Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 01:41
General
- Target dopuslib.dll
- Size 427.9MB
- Sample260503-b4ebrsd18l
- SHA256 153888d497bbc1dc488dcbe6b2ef1bbcf4ccedff48ce9ca8f11fb37a71b2adb5
Malware Config
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: StormKitty
StormKitty is an open source info stealer written in C#.
- Family: VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
- Async RAT payload 1 IoCs
- StormKitty payload 2 IoCs
- VenomRAT 2 IoCs
Detects VenomRAT.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\dopuslib.dll1⤵
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Temp\xkpsm.sysC:\Windows\Temp\xkpsm.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd /c cd /d "C:\Users\Admin\AppData\Roaming\USB30VCBSDRY" & "C:\Users\Admin\AppData\Roaming\USB30VCBSDRY\regsvr32.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\USB30VCBSDRY\regsvr32.exe"C:\Users\Admin\AppData\Roaming\USB30VCBSDRY\regsvr32.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
f95051356dc80161.tmp
TextShaping.dll
dpnhupnp.dll
imageres.dll
regsvr32.exe
xkpsm.sys
memory/1528-4468-0x00007FF978BC0000-0x00007FF978C6E000-memory.dmp
memory/1528-4466-0x00007FF979640000-0x00007FF979849000-memory.dmp
memory/1528-4469-0x00007FF9784E0000-0x00007FF97867A000-memory.dmp
memory/1528-4470-0x00007FF977500000-0x00007FF977878000-memory.dmp
memory/1528-4467-0x00007FF978420000-0x00007FF9784DD000-memory.dmp
memory/2876-2-0x0000000000010000-0x0000000000018000-memory.dmp
memory/6072-4482-0x0000000005D60000-0x0000000005D70000-memory.dmp
memory/6072-4477-0x00000000060C0000-0x0000000006666000-memory.dmp
memory/6072-4481-0x0000000005B80000-0x0000000005BE6000-memory.dmp
memory/6072-4473-0x0000000001100000-0x0000000001440000-memory.dmp
memory/6072-4483-0x0000000006B90000-0x0000000006C22000-memory.dmp
memory/6072-4484-0x0000000006B40000-0x0000000006B4A000-memory.dmp
memory/6072-4485-0x0000000006B00000-0x0000000006B07000-memory.dmp
memory/6072-4486-0x0000000005D60000-0x0000000005D70000-memory.dmp
memory/6072-4489-0x0000000007220000-0x00000000072BC000-memory.dmp
memory/6072-4490-0x0000000007760000-0x0000000007782000-memory.dmp
memory/6072-4491-0x0000000007790000-0x0000000007AE7000-memory.dmp