Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-01-2025 12:06
General
-
Target
2401419d189d439cdbd5a3cc97d6afaa77570e866862f7b213c6541e1f48b5b8.exe
-
Size
3.0MB
-
MD5
595231af8783e25f2ff3d8d6344c2e8f
-
SHA1
d1ecae98510b4136c256b1ec9c7bca62173e2f57
-
SHA256
2401419d189d439cdbd5a3cc97d6afaa77570e866862f7b213c6541e1f48b5b8
-
SHA512
ed1fa754bc890441d0e2107a1609a39e1af228a38c2bfad4da2219931c468664d4cc7dc1ca155c272bfc2a20c1146f77d6d52220e9eaaff22e1ae357b8f84d53
-
SSDEEP
49152:0GVLgqHU3mdatQdsgUBX3B3kNC3H6vUZkr/N2e:0GFQ3mdatQSx
Score
10/10
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Venomrat family
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2401419d189d439cdbd5a3cc97d6afaa77570e866862f7b213c6541e1f48b5b8.exe"C:\Users\Admin\AppData\Local\Temp\2401419d189d439cdbd5a3cc97d6afaa77570e866862f7b213c6541e1f48b5b8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
3.0MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB