Analysis
-
max time kernel
150s -
max time network
28s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
31-03-2021 06:59
Static task
static1
Behavioral task
behavioral1
Sample
Ref150420190619A-B0270PEL. pdf.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Ref150420190619A-B0270PEL. pdf.exe
Resource
win10v20201028
General
-
Target
Ref150420190619A-B0270PEL. pdf.exe
-
Size
1.0MB
-
MD5
5ed97211220671294ee925c64b1e3ebc
-
SHA1
22651d893883c0e0df19df33a31cb75ded09d102
-
SHA256
01bac3adf5b25f8dad0afe3fd753eefa5b31f2b3550e44069f594280e084f9b4
-
SHA512
73d7b53b0fe041d06f025842a57149e96aa9b6d52e2983c520ae52ea39c0bd617fd9341a32377bafe9e5d7da86807fbe062add794749f85e98f569dedb18c1a5
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1900-29-0x0000000000850000-0x00000000008FC000-memory.dmp family_stormkitty -
Loads dropped DLL 1 IoCs
Processes:
Ref150420190619A-B0270PEL. pdf.exepid process 1684 Ref150420190619A-B0270PEL. pdf.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 5 IoCs
Processes:
Ref150420190619A-B0270PEL. pdf.exeRef150420190619A-B0270PEL. pdf.exedescription pid process target process PID 1684 set thread context of 1984 1684 Ref150420190619A-B0270PEL. pdf.exe Ref150420190619A-B0270PEL. pdf.exe PID 1984 set thread context of 1932 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 set thread context of 1900 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 set thread context of 1732 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 set thread context of 1792 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1268 1900 WerFault.exe AppLaunch.exe 1356 1932 WerFault.exe AppLaunch.exe 1568 1732 WerFault.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
Ref150420190619A-B0270PEL. pdf.exeWerFault.exeWerFault.exeWerFault.exepid process 1684 Ref150420190619A-B0270PEL. pdf.exe 1684 Ref150420190619A-B0270PEL. pdf.exe 1684 Ref150420190619A-B0270PEL. pdf.exe 1684 Ref150420190619A-B0270PEL. pdf.exe 1268 WerFault.exe 1356 WerFault.exe 1268 WerFault.exe 1356 WerFault.exe 1268 WerFault.exe 1356 WerFault.exe 1268 WerFault.exe 1356 WerFault.exe 1268 WerFault.exe 1356 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe 1568 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
Processes:
Ref150420190619A-B0270PEL. pdf.exeWerFault.exeWerFault.exepid process 1984 Ref150420190619A-B0270PEL. pdf.exe 1268 WerFault.exe 1356 WerFault.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Ref150420190619A-B0270PEL. pdf.exepid process 1684 Ref150420190619A-B0270PEL. pdf.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
InstallUtil.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1732 InstallUtil.exe Token: SeDebugPrivilege 1268 WerFault.exe Token: SeDebugPrivilege 1356 WerFault.exe Token: SeDebugPrivilege 1568 WerFault.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Ref150420190619A-B0270PEL. pdf.exepid process 1984 Ref150420190619A-B0270PEL. pdf.exe 1984 Ref150420190619A-B0270PEL. pdf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Ref150420190619A-B0270PEL. pdf.exepid process 1984 Ref150420190619A-B0270PEL. pdf.exe 1984 Ref150420190619A-B0270PEL. pdf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Ref150420190619A-B0270PEL. pdf.exeRef150420190619A-B0270PEL. pdf.exeAppLaunch.exeAppLaunch.exeInstallUtil.exedescription pid process target process PID 1684 wrote to memory of 1984 1684 Ref150420190619A-B0270PEL. pdf.exe Ref150420190619A-B0270PEL. pdf.exe PID 1684 wrote to memory of 1984 1684 Ref150420190619A-B0270PEL. pdf.exe Ref150420190619A-B0270PEL. pdf.exe PID 1684 wrote to memory of 1984 1684 Ref150420190619A-B0270PEL. pdf.exe Ref150420190619A-B0270PEL. pdf.exe PID 1684 wrote to memory of 1984 1684 Ref150420190619A-B0270PEL. pdf.exe Ref150420190619A-B0270PEL. pdf.exe PID 1684 wrote to memory of 1984 1684 Ref150420190619A-B0270PEL. pdf.exe Ref150420190619A-B0270PEL. pdf.exe PID 1984 wrote to memory of 1932 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1932 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1932 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1932 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1932 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1932 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1932 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1932 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1932 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1932 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1932 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1932 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1900 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1900 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1900 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1900 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1900 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1900 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1900 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1900 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1900 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1900 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1900 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1900 1984 Ref150420190619A-B0270PEL. pdf.exe AppLaunch.exe PID 1984 wrote to memory of 1732 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 wrote to memory of 1732 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 wrote to memory of 1732 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 wrote to memory of 1732 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 wrote to memory of 1732 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 wrote to memory of 1732 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 wrote to memory of 1732 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 wrote to memory of 1732 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 wrote to memory of 1732 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 wrote to memory of 1732 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 wrote to memory of 1732 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 wrote to memory of 1732 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1932 wrote to memory of 1356 1932 AppLaunch.exe WerFault.exe PID 1932 wrote to memory of 1356 1932 AppLaunch.exe WerFault.exe PID 1932 wrote to memory of 1356 1932 AppLaunch.exe WerFault.exe PID 1932 wrote to memory of 1356 1932 AppLaunch.exe WerFault.exe PID 1932 wrote to memory of 1356 1932 AppLaunch.exe WerFault.exe PID 1932 wrote to memory of 1356 1932 AppLaunch.exe WerFault.exe PID 1932 wrote to memory of 1356 1932 AppLaunch.exe WerFault.exe PID 1900 wrote to memory of 1268 1900 AppLaunch.exe WerFault.exe PID 1900 wrote to memory of 1268 1900 AppLaunch.exe WerFault.exe PID 1900 wrote to memory of 1268 1900 AppLaunch.exe WerFault.exe PID 1900 wrote to memory of 1268 1900 AppLaunch.exe WerFault.exe PID 1900 wrote to memory of 1268 1900 AppLaunch.exe WerFault.exe PID 1900 wrote to memory of 1268 1900 AppLaunch.exe WerFault.exe PID 1900 wrote to memory of 1268 1900 AppLaunch.exe WerFault.exe PID 1732 wrote to memory of 1568 1732 InstallUtil.exe WerFault.exe PID 1732 wrote to memory of 1568 1732 InstallUtil.exe WerFault.exe PID 1732 wrote to memory of 1568 1732 InstallUtil.exe WerFault.exe PID 1732 wrote to memory of 1568 1732 InstallUtil.exe WerFault.exe PID 1984 wrote to memory of 1792 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 wrote to memory of 1792 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 wrote to memory of 1792 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 wrote to memory of 1792 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe PID 1984 wrote to memory of 1792 1984 Ref150420190619A-B0270PEL. pdf.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ref150420190619A-B0270PEL. pdf.exe"C:\Users\Admin\AppData\Local\Temp\Ref150420190619A-B0270PEL. pdf.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ref150420190619A-B0270PEL. pdf.exe"C:\Users\Admin\AppData\Local\Temp\Ref150420190619A-B0270PEL. pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 6604⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 6644⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 10564⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\BrowsersFiles\MozillaCookies.txtMD5
c0eba57ce108eb752f9d91b8e3529c9c
SHA1ed333454d80787cb146a5c50bfc96fbe0ef881c2
SHA2567afc1e9f51dd43ef4205cb543ebb57bbe6eba7ea23228a7973f397da556ace4b
SHA512b3345a6f9a92d1e04cb4289cecea29e55a4ea4e4843d2218ceac852769fd47cf5d347483792f6ec6495d858cb688aabd74ed7cdd52a81c9b486380edc04216d0
-
C:\Users\Admin\BrowsersFiles\MozillaCookies.txtMD5
c0eba57ce108eb752f9d91b8e3529c9c
SHA1ed333454d80787cb146a5c50bfc96fbe0ef881c2
SHA2567afc1e9f51dd43ef4205cb543ebb57bbe6eba7ea23228a7973f397da556ace4b
SHA512b3345a6f9a92d1e04cb4289cecea29e55a4ea4e4843d2218ceac852769fd47cf5d347483792f6ec6495d858cb688aabd74ed7cdd52a81c9b486380edc04216d0
-
C:\Users\Admin\Files.zipMD5
3a684444533e5e033070be386fa0f42e
SHA1c3173be824063918bc551684a8a3edc59c4482cb
SHA256f6072613eecae474e80f39a4da274b0912dc477c3314f5810896c9d650a8fe76
SHA512609ebf20025d4100edce82c7c88b04fd9172834471ad7678de1438faac8d91cce4e9303201392224df06e872fd71bd8c43528e82abd0da421867393e762698e9
-
\Users\Admin\AppData\Local\Temp\nss291.tmp\e3u77ae8ix8.dllMD5
5fb5ee14aa1d0cefb98f2ed181d27bf6
SHA1ef10e1a1aa7306470fb76d8ba589f6af89a66b73
SHA256d616b31e1a3824f57b7b7756e4fca5ae3c6b9557d9f496f9fb5a0fa0cea75882
SHA512e6c20caed2833f5546c321a48baed36122b1354634fc440ea99ba16993e210404fe7ffbc1488b95992724e32513ce85975311ab618841c20a18720fbf59aeb58
-
memory/1268-42-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/1268-36-0x0000000000000000-mapping.dmp
-
memory/1268-39-0x00000000021E0000-0x00000000021F1000-memory.dmpFilesize
68KB
-
memory/1356-41-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1356-35-0x0000000000000000-mapping.dmp
-
memory/1568-45-0x0000000000680000-0x0000000000681000-memory.dmpFilesize
4KB
-
memory/1568-44-0x00000000021E0000-0x00000000021F1000-memory.dmpFilesize
68KB
-
memory/1568-43-0x0000000000000000-mapping.dmp
-
memory/1684-2-0x00000000756A1000-0x00000000756A3000-memory.dmpFilesize
8KB
-
memory/1732-20-0x0000000074370000-0x0000000074A5E000-memory.dmpFilesize
6.9MB
-
memory/1732-22-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1732-18-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1732-19-0x0000000000404212-mapping.dmp
-
memory/1732-33-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/1792-48-0x0000000074370000-0x0000000074A5E000-memory.dmpFilesize
6.9MB
-
memory/1792-47-0x0000000000404212-mapping.dmp
-
memory/1900-16-0x0000000074370000-0x0000000074A5E000-memory.dmpFilesize
6.9MB
-
memory/1900-21-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1900-31-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/1900-14-0x0000000000447FAE-mapping.dmp
-
memory/1900-29-0x0000000000850000-0x00000000008FC000-memory.dmpFilesize
688KB
-
memory/1932-10-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1932-17-0x0000000074370000-0x0000000074A5E000-memory.dmpFilesize
6.9MB
-
memory/1932-32-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/1932-11-0x0000000000447FAE-mapping.dmp
-
memory/1984-8-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/1984-9-0x0000000003BE0000-0x0000000003BE1000-memory.dmpFilesize
4KB
-
memory/1984-4-0x00000000004033D0-mapping.dmp