Analysis
-
max time kernel
150s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
13-04-2021 21:38
General
-
Target
SecuriteInfo.com.Trojan.Siggen13.7926.26442.26251.exe
-
Size
1.1MB
-
MD5
0e5a32151bc2d235ca8b57bfd1684f6e
-
SHA1
db048b176a6f99934f13d1bac90a7918600a0f23
-
SHA256
3693a93f4ddbfa1eb9207e06cf87041b59b9b1ddfd866e6fbbbb52aaeae7ed83
-
SHA512
caaaf144653fb6295c53c47c4f91b52038c662aa50931dbdd78c7e2ca7da86ccf90022b47cf0db213f00fb70abcf622ecca9e9901628bad6d029149b97eeb732
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty Payload 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Suspicious use of SetThreadContext 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 44 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen13.7926.26442.26251.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen13.7926.26442.26251.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen13.7926.26442.26251.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen13.7926.26442.26251.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 6444⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
c0eba57ce108eb752f9d91b8e3529c9c
SHA1ed333454d80787cb146a5c50bfc96fbe0ef881c2
SHA2567afc1e9f51dd43ef4205cb543ebb57bbe6eba7ea23228a7973f397da556ace4b
SHA512b3345a6f9a92d1e04cb4289cecea29e55a4ea4e4843d2218ceac852769fd47cf5d347483792f6ec6495d858cb688aabd74ed7cdd52a81c9b486380edc04216d0
-
MD5
4f85ab31a81e897315fc38373221023f
SHA13e73f679a385e34e0bd50a20d6db357e455049b7
SHA2561c8d220052a771eda30d0a58aa4c74a0260595488d4468a57616b20da55be820
SHA512c313d113297da309f5cc93067db5478504f506b4d12922b39bdbcc0c507b4ab2e4c9174ab96d428ff9d8abb95efc86f414d6a2df54f81465780d192991d5a4f8
-
Filesize
8KB
-
Filesize
12.3MB
-
Filesize
12.3MB
-
-
Filesize
96KB
-
-
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
712KB
-
-
Filesize
4KB
-
Filesize
712KB
-
Filesize
828KB
-
Filesize
4KB
-