Analysis

  • max time kernel
    150s
  • max time network
    28s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    31-03-2021 06:59

General

  • Target

    Ref150420190619A-B0270PEL. pdf.exe

  • Size

    1.0MB

  • MD5

    5ed97211220671294ee925c64b1e3ebc

  • SHA1

    22651d893883c0e0df19df33a31cb75ded09d102

  • SHA256

    01bac3adf5b25f8dad0afe3fd753eefa5b31f2b3550e44069f594280e084f9b4

  • SHA512

    73d7b53b0fe041d06f025842a57149e96aa9b6d52e2983c520ae52ea39c0bd617fd9341a32377bafe9e5d7da86807fbe062add794749f85e98f569dedb18c1a5

Malware Config

Signatures

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty Payload 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ref150420190619A-B0270PEL. pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Ref150420190619A-B0270PEL. pdf.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Users\Admin\AppData\Local\Temp\Ref150420190619A-B0270PEL. pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Ref150420190619A-B0270PEL. pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 660
          4⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1356
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1900
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 664
          4⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1268
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 1056
          4⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1568
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        3⤵
          PID:1792

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\BrowsersFiles\MozillaCookies.txt
      MD5

      c0eba57ce108eb752f9d91b8e3529c9c

      SHA1

      ed333454d80787cb146a5c50bfc96fbe0ef881c2

      SHA256

      7afc1e9f51dd43ef4205cb543ebb57bbe6eba7ea23228a7973f397da556ace4b

      SHA512

      b3345a6f9a92d1e04cb4289cecea29e55a4ea4e4843d2218ceac852769fd47cf5d347483792f6ec6495d858cb688aabd74ed7cdd52a81c9b486380edc04216d0

    • C:\Users\Admin\BrowsersFiles\MozillaCookies.txt
      MD5

      c0eba57ce108eb752f9d91b8e3529c9c

      SHA1

      ed333454d80787cb146a5c50bfc96fbe0ef881c2

      SHA256

      7afc1e9f51dd43ef4205cb543ebb57bbe6eba7ea23228a7973f397da556ace4b

      SHA512

      b3345a6f9a92d1e04cb4289cecea29e55a4ea4e4843d2218ceac852769fd47cf5d347483792f6ec6495d858cb688aabd74ed7cdd52a81c9b486380edc04216d0

    • C:\Users\Admin\Files.zip
      MD5

      3a684444533e5e033070be386fa0f42e

      SHA1

      c3173be824063918bc551684a8a3edc59c4482cb

      SHA256

      f6072613eecae474e80f39a4da274b0912dc477c3314f5810896c9d650a8fe76

      SHA512

      609ebf20025d4100edce82c7c88b04fd9172834471ad7678de1438faac8d91cce4e9303201392224df06e872fd71bd8c43528e82abd0da421867393e762698e9

    • \Users\Admin\AppData\Local\Temp\nss291.tmp\e3u77ae8ix8.dll
      MD5

      5fb5ee14aa1d0cefb98f2ed181d27bf6

      SHA1

      ef10e1a1aa7306470fb76d8ba589f6af89a66b73

      SHA256

      d616b31e1a3824f57b7b7756e4fca5ae3c6b9557d9f496f9fb5a0fa0cea75882

      SHA512

      e6c20caed2833f5546c321a48baed36122b1354634fc440ea99ba16993e210404fe7ffbc1488b95992724e32513ce85975311ab618841c20a18720fbf59aeb58

    • memory/1268-42-0x0000000000290000-0x0000000000291000-memory.dmp
      Filesize

      4KB

    • memory/1268-36-0x0000000000000000-mapping.dmp
    • memory/1268-39-0x00000000021E0000-0x00000000021F1000-memory.dmp
      Filesize

      68KB

    • memory/1356-41-0x0000000000240000-0x0000000000241000-memory.dmp
      Filesize

      4KB

    • memory/1356-35-0x0000000000000000-mapping.dmp
    • memory/1568-45-0x0000000000680000-0x0000000000681000-memory.dmp
      Filesize

      4KB

    • memory/1568-44-0x00000000021E0000-0x00000000021F1000-memory.dmp
      Filesize

      68KB

    • memory/1568-43-0x0000000000000000-mapping.dmp
    • memory/1684-2-0x00000000756A1000-0x00000000756A3000-memory.dmp
      Filesize

      8KB

    • memory/1732-20-0x0000000074370000-0x0000000074A5E000-memory.dmp
      Filesize

      6.9MB

    • memory/1732-22-0x0000000000400000-0x000000000040A000-memory.dmp
      Filesize

      40KB

    • memory/1732-18-0x0000000000400000-0x000000000040A000-memory.dmp
      Filesize

      40KB

    • memory/1732-19-0x0000000000404212-mapping.dmp
    • memory/1732-33-0x0000000004710000-0x0000000004711000-memory.dmp
      Filesize

      4KB

    • memory/1792-48-0x0000000074370000-0x0000000074A5E000-memory.dmp
      Filesize

      6.9MB

    • memory/1792-47-0x0000000000404212-mapping.dmp
    • memory/1900-16-0x0000000074370000-0x0000000074A5E000-memory.dmp
      Filesize

      6.9MB

    • memory/1900-21-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/1900-31-0x0000000004C90000-0x0000000004C91000-memory.dmp
      Filesize

      4KB

    • memory/1900-14-0x0000000000447FAE-mapping.dmp
    • memory/1900-29-0x0000000000850000-0x00000000008FC000-memory.dmp
      Filesize

      688KB

    • memory/1932-10-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/1932-17-0x0000000074370000-0x0000000074A5E000-memory.dmp
      Filesize

      6.9MB

    • memory/1932-32-0x0000000004A60000-0x0000000004A61000-memory.dmp
      Filesize

      4KB

    • memory/1932-11-0x0000000000447FAE-mapping.dmp
    • memory/1984-8-0x0000000000400000-0x0000000000491000-memory.dmp
      Filesize

      580KB

    • memory/1984-9-0x0000000003BE0000-0x0000000003BE1000-memory.dmp
      Filesize

      4KB

    • memory/1984-4-0x00000000004033D0-mapping.dmp