fid1747209335_RunQMhunt.exe.zip
- SHA256 51c5bc2f73aec53e327a2091a26e96d5dd396c0fb3a235d3e5bdc71c7cedcad9
Behavioral task
behavioral1
Sample
tmp/RunQMhunt.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp/RunQMhunt.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
General
- Target fid1747209335_RunQMhunt.exe.zip
- Size 4.6MB
- Sample260604-pjskjsfv2p
- SHA256 51c5bc2f73aec53e327a2091a26e96d5dd396c0fb3a235d3e5bdc71c7cedcad9
- MD5 eee73353ab048576e2f966760654df94
- SHA1 b5aae9fe5a0d595f4baa911560cc9a49cfb0b408
- SHA512 6aaafbee899cf042d87a3c335e4f7fa546750588ce7a69c639f8b1ef2403891a8916d0da9b2211457d210e85ca8143dfcb9d99cfbd96656707dd13f3b4eca5f0
- SSDEEP 98304:RuAoI0VTVi4eB4tr5Rd1iQXDxQY6z144TxdsZDQ/5hxw313a5t:IdBVi4S4V5RWY6z14472a5hxwZ4t
- TLSH T1852633A8C6B68171504CEA75E9F85920B53E87B9DDF0FC634FAB443640B21C8361FDA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: StormKitty
StormKitty is an open source info stealer written in C#.
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/tmp/RunQMhunt.exe disable_win_def - StormKitty payload 1 IoCs
resource yara_rule static1/unpack001/tmp/RunQMhunt.exe family_stormkitty
File Explorer
-
fid1747209335_RunQMhunt.exe.zip.zip 4.6MB
-
tmp/RunQMhunt.exe.exe 15.9MB
tmp/RunQMhunt.exe
- IMPHASH 3739209cb2e8009dbccb6480c1f6dd1a
- SHA256 88f5336a1e1a666c814492831c002ce7fd3799dbf9b4157b40cf3e96af5570a8
- MD5 a6102ab470462c123f2e3efa90a1d47e
- SHA1 d6051cf209a49bdd98dd550cbc4d77270149a713
- SHA512 558ec4329a80cb8a8578c4a4bbc7be6c611289d759b235b630539dc41b2b126a2d9ef741026c3a970cbb437beced6254208c4cf1f5b6a37fbe3983c288e989f7
- SSDEEP 98304:Twy84/XFmDSuftQs48fsEXho070F/7OR+FssiCirgfnA10KqiDOlLHk+EqD:b/1m/oEv0x7hXiYfnA1nVtKD
- TLSH T111F67C12FF66F0EAC53DC2748A7A5362BF35F80C0725ABDB12944A222D15BC07E75B25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
StormKitty payload
Digest
6d:0f:07:26:a7:5b:20:53:f8:dd:ac:75:1c:14:3c:b8:a8:ca:9c:0d:15:0b:0b:27:68:fa:10:53:1b:85:65:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
Chains
May 14, 2025
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
Serial Number
0d:da:f2:fe:51:f3:b2:e9:4c:bb:69:5a:4a:51:74:fc
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 18, 2022 - Oct 17, 2025
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
32451
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\UGit\qqpcmgr_proj\FTCommon\FTCommonTestTool\Release\RunQMhunt.pdb
kernel32
SizeofResource
GetCommandLineW
TerminateProcess
GetModuleFileNameW
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
LockResource
Process32FirstW
CloseHandle
GetNativeSystemInfo
LoadLibraryW
LoadResource
FindResourceW
SetCurrentDirectoryW
GetProcAddress
LocalFree
ExitProcess
CreateProcessW
FreeLibrary
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
FormatMessageA
shell32
CommandLineToArgvW
msvcp140
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Xout_of_range@std@@YAXPBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
shlwapi
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
vcruntime140
__std_exception_destroy
__CxxFrameHandler3
__std_terminate
__current_exception
memset
_CxxThrowException
__current_exception_context
memcpy
_except_handler4_common
__std_exception_copy
memmove
api-ms-win-crt-filesystem-l1-1-0
_wmkdir
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
free
_callnewh
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-stdio-l1-1-0
__p__commode
fclose
_wfopen_s
fwrite
_set_fmode
api-ms-win-crt-runtime-l1-1-0
perror
_crt_atexit
_c_exit
_cexit
_invalid_parameter_noinfo_noreturn
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_initialize_onexit_table
_set_app_type
_seh_filter_exe
_controlfp_s
_exit
_register_onexit_function
terminate
_register_thread_local_exe_atexit_callback
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15.8MB
Virtual Size
15.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=260, version=30034,
count=1, id=259, version=30034,
count=26, id=261, version=30034,
count=4, id=257, version=30034,
count=7, id=257, version=30795,
count=163, id=1, productName=Unmarked objects,
count=1, id=265, version=30157,
count=1, id=255, version=30157,
count=1, id=151,
count=1, id=258, version=30157,