Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
13/01/2025, 01:06
250113-bf23xsxrgx 1012/01/2025, 12:49
250112-p2tkkasphv 1010/01/2025, 14:10
250110-rgr74sylhj 10Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2025, 14:10
Behavioral task
behavioral1
Sample
8c6a99f240d978718d2f962619c23168.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8c6a99f240d978718d2f962619c23168.exe
Resource
win10v2004-20241007-en
General
-
Target
8c6a99f240d978718d2f962619c23168.exe
-
Size
3.0MB
-
MD5
8c6a99f240d978718d2f962619c23168
-
SHA1
cbee26a0553840d6f3cdb5fc306c3bc13cdbf7d4
-
SHA256
240175a3a74b70fb9f6d0463042d6ef21223e2acc843e589d91ec607d52305a8
-
SHA512
7044b7909f48f4ff5b58b0412b573a7fef145d8c3dd24bee76c5fd215aa7addd4af9f6818426409055a7ab99cbca7d619f92205dae21de2ea108e063b269e6b0
-
SSDEEP
49152:XPCQNqtCSmdatQdsgUBX3B3kNC3H6vUZikr/Nxe:XPVlSmdatQSN
Malware Config
Signatures
-
Asyncrat family
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/1624-1-0x0000000000E60000-0x0000000001164000-memory.dmp family_stormkitty -
Stormkitty family
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe 1624 8c6a99f240d978718d2f962619c23168.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1624 8c6a99f240d978718d2f962619c23168.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1624 8c6a99f240d978718d2f962619c23168.exe