Analysis
-
max time kernel
134s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
03-02-2025 04:19
General
-
Target
dd.exe
-
Size
3.0MB
-
MD5
255f077cd026e04fbf542df703512b8c
-
SHA1
47d0a8f98892c71bdda1a818e941d5539b70838c
-
SHA256
c73164d91bc07cd812b7897f7660ce5dba9b28dc2452569b8e94389008c7a393
-
SHA512
d3494fcf62f41c728d9f4ec0c1a92b56e68739754883e60fba93438957b17284c8ff735ca866b2f5247d38c177d15bc7029add9f211f981ee5c7f8d396627b04
-
SSDEEP
49152:0NOA+ib1Yw3TLOLS/9gUBO3B3kNC3H6vUZgr/NFQ:0NOZ6YCOLSV
Score
10/10
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Venomrat family
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd.exe"C:\Users\Admin\AppData\Local\Temp\dd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB