Extracted

• • Target

    Document25.xlsm

  • Size

    36KB

  • MD5

    7ac07195f03358c51fbb2e422a8b5452

  • SHA1

    a4e0c6f0797f655c26d920cf8474e21815435455

  • SHA256

    5d12f3d6b8c0418215b29ad3afb0a3448966a6eaeb02dca2e89d6bff5d8e2570

  • SHA512

    2d34931e2ada796342d351de141ccfa8fae75192918fe5be3224d222a891bab957f64a9b1e16219db8d17fc8d761b29b1788937b777205c95abcf5830ab66ae0

  • SSDEEP

    768:hETn4o5bHOKYdjaALFIOldjZ7aN9QnIpdCEuEC2t:hETNbBALFtldZ7aD5D79

  Score

  10^/10

  asyncratvenomratdefaultdiscoveryexecutionpersistenceratstormkittystealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Stormkitty family

    stormkitty

  • VenomRAT

    Detects VenomRAT.

    rat

  • Venomrat family

    venomrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2