Overview

overview

10

Static

static

10

8c6a99f240...68.exe

windows7-x64

10

8c6a99f240...68.exe

windows10-2004-x64

10

8c6a99f240...68.exe

android-9-x86

8c6a99f240...68.exe

android-10-x64

8c6a99f240...68.exe

android-11-x64

8c6a99f240...68.exe

macos-10.15-amd64

8c6a99f240...68.exe

ubuntu-18.04-amd64

8c6a99f240...68.exe

debian-9-armhf

8c6a99f240...68.exe

debian-9-mips

8c6a99f240...68.exe

debian-9-mipsel

Resubmissions

13-01-2025 01:06

250113-bf23xsxrgx 10

12-01-2025 12:49

250112-p2tkkasphv 10

10-01-2025 14:10

250110-rgr74sylhj 10

Analysis

  • max time kernel
    899s
  • max time network
    902s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-01-2025 01:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8c6a99f240d978718d2f962619c23168.exe

  • Size

    3.0MB

  • MD5

    8c6a99f240d978718d2f962619c23168

  • SHA1

    cbee26a0553840d6f3cdb5fc306c3bc13cdbf7d4

  • SHA256

    240175a3a74b70fb9f6d0463042d6ef21223e2acc843e589d91ec607d52305a8

  • SHA512

    7044b7909f48f4ff5b58b0412b573a7fef145d8c3dd24bee76c5fd215aa7addd4af9f6818426409055a7ab99cbca7d619f92205dae21de2ea108e063b269e6b0

  • SSDEEP

    49152:XPCQNqtCSmdatQdsgUBX3B3kNC3H6vUZikr/Nxe:XPVlSmdatQSN

Score
10/10
asyncratstormkittyratstealer

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c6a99f240d978718d2f962619c23168.exe
    C:\Users\Admin\AppData\Local\Temp\8c6a99f240d978718d2f962619c23168.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3676-0-0x00007FFBFAB63000-0x00007FFBFAB65000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3676-1-0x0000000000540000-0x0000000000844000-memory.dmp

    Filesize

    3.0MB

    Download

  • memory/3676-2-0x00007FFBFAB60000-0x00007FFBFB621000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3676-3-0x00007FFBFAB63000-0x00007FFBFAB65000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3676-4-0x00007FFBFAB60000-0x00007FFBFB621000-memory.dmp

    Filesize

    10.8MB

    Download