Behavioral task
behavioral1
Sample
372-77-0x0000000001170000-0x0000000002170000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
372-77-0x0000000001170000-0x0000000002170000-memory.exe
Resource
win10v2004-20240426-en
General
-
Target
372-77-0x0000000001170000-0x0000000002170000-memory.dmp
-
Size
16.0MB
-
MD5
00b28e3bc1c344493f2e4032ef716c56
-
SHA1
41a726e4159f158cef8a1f00ce23962756910b77
-
SHA256
5e081978e4947c24713bbd2969544121801b5c12aa49e5e30a58c7376b2ff260
-
SHA512
14824f8cdf039fb1817162238be7c78efa6b75eac85fa435b7102cb32b2c69a91fb787279e363984a6de4d9bf07e39f38bdcc00e79de6a647b42f02f6770d13f
-
SSDEEP
3072:WpST7JS3xDUKuBg7JBZ3c3nMZPYOoJIvqIeu/i9bdJ2cewTob+WpN:FJ2dUKFJB5c0XeSi9b7
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6889241853:AAHAa8eUBd5h6tWRG0OvgDx7o1_LKQJi-y8/sendMessage?chat_id=6367688286
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
StormKitty payload 1 IoCs
Processes:
resource yara_rule sample family_stormkitty -
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 372-77-0x0000000001170000-0x0000000002170000-memory.dmp
Files
-
372-77-0x0000000001170000-0x0000000002170000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ