imminent | aeee1a4e2ca34a80e450dde19d9a790857b5a5e725348b595794d546109e9cc4

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.Win32.Hookey.ny.exe
Size 3.2MB
Sample261012-k6cqdstybt
SHA256 aeee1a4e2ca34a80e450dde19d9a790857b5a5e725348b595794d546109e9cc4
MD5 29fe85e345bd0760449f465dbd989e85
SHA1 99b873c5e7286363606edc16331dc9733b3be313
SHA512 cc04cd1d093c62f0119c63419d061f79d5e95d74a25dc9d21f7082a63f3e9ff7d4be05f9490e7242b4c125cad08026737167e883faf2d390019185305650dafc
SSDEEP 49152:RJZoQrbTFZY1iaV0a4mv9YOiB0stOP6ScLIt9tUXjfNDpruSDIAKpfx/qIs17+AZ:RtrbTA1+aLu+se6lLO2zFpHeTY17dZ
TLSH
T100F52321B5D5C036C2B327B15EBEF7BAD63965360336C19B23D829714FA05812B2A773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery imminent persistence spyware trojan

Malware Config

Signatures

Family: Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 1 IoCs

pid	Process
2176	material.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\papas = "C:\\Users\\Admin\\AppData\\Roaming\\papass\\material.exe"	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6116 set thread context of 3544	6116	jaffacakes118_Trojan-Spy.Win32.Hookey.ny.exe	89

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	MSBuild.exe
File created	C:\Windows\assembly\Desktop.ini	MSBuild.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	MSBuild.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	MSBuild.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.Win32.Hookey.ny.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	material.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3544	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3544	MSBuild.exe
Token: 33	3544	MSBuild.exe
Token: SeIncBasePriorityPrivilege	3544	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3544	MSBuild.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 3544	6116	jaffacakes118_Trojan-Spy.Win32.Hookey.ny.exe	89
PID 6116 wrote to memory of 3544	6116	jaffacakes118_Trojan-Spy.Win32.Hookey.ny.exe	89
PID 6116 wrote to memory of 3544	6116	jaffacakes118_Trojan-Spy.Win32.Hookey.ny.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Hookey.ny.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Hookey.ny.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Enumerates video capture drivers
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3544

C:\Users\Admin\AppData\Roaming\papass\material.exe
C:\Users\Admin\AppData\Roaming\papass\material.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2176

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

material.exe

Path C:\Users\Admin\AppData\Roaming\papass\material.exe
Size 68KB
SHA256 dc993b3089f03102ca1edd12d166dada69209fa286d6faec434237d867ea477d
MD5 5acb4f105d31ca01afe15b89315cd562
SHA1 1ba2aa8b26cb3479a6736f0f6797dbf14fee8013
SHA512 836835d119865190357d9f5b8194cfad7cfcad9bb118d64155727403902dd656a090dfd4027d29007d18135276f440e098422d820c888e6b6acd9a70c3c2b9cb
SSDEEP 768:uElGiBcBuiyFjUwF0wdP9/rJMD14FRJfStf4wV3e3qtAcy:hlGBu7jjP9/tMD1SJAFVO3GO
TLSH
T162631812A3E84B12F6BA867068F94A224637F912F975D35D38CD374D1F327808D6276B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2176-10-0x0000000073AD0000-0x00000000740F1000-memory.dmp

Download

memory/2176-12-0x0000000073AD0000-0x00000000740F1000-memory.dmp

Download

memory/2176-11-0x0000000073AD0000-0x00000000740F1000-memory.dmp

Download

memory/3544-0-0x0000000001190000-0x00000000011E6000-memory.dmp

Download

memory/3544-1-0x0000000001A70000-0x0000000001A80000-memory.dmp

Download

memory/3544-2-0x0000000073AD2000-0x0000000073AD4000-memory.dmp

Download

memory/3544-3-0x0000000073AD0000-0x00000000740F1000-memory.dmp

Download

memory/3544-15-0x0000000001A70000-0x0000000001A80000-memory.dmp

Download

memory/3544-16-0x0000000073AD2000-0x0000000073AD4000-memory.dmp

Download

memory/3544-19-0x0000000073AD0000-0x00000000740F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads