asyncrat | ffd4eb84d30487daae13452db290c8a31332a93e818fa88cdc2f8041fd035c57

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2022, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ffd4eb84d30487daae13452db290c8a31332a93e818fa88cdc2f8041fd035c57.exe
Size 17KB
Sample221109-psby6aadhj
SHA256 ffd4eb84d30487daae13452db290c8a31332a93e818fa88cdc2f8041fd035c57
MD5 19c10a7d818b70b9947e6851849fd2df
SHA1 0761493f617982c330fafa68ed8bbb5c312a2d82
SHA512 b408f4c020981139fe610cfcc79b12bec1295c18c16a4fe810f0925d34fc1b844a4a9e7716b6b0abbb0fd5a7b2303c81dc64435fc88e0f4edb163de2c6285382
SSDEEP 192:xNIUPBsnnBZHJUmJoeYG8R+ZscF8Bd1LQJEul4uhUmJoeYG8R+ZscF8Bd1L/Jzg2:xxpIhJoSXZsHLQJEruhoSXZsHL/Jmhq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat stormkitty default collection evasion persistence rat spyware stealer vmprotect

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot5733301341:AAF6S_qPXNWS0WW5VbV6kBv7HBzZIREbZ_g/sendMessage?chat_id=1071532135

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 6 IoCs

resource	yara_rule
behavioral2/files/0x0001000000022e03-141.dat	family_stormkitty
behavioral2/files/0x0001000000022e03-142.dat	family_stormkitty
behavioral2/memory/2716-144-0x0000000000E00000-0x0000000000E50000-memory.dmp	family_stormkitty
behavioral2/files/0x0001000000022e05-147.dat	family_stormkitty
behavioral2/files/0x0001000000022e05-146.dat	family_stormkitty
behavioral2/memory/4844-150-0x0000000000140000-0x0000000000170000-memory.dmp	family_stormkitty

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/files/0x0001000000022e05-147.dat	asyncrat
behavioral2/files/0x0001000000022e05-146.dat	asyncrat
behavioral2/memory/4844-150-0x0000000000140000-0x0000000000170000-memory.dmp	asyncrat

Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
3680	RegAsm.exe
4992	Flood http.exe
2716	StormKittyBuild.exe
4844	WorldWindClient.exe
2376	1.exe
2784	http.exe
4208	2.exe
3136	LOIC.exe
2292	Synaptics.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4888	netsh.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/2716-192-0x000000001CB70000-0x000000001CBF4000-memory.dmp	vmprotect
behavioral2/files/0x0001000000022e4b-200.dat	vmprotect

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	StormKittyBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	ffd4eb84d30487daae13452db290c8a31332a93e818fa88cdc2f8041fd035c57.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Flood http.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	http.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	2.exe

Drops startup file 14 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Flood http.exe	RegAsm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WorldWindClient.exe	RegAsm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\__tmp_rar_sfx_access_check_240586593	Flood http.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe	Flood http.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\http.exe	Flood http.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.bat	1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4c63b54190652b309c82e2a2b6c90f6.exe	Synaptics.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WorldWindClient.exe	RegAsm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe	Flood http.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\http.exe	Flood http.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4c63b54190652b309c82e2a2b6c90f6.exe	Synaptics.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Flood http.exe	RegAsm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\__tmp_rar_sfx_access_check_240587984	1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.bat	1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	StormKittyBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	StormKittyBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	StormKittyBuild.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b4c63b54190652b309c82e2a2b6c90f6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Synaptics.exe\" .."	Synaptics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b4c63b54190652b309c82e2a2b6c90f6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Synaptics.exe\" .."	Synaptics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BKJGNEJCBODKHMF = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Flood http.exe"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BEPEHKPAHCPEFOD = "C:\\Windows\\system32\\StormKittyBuild.exe"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BENCPGLOHGDADIF = "C:\\Dir1\\SubDir\\Sorano.exe"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HGBGPKDADGFIJKJ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WorldWindClient.exe"	RegAsm.exe

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\f9329af01565404fc5c928dd43ca9cae\Admin@IYMUGYHL_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	WorldWindClient.exe
File created	C:\Users\Admin\AppData\Local\f9329af01565404fc5c928dd43ca9cae\Admin@IYMUGYHL_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	WorldWindClient.exe
File created	C:\Users\Admin\AppData\Local\f9329af01565404fc5c928dd43ca9cae\Admin@IYMUGYHL_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	WorldWindClient.exe
File created	C:\Users\Admin\AppData\Local\f9329af01565404fc5c928dd43ca9cae\Admin@IYMUGYHL_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	WorldWindClient.exe
File opened for modification	C:\Users\Admin\AppData\Local\f9329af01565404fc5c928dd43ca9cae\Admin@IYMUGYHL_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	WorldWindClient.exe
File opened for modification	C:\Users\Admin\AppData\Local\f9329af01565404fc5c928dd43ca9cae\Admin@IYMUGYHL_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	WorldWindClient.exe
File created	C:\Users\Admin\AppData\Local\f9329af01565404fc5c928dd43ca9cae\Admin@IYMUGYHL_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	WorldWindClient.exe
File opened for modification	C:\Users\Admin\AppData\Local\f9329af01565404fc5c928dd43ca9cae\Admin@IYMUGYHL_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	WorldWindClient.exe
File created	C:\Users\Admin\AppData\Local\f9329af01565404fc5c928dd43ca9cae\Admin@IYMUGYHL_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	WorldWindClient.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ip-api.com
41	icanhazip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\StormKittyBuild.exe	RegAsm.exe
File opened for modification	C:\Windows\SysWOW64\StormKittyBuild.exe	RegAsm.exe
File opened for modification	C:\Windows\SysWOW64\StormKittyBuild.exe	StormKittyBuild.exe
File created	C:\Windows\SysWOW64\DotNetZip.dll	StormKittyBuild.exe
File opened for modification	C:\Windows\SysWOW64\DotNetZip.dll	StormKittyBuild.exe
File created	C:\Windows\SysWOW64\AnonFileApi.dll	StormKittyBuild.exe
File opened for modification	C:\Windows\SysWOW64\AnonFileApi.dll	StormKittyBuild.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	StormKittyBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	StormKittyBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	WorldWindClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WorldWindClient.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4600	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3776	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
2716	StormKittyBuild.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
4844	WorldWindClient.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe
2716	StormKittyBuild.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	ffd4eb84d30487daae13452db290c8a31332a93e818fa88cdc2f8041fd035c57.exe
Token: SeDebugPrivilege	4844	WorldWindClient.exe
Token: SeDebugPrivilege	2716	StormKittyBuild.exe
Token: SeDebugPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: SeSecurityPrivilege	1096	msiexec.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: SeDebugPrivilege	3776	taskkill.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe
Token: 33	2292	Synaptics.exe
Token: SeIncBasePriorityPrivilege	2292	Synaptics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 3680	2236	ffd4eb84d30487daae13452db290c8a31332a93e818fa88cdc2f8041fd035c57.exe	83
PID 2236 wrote to memory of 3680	2236	ffd4eb84d30487daae13452db290c8a31332a93e818fa88cdc2f8041fd035c57.exe	83
PID 2236 wrote to memory of 3680	2236	ffd4eb84d30487daae13452db290c8a31332a93e818fa88cdc2f8041fd035c57.exe	83
PID 3680 wrote to memory of 4992	3680	RegAsm.exe	87
PID 3680 wrote to memory of 4992	3680	RegAsm.exe	87
PID 3680 wrote to memory of 4992	3680	RegAsm.exe	87
PID 3680 wrote to memory of 2716	3680	RegAsm.exe	88
PID 3680 wrote to memory of 2716	3680	RegAsm.exe	88
PID 3680 wrote to memory of 4844	3680	RegAsm.exe	89
PID 3680 wrote to memory of 4844	3680	RegAsm.exe	89
PID 3680 wrote to memory of 4844	3680	RegAsm.exe	89
PID 4992 wrote to memory of 2376	4992	Flood http.exe	90
PID 4992 wrote to memory of 2376	4992	Flood http.exe	90
PID 4992 wrote to memory of 2376	4992	Flood http.exe	90
PID 4992 wrote to memory of 2784	4992	Flood http.exe	92
PID 4992 wrote to memory of 2784	4992	Flood http.exe	92
PID 4992 wrote to memory of 2784	4992	Flood http.exe	92
PID 2376 wrote to memory of 4364	2376	1.exe	93
PID 2376 wrote to memory of 4364	2376	1.exe	93
PID 2376 wrote to memory of 4364	2376	1.exe	93
PID 2784 wrote to memory of 4208	2784	http.exe	95
PID 2784 wrote to memory of 4208	2784	http.exe	95
PID 2784 wrote to memory of 3136	2784	http.exe	96
PID 2784 wrote to memory of 3136	2784	http.exe	96
PID 2784 wrote to memory of 3136	2784	http.exe	96
PID 4208 wrote to memory of 2292	4208	2.exe	101
PID 4208 wrote to memory of 2292	4208	2.exe	101
PID 2292 wrote to memory of 4888	2292	Synaptics.exe	102
PID 2292 wrote to memory of 4888	2292	Synaptics.exe	102
PID 4844 wrote to memory of 3000	4844	WorldWindClient.exe	104
PID 4844 wrote to memory of 3000	4844	WorldWindClient.exe	104
PID 4844 wrote to memory of 3000	4844	WorldWindClient.exe	104
PID 3000 wrote to memory of 2204	3000	cmd.exe	107
PID 3000 wrote to memory of 2204	3000	cmd.exe	107
PID 3000 wrote to memory of 2204	3000	cmd.exe	107
PID 3000 wrote to memory of 1584	3000	cmd.exe	108
PID 3000 wrote to memory of 1584	3000	cmd.exe	108
PID 3000 wrote to memory of 1584	3000	cmd.exe	108
PID 3000 wrote to memory of 452	3000	cmd.exe	109
PID 3000 wrote to memory of 452	3000	cmd.exe	109
PID 3000 wrote to memory of 452	3000	cmd.exe	109
PID 4844 wrote to memory of 2952	4844	WorldWindClient.exe	110
PID 4844 wrote to memory of 2952	4844	WorldWindClient.exe	110
PID 4844 wrote to memory of 2952	4844	WorldWindClient.exe	110
PID 2952 wrote to memory of 3840	2952	cmd.exe	112
PID 2952 wrote to memory of 3840	2952	cmd.exe	112
PID 2952 wrote to memory of 3840	2952	cmd.exe	112
PID 2952 wrote to memory of 5108	2952	cmd.exe	113
PID 2952 wrote to memory of 5108	2952	cmd.exe	113
PID 2952 wrote to memory of 5108	2952	cmd.exe	113
PID 2716 wrote to memory of 540	2716	StormKittyBuild.exe	114
PID 2716 wrote to memory of 540	2716	StormKittyBuild.exe	114
PID 2716 wrote to memory of 540	2716	StormKittyBuild.exe	114
PID 540 wrote to memory of 2276	540	cmd.exe	117
PID 540 wrote to memory of 2276	540	cmd.exe	117
PID 540 wrote to memory of 2276	540	cmd.exe	117
PID 540 wrote to memory of 4308	540	cmd.exe	118
PID 540 wrote to memory of 4308	540	cmd.exe	118
PID 540 wrote to memory of 4308	540	cmd.exe	118
PID 540 wrote to memory of 4356	540	cmd.exe	119
PID 540 wrote to memory of 4356	540	cmd.exe	119
PID 540 wrote to memory of 4356	540	cmd.exe	119
PID 2716 wrote to memory of 548	2716	StormKittyBuild.exe	121
PID 2716 wrote to memory of 548	2716	StormKittyBuild.exe	121

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	StormKittyBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	StormKittyBuild.exe

C:\Users\Admin\AppData\Local\Temp\ffd4eb84d30487daae13452db290c8a31332a93e818fa88cdc2f8041fd035c57.exe
"C:\Users\Admin\AppData\Local\Temp\ffd4eb84d30487daae13452db290c8a31332a93e818fa88cdc2f8041fd035c57.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
  "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Flood http.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Flood http.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Drops startup file
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops startup file
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.bat" "
        5⤵
        
        PID:4364
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\http.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\http.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:2784
    - - C:\ProgramData\Synaptics\2.exe
        
        "C:\ProgramData\Synaptics\2.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4208
      - C:\Users\Admin\AppData\Roaming\Synaptics.exe
        
        "C:\Users\Admin\AppData\Roaming\Synaptics.exe"
        6⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Synaptics.exe" "Synaptics.exe" ENABLE
        7⤵
        Modifies Windows Firewall
        
        PID:4888
    - - C:\ProgramData\Synaptics\LOIC.exe
        
        "C:\ProgramData\Synaptics\LOIC.exe"
        5⤵
        Executes dropped EXE
        
        PID:3136
- - C:\Windows\SysWOW64\StormKittyBuild.exe
    "C:\Windows\system32\StormKittyBuild.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Accesses Microsoft Outlook profiles
    - Drops file in System32 directory
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:2716
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      4⤵
      Suspicious use of WriteProcessMemory
      PID:540
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2276
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        5⤵
        
        PID:4308
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        5⤵
        
        PID:4356
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      4⤵
      PID:548
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2404
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        
        PID:4532
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpD60A.tmp.bat
      4⤵
      PID:4420
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:444
    - - C:\Windows\system32\taskkill.exe
        
        TaskKill /F /IM 2716
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3776
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 2 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4600
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WorldWindClient.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WorldWindClient.exe"
    3⤵
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3000
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2204
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        5⤵
        
        PID:1584
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        5⤵
        
        PID:452
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2952
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3840
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        
        PID:5108

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2.exe

Path C:\ProgramData\Synaptics\2.exe
Size 71KB
SHA256 01de109e43797dc6dfe00f67624fa30de1e55b2b1bfb677ac130680330a7d8e5
MD5 e7871d01644e5514f8dd627f43a8bf7d
SHA1 b951bc913cb03ea95f787d52735ecdab117b1d13
SHA512 e16f0ce1bafb79ca861f0cadcf2f058066f9222e658aa68d314ccb366937612e212851661b44c8b7ba4ba5243b86d24c53e13967e9fdd35537e5241d06d1ea79
SSDEEP 1536:va5jjXUYGy23ZY+LBEkyyBLd0y/zIF3RW+ZnXD9wR+qEnNX05Eb3:y5jjXUjZBLi7FfJBuENEyb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

2.exe

Path C:\ProgramData\Synaptics\2.exe
Size 71KB
SHA256 01de109e43797dc6dfe00f67624fa30de1e55b2b1bfb677ac130680330a7d8e5
MD5 e7871d01644e5514f8dd627f43a8bf7d
SHA1 b951bc913cb03ea95f787d52735ecdab117b1d13
SHA512 e16f0ce1bafb79ca861f0cadcf2f058066f9222e658aa68d314ccb366937612e212851661b44c8b7ba4ba5243b86d24c53e13967e9fdd35537e5241d06d1ea79
SSDEEP 1536:va5jjXUYGy23ZY+LBEkyyBLd0y/zIF3RW+ZnXD9wR+qEnNX05Eb3:y5jjXUjZBLi7FfJBuENEyb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOIC.exe

Path C:\ProgramData\Synaptics\LOIC.exe
Size 238KB
SHA256 be3db90fc447ea9ff809c6b1fa764547cb571839a7c145ada9f6b80cf0454538
MD5 7674c396a3cb2a46fa7f6be6e8ff053f
SHA1 220e67050920d924af1c4bf009cdb1933e6f3a9a
SHA512 eed4e855a28555c32453ae2fd9c09729824da1c2e41af96e997df184a5155605cca3526ada7d6bc6086a7ae97237d01c91d3390eab1e1a355696c2a6a5a361a5
SSDEEP 3072:4zoXRbtRkUYKPbc3qFAytKWRiU6NR2kgijQhHdf0cW48kLcdo2umHSYOWmhrX3VG:4z0btTcZtckgymHdyJkQo2VSFrX3VO/
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOIC.exe

Path C:\ProgramData\Synaptics\LOIC.exe
Size 238KB
SHA256 be3db90fc447ea9ff809c6b1fa764547cb571839a7c145ada9f6b80cf0454538
MD5 7674c396a3cb2a46fa7f6be6e8ff053f
SHA1 220e67050920d924af1c4bf009cdb1933e6f3a9a
SHA512 eed4e855a28555c32453ae2fd9c09729824da1c2e41af96e997df184a5155605cca3526ada7d6bc6086a7ae97237d01c91d3390eab1e1a355696c2a6a5a361a5
SSDEEP 3072:4zoXRbtRkUYKPbc3qFAytKWRiU6NR2kgijQhHdf0cW48kLcdo2umHSYOWmhrX3VG:4z0btTcZtckgymHdyJkQo2VSFrX3VO/
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
Size 1.1MB
SHA256 721deeddd57e11fb7d7ae4acef3737f6c482803febf84d4189ed6fc460c923a4
MD5 de7e7f2812847b3fcab8158593084606
SHA1 35091fee074d8346c846623f76d1009bd3e6d266
SHA512 e97324003865e60d18d747e96a77ae39cfcc3e692ea1d7595b34f70305db0fb0e5db2ffc214c81e5d304bbc3d639a3fde18ca96cc19284f4de15bea3d686e6f7
SSDEEP 24576:FXHb4I+KDILKHEKPZjlDD9tGyrkft2yQ53wn:tbKKDslKPD6yr8Q5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
Size 1.1MB
SHA256 721deeddd57e11fb7d7ae4acef3737f6c482803febf84d4189ed6fc460c923a4
MD5 de7e7f2812847b3fcab8158593084606
SHA1 35091fee074d8346c846623f76d1009bd3e6d266
SHA512 e97324003865e60d18d747e96a77ae39cfcc3e692ea1d7595b34f70305db0fb0e5db2ffc214c81e5d304bbc3d639a3fde18ca96cc19284f4de15bea3d686e6f7
SSDEEP 24576:FXHb4I+KDILKHEKPZjlDD9tGyrkft2yQ53wn:tbKKDslKPD6yr8Q5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpD60A.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpD60A.tmp.bat
Size 202B
SHA256 b6e7a3de81498c1dc8bc7d9adce13062ba22efcfe1a6687387d6292dfd496cb5
MD5 84079a28c46a14a6b0eb6895ac9e5345
SHA1 06ff0a5c217cd6a8383c08423347e1da4239d84e
SHA512 8f1592977d144b7e622415745728062ce5b3fe157272a5237cfebd13c660a23712b23d78e082ee6321f15cacc87bdf3b7cf5033bab3585a4f77a044abb82d05c
MD5 SHA1 SHA512

Submit Download

1.bat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.bat
Size 42B
SHA256 949d5e216f4e6efa124ab5c84537e85f901756b18e8af4fd96bbc949a528480c
MD5 fd66b8c018571b107c004ea6d24aaa5e
SHA1 e95765d2acd22c4b3cc4f58126ac63283b941a55
SHA512 765f710c5d6d26465da19af840afbb7f06bf6f95a4a708d395ffb9e8e31df751ee6047ccbda18fa88f06c88b95b5d48371b64d8f85175d689fe12e34b624dc5e
MD5 SHA1 SHA512

Submit Download

1.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe
Size 310KB
SHA256 c5d7b73005a23bece094191672e0601437434952e1354cd3866bbb0f6e039973
MD5 4ea26ba1bd9f6ef40dcf0e373014c8ba
SHA1 7b65a49e64bc20675eba7c8c19c5fb8af4795ec2
SHA512 e6f84dfa01849dd33e287d4e589af9eb80d1c98079172c892eda3359ecceedf5333b317336a4b5aaab295a0a5bd0c5266a51f98807cc55906daafce6a94533d0
SSDEEP 6144:H8JsLcpjzTDDmHayakLkrb4NSarQWtT+tG1X2:8zxzTDWikLSb4NS7ET+tG1X2
MD5 SHA1 SHA512 SSDEEP

Submit Download

1.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.exe
Size 310KB
SHA256 c5d7b73005a23bece094191672e0601437434952e1354cd3866bbb0f6e039973
MD5 4ea26ba1bd9f6ef40dcf0e373014c8ba
SHA1 7b65a49e64bc20675eba7c8c19c5fb8af4795ec2
SHA512 e6f84dfa01849dd33e287d4e589af9eb80d1c98079172c892eda3359ecceedf5333b317336a4b5aaab295a0a5bd0c5266a51f98807cc55906daafce6a94533d0
SSDEEP 6144:H8JsLcpjzTDDmHayakLkrb4NSarQWtT+tG1X2:8zxzTDWikLSb4NS7ET+tG1X2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Flood http.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Flood http.exe
Size 765KB
SHA256 89ff3b4684a524868779ebf7ba551eb697245d2fdcde09d37e5f964533d7fcce
MD5 1f7d25518ab99eab5f8fdeeaf53060c2
SHA1 bfc1c9782e91fa6e33b8b5454655691bf34497bc
SHA512 12cb32127d2933538bae3c935606604a06e3426c6c5de6fc490fda70eacf84a836a00bdd96894151065117e3e7c7652de0282a1c22131b2c6f7ffd05602d3b84
SSDEEP 12288:zzxzTDWikLSb4NS7U/X+XBOwneuVRp3iZKmQ/7OFn2kSnpPGUEypyucrIOCxOoZB:5DWHSb4NBX6OtaRpSZKmQDO0kYEypyPu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Flood http.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Flood http.exe
Size 765KB
SHA256 89ff3b4684a524868779ebf7ba551eb697245d2fdcde09d37e5f964533d7fcce
MD5 1f7d25518ab99eab5f8fdeeaf53060c2
SHA1 bfc1c9782e91fa6e33b8b5454655691bf34497bc
SHA512 12cb32127d2933538bae3c935606604a06e3426c6c5de6fc490fda70eacf84a836a00bdd96894151065117e3e7c7652de0282a1c22131b2c6f7ffd05602d3b84
SSDEEP 12288:zzxzTDWikLSb4NS7U/X+XBOwneuVRp3iZKmQ/7OFn2kSnpPGUEypyucrIOCxOoZB:5DWHSb4NBX6OtaRpSZKmQDO0kYEypyPu
MD5 SHA1 SHA512 SSDEEP

Submit Download

WorldWindClient.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WorldWindClient.exe
Size 170KB
SHA256 e6ed27b49434df1a90585bceb02ce9386ebda400bbf2647fc335641b48332600
MD5 4149605cf9386222dfe2179096562fc0
SHA1 a82072c1dd97d2b304b4129caf3e13fca93a95b1
SHA512 2f5d4e847d159dee8dea00faf73f0914fdda433d60c16543bb1f7dd2a95b0985834ed691589d44ebf4d64c376f58dfb7edfc4f4b826ab4fc7d11b12bd04cfe7e
SSDEEP 3072:++STW8djpN6izj8mZwdJqutB+YDpqIPu/i9bVK2cAGV6+Wp7:j8XN6W8mmHPtppXPSi9b43
MD5 SHA1 SHA512 SSDEEP

Submit Download

WorldWindClient.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WorldWindClient.exe
Size 170KB
SHA256 e6ed27b49434df1a90585bceb02ce9386ebda400bbf2647fc335641b48332600
MD5 4149605cf9386222dfe2179096562fc0
SHA1 a82072c1dd97d2b304b4129caf3e13fca93a95b1
SHA512 2f5d4e847d159dee8dea00faf73f0914fdda433d60c16543bb1f7dd2a95b0985834ed691589d44ebf4d64c376f58dfb7edfc4f4b826ab4fc7d11b12bd04cfe7e
SSDEEP 3072:++STW8djpN6izj8mZwdJqutB+YDpqIPu/i9bVK2cAGV6+Wp7:j8XN6W8mmHPtppXPSi9b43
MD5 SHA1 SHA512 SSDEEP

Submit Download

http.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\http.exe
Size 469KB
SHA256 59af5b6ab7c95657e256926fa80f3de9bdaebf3a888838590f770e6000b67490
MD5 bc6ba434dfe9ffcc5268c3bd9beb7dd8
SHA1 7b19a836125c2fa96fd11f04fb82bdaa2682b97a
SHA512 c86bfb163e22f17026aca681ed4ed372812e7371836e4e51a028645db2929c19c87ae268f3d882602e9b01381437fb6ba15791359d40a08833e0d6ed283e1d00
SSDEEP 12288:8zxzTDWikLSb4NS7ET+tG1XI1lRgmmv/yhpumg/:6DWHSb4NhSf5mvoumg/
MD5 SHA1 SHA512 SSDEEP

Submit Download

http.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\http.exe
Size 469KB
SHA256 59af5b6ab7c95657e256926fa80f3de9bdaebf3a888838590f770e6000b67490
MD5 bc6ba434dfe9ffcc5268c3bd9beb7dd8
SHA1 7b19a836125c2fa96fd11f04fb82bdaa2682b97a
SHA512 c86bfb163e22f17026aca681ed4ed372812e7371836e4e51a028645db2929c19c87ae268f3d882602e9b01381437fb6ba15791359d40a08833e0d6ed283e1d00
SSDEEP 12288:8zxzTDWikLSb4NS7ET+tG1XI1lRgmmv/yhpumg/:6DWHSb4NhSf5mvoumg/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synaptics.exe

Path C:\Users\Admin\AppData\Roaming\Synaptics.exe
Size 71KB
SHA256 01de109e43797dc6dfe00f67624fa30de1e55b2b1bfb677ac130680330a7d8e5
MD5 e7871d01644e5514f8dd627f43a8bf7d
SHA1 b951bc913cb03ea95f787d52735ecdab117b1d13
SHA512 e16f0ce1bafb79ca861f0cadcf2f058066f9222e658aa68d314ccb366937612e212851661b44c8b7ba4ba5243b86d24c53e13967e9fdd35537e5241d06d1ea79
SSDEEP 1536:va5jjXUYGy23ZY+LBEkyyBLd0y/zIF3RW+ZnXD9wR+qEnNX05Eb3:y5jjXUjZBLi7FfJBuENEyb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synaptics.exe

Path C:\Users\Admin\AppData\Roaming\Synaptics.exe
Size 71KB
SHA256 01de109e43797dc6dfe00f67624fa30de1e55b2b1bfb677ac130680330a7d8e5
MD5 e7871d01644e5514f8dd627f43a8bf7d
SHA1 b951bc913cb03ea95f787d52735ecdab117b1d13
SHA512 e16f0ce1bafb79ca861f0cadcf2f058066f9222e658aa68d314ccb366937612e212851661b44c8b7ba4ba5243b86d24c53e13967e9fdd35537e5241d06d1ea79
SSDEEP 1536:va5jjXUYGy23ZY+LBEkyyBLd0y/zIF3RW+ZnXD9wR+qEnNX05Eb3:y5jjXUjZBLi7FfJBuENEyb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AnonFileApi.dll

Path C:\Windows\SysWOW64\AnonFileApi.dll
Size 293KB
SHA256 75db945388f62f2de3d3eaae911f49495f289244e2fec9b25455c2d686989f69
MD5 7a2d5deab61f043394a510f4e2c0866f
SHA1 ca16110c9cf6522cd7bea32895fd0f697442849b
SHA512 b66b0bf227762348a5ede3c2578d5bc089c222f632a705241bcc63d56620bef238c67ca2bd400ba7874b2bc168e279673b0e105b73282bc69aa21a7fd34bafe0
SSDEEP 6144:1YYua6E5OQB+4M5erCkGQ+Qo2gxYQWoclJjzNV0zFKZ2v92PTr3g2uKGYPbRiWm:1pgI1BTMEGkYjxYQWoEJHNV0SPTrw2ux
MD5 SHA1 SHA512 SSDEEP

Submit Download

DotNetZip.dll

Path C:\Windows\SysWOW64\DotNetZip.dll
Size 448KB
SHA256 00da1597d92235d3f84da979e2fa5dbf049bafb52c33bd6fc8ee7b29570c124c
MD5 6d1c62ec1c2ef722f49b2d8dd4a4df16
SHA1 1bb08a979b7987bc7736a8cfa4779383cb0ecfa6
SHA512 c0dce8eaa52eb6c319d4be2eec4622bb3380c65b659cfb77ff51a4ada7d3e591e791ee823dad67b5556ffac5c060ff45d09dd1cc21baaf70ba89806647cb3bd2
SSDEEP 6144:FuCIjOL8qwWN/jMlC/XiapWSu9vnITVxGtSV41kJDsTDD5rlGe6wfxLV/7:dZLJLdvOSsnjS4csBrge6sf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

StormKittyBuild.exe

Path C:\Windows\SysWOW64\StormKittyBuild.exe
Size 309KB
SHA256 3aac01a9606376d386e6b91e5ec5cc147ee07dbea224834a24135e440de53cab
MD5 a354d5170202e6741ff7643ec5bd04f2
SHA1 5f8d8e06ca4cefbabe999f47c6ae24c7541f08ab
SHA512 0b3f6fa1a8685afcfc019379d52627df1ae7b0f07ca7f443f28a9f0a9feda7210b1d3031264c58aaac217129a763d22a3bbe37448421c6745f195c0f433ea360
SSDEEP 6144:p3gP8WtFyq81ieTqOMiScBL8w+2KW57kt4YwJ7/9ioNEotdSTxYGlN:p3mtgTqOMbY8w+I57kt4r/9igEp2c
MD5 SHA1 SHA512 SSDEEP

Submit Download

StormKittyBuild.exe

Path C:\Windows\SysWOW64\StormKittyBuild.exe
Size 309KB
SHA256 3aac01a9606376d386e6b91e5ec5cc147ee07dbea224834a24135e440de53cab
MD5 a354d5170202e6741ff7643ec5bd04f2
SHA1 5f8d8e06ca4cefbabe999f47c6ae24c7541f08ab
SHA512 0b3f6fa1a8685afcfc019379d52627df1ae7b0f07ca7f443f28a9f0a9feda7210b1d3031264c58aaac217129a763d22a3bbe37448421c6745f195c0f433ea360
SSDEEP 6144:p3gP8WtFyq81ieTqOMiScBL8w+2KW57kt4YwJ7/9ioNEotdSTxYGlN:p3mtgTqOMbY8w+I57kt4r/9igEp2c
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2236-137-0x00007FF984A20000-0x00007FF9854E1000-memory.dmp

Download

memory/2236-132-0x0000000000F20000-0x0000000000F26000-memory.dmp

Download

memory/2236-133-0x00007FF984A20000-0x00007FF9854E1000-memory.dmp

Download

memory/2292-172-0x00007FF97ACE0000-0x00007FF97B716000-memory.dmp

Download

memory/2716-192-0x000000001CB70000-0x000000001CBF4000-memory.dmp

Download

memory/2716-148-0x00007FF984970000-0x00007FF985431000-memory.dmp

Download

memory/2716-198-0x00007FF984970000-0x00007FF985431000-memory.dmp

Download

memory/2716-144-0x0000000000E00000-0x0000000000E50000-memory.dmp

Download

memory/2716-167-0x00007FF984970000-0x00007FF985431000-memory.dmp

Download

memory/2716-191-0x000000001CA60000-0x000000001CAD6000-memory.dmp

Download

memory/3136-171-0x000000006F4C0000-0x000000006FA71000-memory.dmp

Download

memory/3136-164-0x000000006F4C0000-0x000000006FA71000-memory.dmp

Download

memory/4208-165-0x00007FF97ACE0000-0x00007FF97B716000-memory.dmp

Download

memory/4844-174-0x00000000058E0000-0x0000000005972000-memory.dmp

Download

memory/4844-166-0x0000000004A90000-0x0000000004AF6000-memory.dmp

Download

memory/4844-175-0x0000000005F30000-0x00000000064D4000-memory.dmp

Download

memory/4844-183-0x0000000005A00000-0x0000000005A0A000-memory.dmp

Download

memory/4844-150-0x0000000000140000-0x0000000000170000-memory.dmp

Download