Overview

overview

10

Static

static

1

7623799dc5...1N.exe

windows7-x64

10

7623799dc5...1N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7623799dc5b101e55edb08459ff09232d41579776b1110ae119c52580ed09c41N.exe

  • Size

    3.2MB

  • Sample

    241222-g6t3wsxldz

  • MD5

    2fcda8a0696d0cb8735e8243524ab110

  • SHA1

    4c1ef9e0ab4bc7fd4fb673b6af627830b0a8f9c4

  • SHA256

    7623799dc5b101e55edb08459ff09232d41579776b1110ae119c52580ed09c41

  • SHA512

    a76c2bb7e1831f0e29fca56f979f786437021f64d874c9d9294be9e87860c9edaf4cd59e47130411783ea364c5c7fa5655266dc11f5e13a5d23d245d7b5525cd

  • SSDEEP

    98304:kKaLGKadqrcJJbruZjqdJ9SSFXO0UDae0AXkv5Iw5dI:ELK+ROqSFe0fAXE5Iw5i

Score
10/10
asyncratstormkittyvenomratdiscoveryratstealer

Malware Config

Targets

    • Target

      7623799dc5b101e55edb08459ff09232d41579776b1110ae119c52580ed09c41N.exe

    • Size

      3.2MB

    • MD5

      2fcda8a0696d0cb8735e8243524ab110

    • SHA1

      4c1ef9e0ab4bc7fd4fb673b6af627830b0a8f9c4

    • SHA256

      7623799dc5b101e55edb08459ff09232d41579776b1110ae119c52580ed09c41

    • SHA512

      a76c2bb7e1831f0e29fca56f979f786437021f64d874c9d9294be9e87860c9edaf4cd59e47130411783ea364c5c7fa5655266dc11f5e13a5d23d245d7b5525cd

    • SSDEEP

      98304:kKaLGKadqrcJJbruZjqdJ9SSFXO0UDae0AXkv5Iw5dI:ELK+ROqSFe0fAXE5Iw5i

    Score
    10/10
    asyncratstormkittyvenomratdiscoveryratstealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • VenomRAT

      Detects VenomRAT.

      rat

    • Venomrat family

      venomrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks