Analysis
- user interaction
yes - max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 20:28
General
- Target Kittycord-Installer.exe
- Size 408KB
- Sample260628-y86m5set2r
- SHA256 0a8fa9a347f285a34538b29a8d01b20a364417efddad499393280208e63bb85f
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kittycord-Installer.exe"C:\Users\Admin\AppData\Local\Temp\Kittycord-Installer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qqgehyv2\qqgehyv2.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBFD0.tmp" "c:\Users\Admin\AppData\Local\Temp\qqgehyv2\CSC297ED6F62C1B4A5B9425A75468EF335E.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sdlfyysk\sdlfyysk.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1E4.tmp" "c:\Users\Admin\AppData\Local\Temp\sdlfyysk\CSCF5A4EFACB0834C04AEAA92360344253.TMP"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
RESBFD0.tmp
RESC1E4.tmp
qqgehyv2.dll
sdlfyysk.dll
CSC297ED6F62C1B4A5B9425A75468EF335E.TMP
qqgehyv2.0.cs
qqgehyv2.cmdline
CSCF5A4EFACB0834C04AEAA92360344253.TMP
sdlfyysk.0.cs
sdlfyysk.cmdline
memory/3104-29-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/3104-1-0x00000000000F0000-0x000000000015C000-memory.dmp
memory/3104-23-0x00000000021F0000-0x00000000021F8000-memory.dmp
memory/3104-12-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/3104-8-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/3104-7-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/3104-0-0x00007FF905B2F000-0x00007FF905B30000-memory.dmp
memory/3104-6-0x000000001AC60000-0x000000001AC82000-memory.dmp
memory/3104-5-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/3104-37-0x000000001AD20000-0x000000001AD28000-memory.dmp
memory/3104-4-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/3104-13-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/3104-38-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/3104-39-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/3104-40-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/3104-43-0x0000000021D30000-0x0000000021D4E000-memory.dmp
memory/3104-44-0x0000000021D50000-0x0000000021E02000-memory.dmp
memory/3104-45-0x0000000023090000-0x0000000023294000-memory.dmp
memory/3104-46-0x0000000021E10000-0x0000000021E2A000-memory.dmp
memory/3104-47-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/3104-48-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/3104-49-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/3104-50-0x00007FF9059A0000-0x00007FF906344000-memory.dmp
memory/3104-51-0x00007FF9059A0000-0x00007FF906344000-memory.dmp