1b5147ea644b7d327005b3a9e85d2d55a2b5bfe7b07bbe258e8e037bff9b2958b4c643c929fe5087136bc1509881a9de615d21cf46b175486ff3
SSDEEP 196608:F0CAmWMg4pCea/iXaHH+uebdJjjEsYvBsAQLIttA:F0FmWMx6iqHWdJ0seHo
TLSH
T1BD7633EEE17ED6E8F9746AB97C2EB0401026CF1A4F51C9C1B163B79A5F8340491DE293
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery imminent persistence spyware trojan

Malware Config

Signatures

Family: Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 4 IoCs

pid	Process
968	miner.exe
5720	service.exe
1296	Realtek Service Host.exe
2520	miner.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek = "\\Realtek Service Host\\Realtek Service Host.exe"	MSBuild.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek = "C:\\Users\\Admin\\AppData\\Roaming\\Realtek Service Host\\Realtek Service Host.exe"	MSBuild.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5720 set thread context of 5848	5720	service.exe	90
PID 968 set thread context of 2520	968	miner.exe	98

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	MSBuild.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Realtek Service Host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5848	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5848	MSBuild.exe
Token: 33	5848	MSBuild.exe
Token: SeIncBasePriorityPrivilege	5848	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5848	MSBuild.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 968	4768	4ffb7cec59276bc2e1fcbdf462b23fbfda1ebae6b0d388dbaaeed6a0cc706f88.exe	88
PID 4768 wrote to memory of 5720	4768	4ffb7cec59276bc2e1fcbdf462b23fbfda1ebae6b0d388dbaaeed6a0cc706f88.exe	89
PID 5720 wrote to memory of 5848	5720	service.exe	90
PID 5720 wrote to memory of 5848	5720	service.exe	90
PID 5720 wrote to memory of 5848	5720	service.exe	90
PID 5720 wrote to memory of 5848	5720	service.exe	90
PID 5720 wrote to memory of 5848	5720	service.exe	90
PID 968 wrote to memory of 2520	968	miner.exe	98
PID 968 wrote to memory of 2520	968	miner.exe	98
PID 968 wrote to memory of 2520	968	miner.exe	98
PID 968 wrote to memory of 2520	968	miner.exe	98
PID 968 wrote to memory of 2520	968	miner.exe	98
PID 968 wrote to memory of 2520	968	miner.exe	98
PID 968 wrote to memory of 2520	968	miner.exe	98
PID 968 wrote to memory of 2520	968	miner.exe	98
PID 968 wrote to memory of 2520	968	miner.exe	98

C:\Users\Admin\AppData\Local\Temp\Red-Flaged\4ffb7cec59276bc2e1fcbdf462b23fbfda1ebae6b0d388dbaaeed6a0cc706f88.exe
"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\4ffb7cec59276bc2e1fcbdf462b23fbfda1ebae6b0d388dbaaeed6a0cc706f88.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\miner.exe
  "C:\Users\Admin\miner.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Users\Admin\miner.exe
    "C:\Users\Admin\miner.exe"
    3⤵
    - Executes dropped EXE
    PID:2520
- C:\Users\Admin\service.exe
  "C:\Users\Admin\service.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5848

C:\Users\Admin\AppData\Roaming\Realtek Service Host\Realtek Service Host.exe
"C:\Users\Admin\AppData\Roaming\Realtek Service Host\Realtek Service Host.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1296

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path.dat

Path C:\Users\Admin\AppData\Roaming\Imminent\Path.dat
Size 76B
SHA256 a1b7db0a14489e97c18deee2e750aa6297ae65f69013e9b601d6e2ae9c539369
MD5 abafcf06c051fac993500de9ab81cf9e
SHA1 3f48fc7b941d489bc87599463867b108ca74b183
SHA512 53afc6890d8acaddd36f46d9aa9ed9fa399a1aebd0c175e6f4e02ff50b424a29b9fbc54fde1d0f9e19ad67d4a7bf716fc8edb52ca4ac4269357312ef870510fa
TLSH
T121A01255042198E5234011010A52B5140844D318602061324430884309951501F2912A
MD5 SHA1 SHA512 TLSH

Submit Download

Realtek Service Host.exe

Path C:\Users\Admin\AppData\Roaming\Realtek Service Host\Realtek Service Host.exe
Size 249KB
SHA256 151d0125c20cdde578d02de3f2a56eb904870a887bb7f1c59bf61471da231916
MD5 f8e68d6abe411ce0c71d6b8c1c1b9048
SHA1 77360aa532c299f636f424a2866016ee6bd5c09b
SHA512 3e6c59395c8c5f07d39db829aa335420ffe426fb9a4ab831cfe1273e803afd5f91912ee341e01b4e108b298349bdeea9e7e52874b05fa1723ebc408be896b650
SSDEEP 3072:6DEKKwBWmSEoRooC7GvORoQYiY35e8w2XpFU4rwOe+ZbZEFf02RFivFuv4GuhK:UHK2W0u1tvORstRXfM102bicw4
TLSH
T103446A01A7EC4615F6FF1A78B8B015158B76F867E866E35E388C61AC1F73740EA60363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miner.exe

Path C:\Users\Admin\miner.exe
Size 5.6MB
SHA256 d9d48c2c19c334895c1923bc0d939486e1c5e304573fb1e51bd9da2bd5fe2d4b
MD5 4be24489802e58eb402041ededd4c5ad
SHA1 7d556eb00880e830592de22349b49fc0a39e73f2
SHA512 874bf7ea1db800f48fb773405ddfcf41d8c309af583255e2e040a82f6fcec33cb1946ab28e9d99b8add4dc11d2a52d026504af048f423e2be5f4d5deee2647d6
SSDEEP 98304:qkLyOXhcSVJepwPxclQyuKOv0d3Gul/dGqVqldSFypFMI2o4GV7i:qkLyicQeGcQyjRblVnuSFCFx2B0G
TLSH
T16546232A9051A2EFF5A755B1A6012210B473F823873CABEB43F4E7351D5BEE40F29719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.exe

Path C:\Users\Admin\service.exe
Size 1.2MB
SHA256 70de79bcce338543f64eb7da22dbc434e0172e73f0550edb572daa5e280024e9
MD5 f4b7ffceb761d804ee3bdb9007324adc
SHA1 36ee6111f0395675fb4deeccb0f3dc00e58c0f91
SHA512 0bef3a8c7a6aa4dc97490a002ef84246e8866a09d4e3cbc482754092303da6bb42308f280831cdc70f4e4b86b5491ae0e14f996d1ccd1477f219a84d0b6d3242
SSDEEP 24576:Ai0Ue1oDvZPntgZYUTVqkbEIno9AJ/5NesIk9xf:yUm2ntgnt18Ajgkjf
TLSH
T1B045F12A9192A2EFF19640B196415260B433F86747396EEF42F8D7352A1FED40F3E325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-63-0x0000000000D10000-0x0000000000D50000-memory.dmp

Download

memory/1296-64-0x0000000003210000-0x000000000322A000-memory.dmp

Download

memory/1296-65-0x00000000058E0000-0x0000000005A3A000-memory.dmp

Download

memory/2076-92-0x0000019B18D10000-0x0000019B18E00000-memory.dmp

Download

memory/2520-85-0x0000000140000000-0x000000014050B000-memory.dmp

Download

memory/4768-20-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4768-24-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4768-19-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4768-1-0x0000000000AB0000-0x000000000118A000-memory.dmp

Download

memory/4768-6-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4768-5-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4768-3-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4768-2-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4768-0-0x00007FFA95AFF000-0x00007FFA95B00000-memory.dmp

Download

memory/5848-53-0x0000000005D10000-0x0000000005D76000-memory.dmp

Download

memory/5848-29-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5848-50-0x000000000A1B0000-0x000000000A76A000-memory.dmp

Download

memory/5848-52-0x0000000005780000-0x0000000005812000-memory.dmp

Download

memory/5848-32-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5848-51-0x0000000074B80000-0x000000007533C000-memory.dmp

Download

memory/5848-43-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5848-40-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5848-35-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5848-34-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5848-33-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5848-31-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5848-30-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5848-46-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5848-37-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5848-54-0x0000000005FA0000-0x0000000005FB9000-memory.dmp

Download

memory/5848-57-0x0000000006220000-0x0000000006236000-memory.dmp

Download

memory/5848-58-0x0000000006340000-0x000000000634A000-memory.dmp

Download

memory/5848-49-0x0000000009A50000-0x0000000009AEC000-memory.dmp

Download

memory/5848-39-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5848-48-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5848-45-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5848-71-0x0000000074B92000-0x0000000074B93000-memory.dmp

Download

memory/5848-27-0x0000000005380000-0x00000000053A8000-memory.dmp

Download

memory/5848-75-0x0000000074B80000-0x000000007533C000-memory.dmp

Download

memory/5848-26-0x0000000074B92000-0x0000000074B93000-memory.dmp

Download

memory/5848-25-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5848-110-0x0000000005340000-0x000000000534C000-memory.dmp

Download