Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-01-2025 04:48
General
-
Target
6bd9630999522db1db619d66da46f5b83e466d1612bc62c5799007d58f52ed8c.exe
-
Size
3.0MB
-
MD5
732db9390cc94d898d874b151b1a512d
-
SHA1
e9f25950c2b525a5658129cf9601545546f95454
-
SHA256
6bd9630999522db1db619d66da46f5b83e466d1612bc62c5799007d58f52ed8c
-
SHA512
7aae4b8d7c5746cc26e0927696ddac4907561efbff8772b65ad36b4525a4730ecbf5b513eb9896be26b193f74e7d3cbff23c928168757a472206eee4cabb0b3e
-
SSDEEP
49152:0GVLgqHU3mdatQdsgUBX3B3kNC3H6vUZNr/N2e:0GFQ3mdatQSQ
Score
10/10
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Venomrat family
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bd9630999522db1db619d66da46f5b83e466d1612bc62c5799007d58f52ed8c.exe"C:\Users\Admin\AppData\Local\Temp\6bd9630999522db1db619d66da46f5b83e466d1612bc62c5799007d58f52ed8c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.0MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB