imminent | e36c6f7110bb2550eee4bb5f41182fcd5d8ebbbd73d4112b8d6a6702f343af11

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 03:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.MSIL.Crypt.gcqm.exe
Size 1.7MB
Sample261016-dx4n7afd85
SHA256 e36c6f7110bb2550eee4bb5f41182fcd5d8ebbbd73d4112b8d6a6702f343af11
MD5 a3c258cf761418255d10258b94be6027
SHA1 dede8f01934d69cac13ffa3db516f0be551bb6b0
SHA512 3b05668d0ce2904d5bd91da874c42a45b7fa554d97fbda3f626db08664c1ad7d3e2d3757773603c7944991499d6546b197275629b9ded189f5cc097063744c63
SSDEEP 49152:FdZ4ZnAUHbY1985VxSEGa6mxBfyhbo5oOLwGBM5nb7OEv:FdZ4VAC8X8bsixBfyhbznGGnb7Ow
TLSH
T111852323A9F104D5CFAFE8B3E1B7CC618D5B14D26692BBE4D5136134ACE07626F2E016
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery imminent persistence spyware trojan

Malware Config

Signatures

Family: Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 2 IoCs

pid	Process
2840	rtyuhbhgpjw.exe
3480	rtyuhbhgpjw.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\dhfygutrtyp = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\dhfygutrtyp.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\dhfygutrtyp = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\dhfygutrtyp.txt \| cmd"	reg.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	regasm.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	regasm.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2840 set thread context of 5944	2840	rtyuhbhgpjw.exe	95
PID 3480 set thread context of 4048	3480	rtyuhbhgpjw.exe	105

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	regasm.exe
File created	C:\Windows\assembly\Desktop.ini	regasm.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	regasm.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	regasm.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan.MSIL.Crypt.gcqm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan.MSIL.Crypt.gcqm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	regasm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	regasm.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rtyuhbhgpjw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rtyuhbhgpjw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.MSIL.Crypt.gcqm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5856	jaffacakes118_Trojan.MSIL.Crypt.gcqm.exe
5856	jaffacakes118_Trojan.MSIL.Crypt.gcqm.exe
2840	rtyuhbhgpjw.exe
2840	rtyuhbhgpjw.exe
3480	rtyuhbhgpjw.exe
3480	rtyuhbhgpjw.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5944	regasm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5856	jaffacakes118_Trojan.MSIL.Crypt.gcqm.exe
Token: SeDebugPrivilege	2840	rtyuhbhgpjw.exe
Token: SeDebugPrivilege	3480	rtyuhbhgpjw.exe
Token: SeDebugPrivilege	5944	regasm.exe
Token: 33	5944	regasm.exe
Token: SeIncBasePriorityPrivilege	5944	regasm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5944	regasm.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 1168	5856	jaffacakes118_Trojan.MSIL.Crypt.gcqm.exe	89
PID 1168 wrote to memory of 2840	1168	cmd.exe	91
PID 2840 wrote to memory of 1364	2840	rtyuhbhgpjw.exe	92
PID 1364 wrote to memory of 6120	1364	cmd.exe	94
PID 2840 wrote to memory of 5944	2840	rtyuhbhgpjw.exe	95
PID 2840 wrote to memory of 5944	2840	rtyuhbhgpjw.exe	95
PID 2840 wrote to memory of 5944	2840	rtyuhbhgpjw.exe	95
PID 2840 wrote to memory of 5944	2840	rtyuhbhgpjw.exe	95
PID 2840 wrote to memory of 5944	2840	rtyuhbhgpjw.exe	95
PID 2748 wrote to memory of 1712	2748	cmd.exe	98
PID 2748 wrote to memory of 2236	2748	cmd.exe	99
PID 2236 wrote to memory of 3480	2236	cmd.exe	100
PID 3480 wrote to memory of 1268	3480	rtyuhbhgpjw.exe	102
PID 1268 wrote to memory of 1052	1268	cmd.exe	104
PID 3480 wrote to memory of 4048	3480	rtyuhbhgpjw.exe	105
PID 3480 wrote to memory of 4048	3480	rtyuhbhgpjw.exe	105
PID 3480 wrote to memory of 4048	3480	rtyuhbhgpjw.exe	105
PID 3480 wrote to memory of 4048	3480	rtyuhbhgpjw.exe	105
PID 3480 wrote to memory of 4048	3480	rtyuhbhgpjw.exe	105

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.MSIL.Crypt.gcqm.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.MSIL.Crypt.gcqm.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Users\Admin\AppData\Roaming\sfghnjrkpp\rtyuhbhgpjw.exe
    "C:\Users\Admin\AppData\Roaming\sfghnjrkpp\rtyuhbhgpjw.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1364
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "dhfygutrtyp" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\dhfygutrtyp.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:6120
  - - C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
      "C:\Users\Admin\AppData\Roaming\sfghnjrkpp\rtyuhbhgpjw.exe"
      4⤵
      Drops desktop.ini file(s)
      Drops file in Windows directory
      Enumerates video capture drivers
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5944

C:\Windows\system32\cmd.exe
"cmd /c type C:\Users\Admin\AppData\Local\Temp\dhfygutrtyp.txt | cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\dhfygutrtyp.txt "
  2⤵
  PID:1712
- C:\Windows\system32\cmd.exe
  cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Users\Admin\AppData\Roaming\sfghnjrkpp\rtyuhbhgpjw.exe
    "C:\Users\Admin\AppData\Roaming\sfghnjrkpp\rtyuhbhgpjw.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1268
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "dhfygutrtyp" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\dhfygutrtyp.txt" | cmd"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1052
  - - C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe
      "C:\Users\Admin\AppData\Roaming\sfghnjrkpp\rtyuhbhgpjw.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4048

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0972B7C417F696E06E186AEB26286F01_6DEFC1B0F00B73D870DAEE9AD78095DA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0972B7C417F696E06E186AEB26286F01_6DEFC1B0F00B73D870DAEE9AD78095DA
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

3D0AC26322348780E90E022EA217C58C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3D0AC26322348780E90E022EA217C58C
Size 14KB
SHA256 e919c8495d1f68f3d579cd32a11ecf9036326e507b14e753490fcc167db4ccc5
MD5 f0187804ed9adc1a39500dac3d6694b6
SHA1 1d9f3abd007f87c4c013df967fcd543ea76d3795
SHA512 52b3753035e1764d0a0a62d7a6d96efd4be1850ee23205d623dd94e5a88022739cc172ec97fc10bb1e0835942a63023c8aa9829768498aea969f7d472feb61aa
SSDEEP 192:0FK+MEJ9CdeOI6ixqo3G18sKgzw0ZpE4YWd9y4DUwAsPvGckh46o9mfYlPzC+L8X:0c+M+9/LHxv3w8XMZpY4DU7nKMu86Xru
TLSH
T110620DD89C6939D7B045A2B1C9CB5EEBCD72B18533D2840AD5A55F014822FCE9EE80F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A3D5BF1283C2E63D8C8A8C72F0051F5A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A3D5BF1283C2E63D8C8A8C72F0051F5A
Size 834B
SHA256 f64b94c786a213df5f80716f98b2e4f90edb77609b43dce1c788792f460a53dd
MD5 6e7576248913afc6faab4229d85e3fcf
SHA1 143ad96b5dbb9c61c0fd5c61c91ca2f60c171624
SHA512 3481f48d977635f480beace91a79752fbc22377239d722cfc6921c63d9cc2ae3bf899c810d37d2939370867c8e323997ddd63a13aa823a6036e5ea332bed0c5c
TLSH
T1E4011E9644083012A4806B24C948ED5FCEB8A39D4FEC9802A0E48D8F5E53FF86B5216A
MD5 SHA1 SHA512 TLSH

Submit Download

0972B7C417F696E06E186AEB26286F01_6DEFC1B0F00B73D870DAEE9AD78095DA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0972B7C417F696E06E186AEB26286F01_6DEFC1B0F00B73D870DAEE9AD78095DA
Size 398B
SHA256 cb7d2b1d6def2cd5f3ec9f42843ba7fb929f84dceae5aad938a1e29c719bce30
MD5 1909e1e75138a6f89431ad725df9fd56
SHA1 eb24296b118afc62711d43914fb205a7c0ceed4c
SHA512 c05dc6b8391e842eecd49aaf164c8bce6c5358499788126dfc4b8c9219071df4a8c770e256c439683bf1229f1c82df898c46dc55af3cf22754ca78df7a4fda51
TLSH
T156E0C2281EBD026EF0B0EEBA57CDE2E44AAAE151181D46EA20A05A063743E00DE66C30
MD5 SHA1 SHA512 TLSH

Submit Download

3D0AC26322348780E90E022EA217C58C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3D0AC26322348780E90E022EA217C58C
Size 170B
SHA256 9b9b6cee4835ab11e93173be37d6d9b4915ae649e9ff1a702440355cd42ae949
MD5 bf80866ab53255545396420bb49c3092
SHA1 8390c48a9b2731acf51cecc7fab3ffc9ab02565c
SHA512 0ed3b9d72d8c87159117604a1ee49488013de66bc20e4ba94b7bdca63c015a2ad7368ffeef4ba1074cb186901a142fd0be4514808dc786b57fc8ec321b7dbf5d
TLSH
T14BC09B491F5453D5F1344D7DD49217217F365505FE82C3DD4B3161C45C7DA114931815
MD5 SHA1 SHA512 TLSH

Submit Download

8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F
Size 392B
SHA256 40bbdcd0cace56279823f41bf21818fef8507d18ae4fcee7c4b020dbaabeb565
MD5 fa26b04be420b37ba5cb3dc5b35506c6
SHA1 48fdf0a546cb42398dae16ef91fedad330d33747
SHA512 e53e5919770af368b4d2d45a7c20d7a79b667dece0eda5292381c580bf71048218ce27fd2a38aa5695a13a5ba9cf2fabb7ffd8e8ab6aff29ac3573129615aeab
TLSH
T15BE072280DEE12AEF9B49D758BD9A0736902E101945803F150D06301BE03B101CB1830
MD5 SHA1 SHA512 TLSH

Submit Download

A3D5BF1283C2E63D8C8A8C72F0051F5A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A3D5BF1283C2E63D8C8A8C72F0051F5A
Size 178B
SHA256 53a18a9465bed4a8debd2a314b0a0e26611c20c10b17df689cccbcc30023e56d
MD5 e751e5aa4773b2759f47bf51660ae9ce
SHA1 d70b163b77da4158d80f63f6b3a72720cfb4e75c
SHA512 06b9a0e37b7f4daf7079687cf6fdc8655514158b441b3eb1a344ac626422064b74a31e99f0d5ff54bad2228518a9b8dfc5208be9a74f1aa7abd46eaa85043964
TLSH
T1E7C02B0437554700DA300D7D000A42104F303104E711C3104B3933146838A404C3BC11
MD5 SHA1 SHA512 TLSH

Submit Download

dhfygutrtyp.txt

Path C:\Users\Admin\AppData\Local\Temp\dhfygutrtyp.txt
Size 69B
SHA256 c70d5705b162fa25bc23cc62298984991dd8c7861c3bd19ab0395d39c6a3a538
MD5 02ed9bec65110e00bdf9af9a81edd96d
SHA1 3128f98687668a9dcf57810e655c2a1d2e1f5c83
SHA512 8a67a92886ee3788b6e4f11129bf397da4b97da07a6e5aa17fcc678dea69fecbe6f35ecb7ba24645ca29154e7a5b5acdf4936cfda7182c479cd9b7dca9de0ce7
TLSH
T1CAA0222282C2C30C880300032BB0BC2E00B3BAE03E882000E300828B22C0008A8C820E
MD5 SHA1 SHA512 TLSH

Submit Download

rtyuhbhgpjw.exe

Path C:\Users\Admin\AppData\Roaming\sfghnjrkpp\rtyuhbhgpjw.exe
Size 1.7MB
SHA256 e36c6f7110bb2550eee4bb5f41182fcd5d8ebbbd73d4112b8d6a6702f343af11
MD5 a3c258cf761418255d10258b94be6027
SHA1 dede8f01934d69cac13ffa3db516f0be551bb6b0
SHA512 3b05668d0ce2904d5bd91da874c42a45b7fa554d97fbda3f626db08664c1ad7d3e2d3757773603c7944991499d6546b197275629b9ded189f5cc097063744c63
SSDEEP 49152:FdZ4ZnAUHbY1985VxSEGa6mxBfyhbo5oOLwGBM5nb7OEv:FdZ4VAC8X8bsixBfyhbznGGnb7Ow
TLSH
T111852323A9F104D5CFAFE8B3E1B7CC618D5B14D26692BBE4D5136134ACE07626F2E016
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2840-21-0x0000000074EB0000-0x00000000754D1000-memory.dmp

Download

memory/2840-30-0x0000000074EB0000-0x00000000754D1000-memory.dmp

Download

memory/2840-33-0x0000000074EB0000-0x00000000754D1000-memory.dmp

Download

memory/5856-1-0x0000000074EB2000-0x0000000074EB4000-memory.dmp

Download

memory/5856-0-0x0000000001AD0000-0x0000000001AE0000-memory.dmp

Download

memory/5944-32-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/5944-34-0x0000000074EB0000-0x00000000754D1000-memory.dmp

Download

memory/5944-46-0x0000000074EB0000-0x00000000754D1000-memory.dmp

Download