�7?1J�8-�b!���:���X%�yk&��A����u�<��GB �`+���]X�Խ���k_80*�7��EVV�f;N^��v��A;�����ߖ��+�gO���c>{��k�ӻ�>vr�y�D�^:���C]�"(�?��3�i�NH�t^�>�Bx����1k�5�i���SOc���c�ۙr���PdDN�!p5P�h_䳅��M�|���:��$ ��FV��������se!�wLi]������� z�lr�=�������$2��O�B��.�h�ū�?��0����<���"Uٽ���l�ܴ����j-B7�z�z�H�٣��g)�'���_��Zl0������j�'�t�TքT��"�� �Y��ϧ���Z0��6��8z�E�q[1���������l;��_M %�>�Z=��V��#u���K����[�L�,��C��G�N7vv�!�kx�V&'���8�� �Iu�X��x���:�Ds�W�� E��K&��t�"p{����^�@_/q2D�r����?�I�'�L\"��J���d��D�:��;��i�9�ߟ*g��k*=��\�$�����Ұ{����_Q����:���~�m�_}��/����*����a_�����}�n�lt����A6$G̓~��K��'���h����q�x,̫C9�,��^������/�#��eF̟~j�y�r��(��LB�i�X01����+#C`�Mr|7[�1?�� B,�=�\|���y��ep�"�9�IQ��c���g����[!��ތ6���b���%H��P����(�5a*���V^!3n��ݺ��W�;��!HܞIx#�eZ����^R*kd��K�Qplo���y�b�H�V��'��_\���7K�|��Oѻ��sEF̋R�<a��2���HqL��_.�b��5h�m�����d ��0�⺄���"٣r�wML�����튇��B�T:v�6鐁QD%��{Ǫ$�{����?ND��D��u��1��N��?1�T!�����{�)8��}�3^;�i��րWq���B�V�<!�L�E`v��p�v�p���2-o���0s�@�;|��_�F��O$� iH��v��w�f<rdfO��+6�Km.�*r�:����.�]������o2��|~1�/V����ExBW�`I`�������r��X�BDN�����`<�P��~c�%V���toRS�����N��b���G*�>[&�I�#�3���<���"I���"����r�Zz�vN�=_2nD:<������gb�^L1 Pc�3Z�]�S�e�q��[�n��f~�o@�㜛���i K��Ϲni�_ _�~ǕOG$ !7���js��Rhԅ��f���W��2 Ќ�a:����!:�@�P�B�f�9J�-��ؔSu$�GVY:͜5�Ds0l+�đ��C��2����N�6������Ca�v�~l_nJ�e�����r��r��+ʁ��U���<�mX�K���%�ܩb� s��N1�,��!8�d�?Y�v`{�D��7�ۼ�6F"�5�"���V�X�O��^kM�6'�S�*��c� ͞� Gd��ދ�ڔ�r�B�A�ۤ��xZԅ�i�BE|�Oy�nY����9���KŨrA�^��{Ee�iy�Q�&f�t�,?����7������/omd�^���B�;�b���Z��P�(?+��܍< �Kq�)6�4f��A��Es�,� ����^�����RM{�,!�eQ��T ���r\<���D|�S��Dt�9m����rMYޤ���8�I�K%~�"D~�sN�.��^�����H+p[<)��2����V_[Q�g����U��d,�Ǧ�ee w�y�\u�:�N�e�����A�oJG�f^�"G��a�E^9tYG�G���v8�E��g�s� �k>G��W�ѾFT��S(�/~�̛ϡ*�%h4�o�?����!?������x$^����L'����Bp�:��3����Kci�{|������*���1X���b��60K����#)��-K��Qj��>\`XC����>��Z!�cd���2�Vrx�0�u1wt���Kƍ�l���Ϛ��W�j��@EϔXW?U�V;Y�M�ouk����GL�y���qgql�5��g�O�EIn�\�AT�j4Ƚ�k��owv��0��0��F�N�z���й�2L�#��&�U.`~vy]����qz�~k��,��C��0�_k��E'��u?]���2>��&�H�G���1��˰=�"�v�|�����N���_R��D�8��ͮ�(<�4�~�N��l��P9��-��0������$���\��k��v�w��u4�f�.ZYUJ���JX�����/��r�vq��c�{ʫ$Xۭ� ��D��f�wў������ ��j״`��h\����&� h2�(�b��2b���c��#B�\4�~��!�3�=�ԢeO7}>s��eɼ&�Vm�C�*�������f�/qeL�����{��c�r�^8�����pRmI>3l���*��"BϦw@����V��]�vT&�#~��;���&��4`M����VU%�i[]�����:zSZ7��t�U�� e�>����(��f�d>�T�'�v/��er���㓓���+8j�К}�q��}2��5}Z�}YHC�*��i���2�Wķg�џ�rR�(��{ ��<'4r]����-���@יV -% 1���Vb^�f��̀2R-����ҿķn�����ϜŘ�OT0[�M���+��ہ�x� �V�7.�s�E���҂�C�Uƥ���t�Ԓ�r�ٙ��yہN��B���D�� F-a��ᄀ^�x��:����4�n�ʩ�a�2 ����Ë6,F<�-"Β���F��;�y�zg���9('��y}y����1Ə �3�;�e�)��,�Y�[A3�6��髝����v��~.�̏ϫ؛���V%TRU�"}{c��QC(�Z�p�GxيQ]��TB�)�R��d=2(��i�NQ?��ؤY؈(�Q��A���|�}� lO&�!�M_����k
Behavioral task
behavioral1
Sample
KittyClub.exe
Resource
win10v2004-20231215-en
General
-
Target
KittyClub.exe
-
Size
8.3MB
-
MD5
8dc54b3dc421bdfcce2036c297d1184e
-
SHA1
79bed1cb822c9cbf69b0901ee822bfea07bbff2c
-
SHA256
cbf4625b307cae71ac967a2f5fa99e783b85f6bade0a7ac9f9bab27508ad39d6
-
SHA512
072ffedb9727b1c3e9681fce3c8b1fcd84ebd929c599f5b791be43f702c9252b51b5a7d07533d203a6f8d6fe51f2ede6e0b870aa11fd90709e558376e0818662
-
SSDEEP
196608:47bYXrxCFt01TsYE6dj2Gn6ZWac2kHieUgP8CjE:47bY7YuTsYEcD6ZbRkqgP8C
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource KittyClub.exe
Files
-
KittyClub.exe.exe windows:6 windows x64 arch:x64
60a0c3d851a8ee405a23116d401a8991
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
winmm
PlaySoundA
kernel32
GetConsoleWindow
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCursorPos
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEncrypt
shell32
ShellExecuteExA
imm32
ImmGetContext
msvcp140
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
xinput1_3
ord4
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
urlmon
URLDownloadToFileA
ntdll
NtQuerySystemInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_wassert
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-math-l1-1-0
__setusermatherr
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertCreateCertificateChainEngine
ws2_32
closesocket
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 712KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 563KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ