Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31/12/2024, 12:02
General
-
Target
4448-2-0x0000000005240000-0x0000000005544000-memory.exe
-
Size
3.0MB
-
MD5
71196f07827a112df47dd2921241eee7
-
SHA1
b475271485bf182ecacdbc20c63ed6b00524a2b9
-
SHA256
dbd418893b7c30779a5736161f94ce0bdccc81f01c6eee54c419b0547edee971
-
SHA512
783b634d3efea801e895a12f994140f796cefdbfed5a542fc962459e73451167329e5d9fb98dcbe85f04a31817022f81385c531ef558f3c9f084897431bd9c6d
-
SSDEEP
49152:XPCQNqtCSmdatQdsgUBX3B3kNC3H6vUZIr/Nxe:XPVlSmdatQSq
Score
10/10
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4448-2-0x0000000005240000-0x0000000005544000-memory.exe"C:\Users\Admin\AppData\Local\Temp\4448-2-0x0000000005240000-0x0000000005544000-memory.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.0MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB