fid1747308966_RunQMhunt.exe.zip
- SHA256 1038b6398fcc8e537cbeebc9b8536d01c29422a7003dfa7eb27042db8a509a59
Behavioral task
behavioral1
Sample
tmp/RunQMhunt.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp/RunQMhunt.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
General
- Target fid1747308966_RunQMhunt.exe.zip
- Size 4.6MB
- Sample260604-pj32aaev6x
- SHA256 1038b6398fcc8e537cbeebc9b8536d01c29422a7003dfa7eb27042db8a509a59
- MD5 b11c0a6e5353722e1897c66ee005a553
- SHA1 d0508d51d3efe2620b9ef93fec84ef29f4907d94
- SHA512 5e246309b740f39a310f6dc26d5e7576d9612c91b73903932d9d1fa788a71fc1595157ec482e9c8bdd0c9d0e4aec5f5a6f08212814b8fa48cb6e89e1992d3891
- SSDEEP 98304:QpQDxEEoYPcoa9jnE1xascbaCENd3YVybu0uZhGSYil+bqhZ4:QyDuEomcoaNnEGscbaCqdIVIubbGSYia
- TLSH T1F62633CAFEDD9F5D353A835688A96D3A19107F817F19D1D0E2994200E2B34CB785F24E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: StormKitty
StormKitty is an open source info stealer written in C#.
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/tmp/RunQMhunt.exe disable_win_def - StormKitty payload 1 IoCs
resource yara_rule static1/unpack001/tmp/RunQMhunt.exe family_stormkitty
File Explorer
-
fid1747308966_RunQMhunt.exe.zip.zip 4.6MB
-
tmp/RunQMhunt.exe.exe 15.7MB
tmp/RunQMhunt.exe
- IMPHASH 3739209cb2e8009dbccb6480c1f6dd1a
- SHA256 f7fdbbcd974ddad321ae089b5ddb02ce92a1074fce403c6500db9e3ea0d2a8a5
- MD5 7b74ef46b8cf06d43eed44da4b42a569
- SHA1 41257b453ed92efd8b429ed269cded0929858cb0
- SHA512 1d7f51e93c9bd1e62ec1136cb361b2c7766e3d159e4d70c5d5182611ba66d49c27a1bdc43ddf61a00d57a5632b894f49b626cb53c868011cd4da0665f0a5d03a
- SSDEEP 98304:jXPRo8aPss+rpOV9ca4JxPwoR58pq0r7OR+FssiCirgfnA10KqiDOlLHE2p10:Lxoss+cZo70r7hXiYfnA1nVg0
- TLSH T111F66C13BF65F8E9C639C134863B5366BF76F80C0736A7EB129446263E11AC02E75B25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
StormKitty payload
Digest
34:75:10:fb:7f:72:e7:6c:fe:59:65:2e:02:a4:29:bc:45:d6:85:22:ae:a2:68:79:84:a8:8a:86:eb:e7:6a:c3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
Chains
May 15, 2025
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
Serial Number
0d:da:f2:fe:51:f3:b2:e9:4c:bb:69:5a:4a:51:74:fc
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 18, 2022 - Oct 17, 2025
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
32387
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\UGit\qqpcmgr_proj\FTCommon\FTCommonTestTool\Release\RunQMhunt.pdb
kernel32
SizeofResource
GetCommandLineW
TerminateProcess
GetModuleFileNameW
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
LockResource
Process32FirstW
CloseHandle
GetNativeSystemInfo
LoadLibraryW
LoadResource
FindResourceW
SetCurrentDirectoryW
GetProcAddress
LocalFree
ExitProcess
CreateProcessW
FreeLibrary
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
FormatMessageA
shell32
CommandLineToArgvW
msvcp140
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Xout_of_range@std@@YAXPBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
shlwapi
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
vcruntime140
__std_exception_destroy
__CxxFrameHandler3
__std_terminate
__current_exception
memset
_CxxThrowException
__current_exception_context
memcpy
_except_handler4_common
__std_exception_copy
memmove
api-ms-win-crt-filesystem-l1-1-0
_wmkdir
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
free
_callnewh
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-stdio-l1-1-0
__p__commode
fclose
_wfopen_s
fwrite
_set_fmode
api-ms-win-crt-runtime-l1-1-0
perror
_crt_atexit
_c_exit
_cexit
_invalid_parameter_noinfo_noreturn
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_initialize_onexit_table
_set_app_type
_seh_filter_exe
_controlfp_s
_exit
_register_onexit_function
terminate
_register_thread_local_exe_atexit_callback
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15.7MB
Virtual Size
15.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=260, version=30034,
count=1, id=259, version=30034,
count=26, id=261, version=30034,
count=4, id=257, version=30034,
count=7, id=257, version=30795,
count=163, id=1, productName=Unmarked objects,
count=1, id=265, version=30157,
count=1, id=255, version=30157,
count=1, id=151,
count=1, id=258, version=30157,