General
-
Target
375fc5ce0834bb83103f7cfe12af833ef4c5df4fa8a73b7e607223705fcd774b.exe
-
Size
3.2MB
-
Sample
241222-jy6sts1jbk
-
MD5
91860f67e6bf8e25fdb079a8ff7417a4
-
SHA1
98458ec95b279c5759e806c2b3c8098a6c5422b7
-
SHA256
375fc5ce0834bb83103f7cfe12af833ef4c5df4fa8a73b7e607223705fcd774b
-
SHA512
8c3df04684c976b94c93a28a8542937b58b31d18f40db897ee77280e64adfca0017a191e81f3e2808adab9d351f7f3dc2c83bfb2ec094bb8fca1212786f9df7f
-
SSDEEP
98304:kKaLGKadqrcJJbruZjqdJ9SSFXO0UDae0AXkv5Iw5dI:ELK+ROqSFe0fAXE5Iw5S
Static task
static1
Behavioral task
behavioral1
Sample
375fc5ce0834bb83103f7cfe12af833ef4c5df4fa8a73b7e607223705fcd774b.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
375fc5ce0834bb83103f7cfe12af833ef4c5df4fa8a73b7e607223705fcd774b.exe
-
Size
3.2MB
-
MD5
91860f67e6bf8e25fdb079a8ff7417a4
-
SHA1
98458ec95b279c5759e806c2b3c8098a6c5422b7
-
SHA256
375fc5ce0834bb83103f7cfe12af833ef4c5df4fa8a73b7e607223705fcd774b
-
SHA512
8c3df04684c976b94c93a28a8542937b58b31d18f40db897ee77280e64adfca0017a191e81f3e2808adab9d351f7f3dc2c83bfb2ec094bb8fca1212786f9df7f
-
SSDEEP
98304:kKaLGKadqrcJJbruZjqdJ9SSFXO0UDae0AXkv5Iw5dI:ELK+ROqSFe0fAXE5Iw5S
-
Asyncrat family
-
StormKitty payload
-
Stormkitty family
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Venomrat family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates processes with tasklist
-