stormkitty | 01bac3adf5b25f8dad0afe3fd753eefa5b31f2b3550e44069f594280e084f9b4

General

Target

Ref150420190619A-B0270PEL. pdf.exe
Size

1.0MB
MD5

5ed97211220671294ee925c64b1e3ebc
SHA1

22651d893883c0e0df19df33a31cb75ded09d102
SHA256

01bac3adf5b25f8dad0afe3fd753eefa5b31f2b3550e44069f594280e084f9b4
SHA512

73d7b53b0fe041d06f025842a57149e96aa9b6d52e2983c520ae52ea39c0bd617fd9341a32377bafe9e5d7da86807fbe062add794749f85e98f569dedb18c1a5

Score

10^/10

stormkitty spyware stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/444-23-0x0000000009260000-0x000000000930C000-memory.dmp	family_stormkitty

Loads dropped DLL 1 IoCs

Processes:

Ref150420190619A-B0270PEL. pdf.exe

pid process

4688 Ref150420190619A-B0270PEL. pdf.exe
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 5 IoCs

Processes:

Ref150420190619A-B0270PEL. pdf.exeRef150420190619A-B0270PEL. pdf.exe

description	pid	process	target process
PID 4688 set thread context of 3524	4688	Ref150420190619A-B0270PEL. pdf.exe	Ref150420190619A-B0270PEL. pdf.exe
PID 3524 set thread context of 444	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 set thread context of 748	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 set thread context of 4176	3524	Ref150420190619A-B0270PEL. pdf.exe	InstallUtil.exe
PID 3524 set thread context of 1216	3524	Ref150420190619A-B0270PEL. pdf.exe	InstallUtil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4076 444 WerFault.exe AppLaunch.exe
4044 748 WerFault.exe AppLaunch.exe
1280 1216 WerFault.exe InstallUtil.exe

pid	pid_target	process	target process
4076	444	WerFault.exe	AppLaunch.exe
4044	748	WerFault.exe	AppLaunch.exe
1280	1216	WerFault.exe	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

Ref150420190619A-B0270PEL. pdf.exeWerFault.exeWerFault.exe

pid	process
4688	Ref150420190619A-B0270PEL. pdf.exe
4688	Ref150420190619A-B0270PEL. pdf.exe
4688	Ref150420190619A-B0270PEL. pdf.exe
4688	Ref150420190619A-B0270PEL. pdf.exe
4688	Ref150420190619A-B0270PEL. pdf.exe
4688	Ref150420190619A-B0270PEL. pdf.exe
4688	Ref150420190619A-B0270PEL. pdf.exe
4688	Ref150420190619A-B0270PEL. pdf.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4076	WerFault.exe
4044	WerFault.exe
4044	WerFault.exe
4044	WerFault.exe
4044	WerFault.exe
4044	WerFault.exe
4044	WerFault.exe
4044	WerFault.exe
4044	WerFault.exe
4044	WerFault.exe
4044	WerFault.exe
4044	WerFault.exe
4044	WerFault.exe
4044	WerFault.exe
4044	WerFault.exe
4044	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Ref150420190619A-B0270PEL. pdf.exe

pid process

3524 Ref150420190619A-B0270PEL. pdf.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Ref150420190619A-B0270PEL. pdf.exe

pid process

4688 Ref150420190619A-B0270PEL. pdf.exe

pid	process
3524	Ref150420190619A-B0270PEL. pdf.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

InstallUtil.exeWerFault.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	4176	InstallUtil.exe
Token: SeRestorePrivilege	4076	WerFault.exe
Token: SeBackupPrivilege	4076	WerFault.exe
Token: SeRestorePrivilege	4044	WerFault.exe
Token: SeBackupPrivilege	4044	WerFault.exe
Token: SeDebugPrivilege	4076	WerFault.exe
Token: SeDebugPrivilege	4044	WerFault.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Ref150420190619A-B0270PEL. pdf.exe

pid process

3524 Ref150420190619A-B0270PEL. pdf.exe
3524 Ref150420190619A-B0270PEL. pdf.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

Ref150420190619A-B0270PEL. pdf.exeInstallUtil.exe

pid process

3524 Ref150420190619A-B0270PEL. pdf.exe
3524 Ref150420190619A-B0270PEL. pdf.exe
4176 InstallUtil.exe
4176 InstallUtil.exe

pid	process
3524	Ref150420190619A-B0270PEL. pdf.exe
3524	Ref150420190619A-B0270PEL. pdf.exe

pid	process
3524	Ref150420190619A-B0270PEL. pdf.exe
3524	Ref150420190619A-B0270PEL. pdf.exe
4176	InstallUtil.exe
4176	InstallUtil.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

Ref150420190619A-B0270PEL. pdf.exeRef150420190619A-B0270PEL. pdf.exeWinMail.exe

description	pid	process	target process
PID 4688 wrote to memory of 3524	4688	Ref150420190619A-B0270PEL. pdf.exe	Ref150420190619A-B0270PEL. pdf.exe
PID 4688 wrote to memory of 3524	4688	Ref150420190619A-B0270PEL. pdf.exe	Ref150420190619A-B0270PEL. pdf.exe
PID 4688 wrote to memory of 3524	4688	Ref150420190619A-B0270PEL. pdf.exe	Ref150420190619A-B0270PEL. pdf.exe
PID 4688 wrote to memory of 3524	4688	Ref150420190619A-B0270PEL. pdf.exe	Ref150420190619A-B0270PEL. pdf.exe
PID 3524 wrote to memory of 444	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 444	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 444	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 444	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 444	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 444	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 444	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 444	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 748	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 748	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 748	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 748	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 748	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 748	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 748	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 748	3524	Ref150420190619A-B0270PEL. pdf.exe	AppLaunch.exe
PID 3524 wrote to memory of 4176	3524	Ref150420190619A-B0270PEL. pdf.exe	InstallUtil.exe
PID 3524 wrote to memory of 4176	3524	Ref150420190619A-B0270PEL. pdf.exe	InstallUtil.exe
PID 3524 wrote to memory of 4176	3524	Ref150420190619A-B0270PEL. pdf.exe	InstallUtil.exe
PID 3524 wrote to memory of 4176	3524	Ref150420190619A-B0270PEL. pdf.exe	InstallUtil.exe
PID 3524 wrote to memory of 4176	3524	Ref150420190619A-B0270PEL. pdf.exe	InstallUtil.exe
PID 3524 wrote to memory of 4176	3524	Ref150420190619A-B0270PEL. pdf.exe	InstallUtil.exe
PID 3524 wrote to memory of 4176	3524	Ref150420190619A-B0270PEL. pdf.exe	InstallUtil.exe
PID 3524 wrote to memory of 4176	3524	Ref150420190619A-B0270PEL. pdf.exe	InstallUtil.exe
PID 3524 wrote to memory of 1216	3524	Ref150420190619A-B0270PEL. pdf.exe	InstallUtil.exe
PID 3524 wrote to memory of 1216	3524	Ref150420190619A-B0270PEL. pdf.exe	InstallUtil.exe
PID 3524 wrote to memory of 1216	3524	Ref150420190619A-B0270PEL. pdf.exe	InstallUtil.exe
PID 3524 wrote to memory of 1216	3524	Ref150420190619A-B0270PEL. pdf.exe	InstallUtil.exe
PID 3524 wrote to memory of 1896	3524	Ref150420190619A-B0270PEL. pdf.exe	WinMail.exe
PID 3524 wrote to memory of 1896	3524	Ref150420190619A-B0270PEL. pdf.exe	WinMail.exe
PID 3524 wrote to memory of 1896	3524	Ref150420190619A-B0270PEL. pdf.exe	WinMail.exe
PID 1896 wrote to memory of 1868	1896	WinMail.exe	WinMail.exe
PID 1896 wrote to memory of 1868	1896	WinMail.exe	WinMail.exe

C:\Users\Admin\AppData\Local\Temp\Ref150420190619A-B0270PEL. pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Ref150420190619A-B0270PEL. pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4688

C:\Users\Admin\AppData\Local\Temp\Ref150420190619A-B0270PEL. pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Ref150420190619A-B0270PEL. pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 984
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 984
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4176

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
3⤵
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 88
4⤵
- Program crash
PID:1280

C:\Program Files (x86)\Windows Mail\WinMail.exe
"C:\Program Files (x86)\Windows Mail\WinMail" OCInstallUserConfigOE
3⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
4⤵
PID:1868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\BrowsersFiles\MozillaCookies.txt
MD5
c0eba57ce108eb752f9d91b8e3529c9c

SHA1
ed333454d80787cb146a5c50bfc96fbe0ef881c2

SHA256
7afc1e9f51dd43ef4205cb543ebb57bbe6eba7ea23228a7973f397da556ace4b

SHA512
b3345a6f9a92d1e04cb4289cecea29e55a4ea4e4843d2218ceac852769fd47cf5d347483792f6ec6495d858cb688aabd74ed7cdd52a81c9b486380edc04216d0

Download Submit
C:\Users\Admin\BrowsersFiles\MozillaCookies.txt
MD5
c0eba57ce108eb752f9d91b8e3529c9c

SHA1
ed333454d80787cb146a5c50bfc96fbe0ef881c2

SHA256
7afc1e9f51dd43ef4205cb543ebb57bbe6eba7ea23228a7973f397da556ace4b

SHA512
b3345a6f9a92d1e04cb4289cecea29e55a4ea4e4843d2218ceac852769fd47cf5d347483792f6ec6495d858cb688aabd74ed7cdd52a81c9b486380edc04216d0

Download Submit
C:\Users\Admin\Files.zip
MD5
af0ec049746802c4bd9bd39dcadde5bf

SHA1
e56762d942fc176b3df86a48694af1f36eeddff7

SHA256
fcfbd6a4b5c9df957113f5aec353bc572049535547e8ab4b955cdc1c52c597cf

SHA512
d878eb283b6c664b0eba0247bdfa0308a84bc41593738c2695619424a458068b6b563e6c9a2c06a2d527730c1fd201d93281b50721646b740e56b6e2dd465016

Download Submit
C:\Users\Admin\credentials.txt
MD5
4d0aa32998a8705488a9092c02ac96b1

SHA1
197a1e18ed6d69408bfa3b6f7aba3daa62211d6c

SHA256
cd1aff8b84a980d2cbf5e2def98366aa02a0378b6d9c30b1f1c62d8f6cb4fe16

SHA512
63e86284f4261e5b9f043e7c90631b2242d75fc08ee3632d528ad62d0681ab02ad48a9c61778a12cbfe64245a6a114ba87172deac1f4b4bfc753791c5a26684c

Download Submit
\Users\Admin\AppData\Local\Temp\nsl2FB2.tmp\e3u77ae8ix8.dll
MD5
5fb5ee14aa1d0cefb98f2ed181d27bf6

SHA1
ef10e1a1aa7306470fb76d8ba589f6af89a66b73

SHA256
d616b31e1a3824f57b7b7756e4fca5ae3c6b9557d9f496f9fb5a0fa0cea75882

SHA512
e6c20caed2833f5546c321a48baed36122b1354634fc440ea99ba16993e210404fe7ffbc1488b95992724e32513ce85975311ab618841c20a18720fbf59aeb58

Download Submit
memory/444-23-0x0000000009260000-0x000000000930C000-memory.dmp

Filesize
688KB

Download
memory/444-8-0x0000000073190000-0x000000007387E000-memory.dmp

Filesize
6.9MB

Download
memory/444-30-0x0000000009250000-0x0000000009251000-memory.dmp

Filesize
4KB

Download
memory/444-7-0x0000000000447FAE-mapping.dmp

Download
memory/444-6-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/748-27-0x0000000009710000-0x0000000009711000-memory.dmp

Filesize
4KB

Download
memory/748-31-0x0000000009660000-0x0000000009661000-memory.dmp

Filesize
4KB

Download
memory/748-10-0x0000000000447FAE-mapping.dmp

Download
memory/748-25-0x0000000009570000-0x0000000009571000-memory.dmp

Filesize
4KB

Download
memory/748-11-0x0000000073190000-0x000000007387E000-memory.dmp

Filesize
6.9MB

Download
memory/1216-48-0x0000000000404212-mapping.dmp

Download
memory/1280-49-0x0000000004870000-0x0000000004871000-memory.dmp

Filesize
4KB

Download
memory/1868-52-0x0000000000000000-mapping.dmp

Download
memory/1896-51-0x0000000000000000-mapping.dmp

Download
memory/3524-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3524-3-0x00000000004033D0-mapping.dmp

Download
memory/4044-34-0x00000000044D0000-0x00000000044D1000-memory.dmp

Filesize
4KB

Download
memory/4044-35-0x00000000044D0000-0x00000000044D1000-memory.dmp

Filesize
4KB

Download
memory/4044-38-0x00000000044D0000-0x00000000044D1000-memory.dmp

Filesize
4KB

Download
memory/4076-33-0x0000000004870000-0x0000000004871000-memory.dmp

Filesize
4KB

Download
memory/4176-32-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/4176-41-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download
memory/4176-42-0x0000000005670000-0x0000000005671000-memory.dmp

Filesize
4KB

Download
memory/4176-43-0x0000000004D61000-0x0000000004D62000-memory.dmp

Filesize
4KB

Download
memory/4176-44-0x0000000004D62000-0x0000000004D63000-memory.dmp

Filesize
4KB

Download
memory/4176-45-0x0000000008A90000-0x0000000008A91000-memory.dmp

Filesize
4KB

Download
memory/4176-40-0x0000000005B40000-0x0000000005B41000-memory.dmp

Filesize
4KB

Download
memory/4176-39-0x0000000005480000-0x0000000005481000-memory.dmp

Filesize
4KB

Download
memory/4176-37-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download
memory/4176-14-0x0000000073190000-0x000000007387E000-memory.dmp

Filesize
6.9MB

Download
memory/4176-13-0x0000000000404212-mapping.dmp

Download
memory/4176-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads