Overview

overview

10

Static

static

1

SecuriteIn...51.exe

windows7_x64

10

SecuriteIn...51.exe

windows10_x64

7

Analysis

  • max time kernel
    150s
  • max time network
    13s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    13-04-2021 21:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.Siggen13.7926.26442.26251.exe

  • Size

    1.1MB

  • MD5

    0e5a32151bc2d235ca8b57bfd1684f6e

  • SHA1

    db048b176a6f99934f13d1bac90a7918600a0f23

  • SHA256

    3693a93f4ddbfa1eb9207e06cf87041b59b9b1ddfd866e6fbbbb52aaeae7ed83

  • SHA512

    caaaf144653fb6295c53c47c4f91b52038c662aa50931dbdd78c7e2ca7da86ccf90022b47cf0db213f00fb70abcf622ecca9e9901628bad6d029149b97eeb732

Score
10/10
stormkittyspywarestealer

Malware Config

Signatures

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty Payload 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen13.7926.26442.26251.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen13.7926.26442.26251.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1116
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen13.7926.26442.26251.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen13.7926.26442.26251.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1928
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 644
          4⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1404
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        3⤵
          PID:1736
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
          3⤵
            PID:1132

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\BrowsersFiles\MozillaCookies.txt
        MD5

        c0eba57ce108eb752f9d91b8e3529c9c

        SHA1

        ed333454d80787cb146a5c50bfc96fbe0ef881c2

        SHA256

        7afc1e9f51dd43ef4205cb543ebb57bbe6eba7ea23228a7973f397da556ace4b

        SHA512

        b3345a6f9a92d1e04cb4289cecea29e55a4ea4e4843d2218ceac852769fd47cf5d347483792f6ec6495d858cb688aabd74ed7cdd52a81c9b486380edc04216d0

        Download Submit
      • \Users\Admin\AppData\Local\Temp\nsiED1.tmp\yyky0yh9xnyax.dll
        MD5

        4f85ab31a81e897315fc38373221023f

        SHA1

        3e73f679a385e34e0bd50a20d6db357e455049b7

        SHA256

        1c8d220052a771eda30d0a58aa4c74a0260595488d4468a57616b20da55be820

        SHA512

        c313d113297da309f5cc93067db5478504f506b4d12922b39bdbcc0c507b4ab2e4c9174ab96d428ff9d8abb95efc86f414d6a2df54f81465780d192991d5a4f8

        Download Submit
      • memory/1116-59-0x00000000767B1000-0x00000000767B3000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1116-65-0x0000000002810000-0x000000000345A000-memory.dmp
        Filesize

        12.3MB

        Download
      • memory/1116-69-0x0000000002810000-0x000000000345A000-memory.dmp
        Filesize

        12.3MB

        Download
      • memory/1132-85-0x0000000000404212-mapping.dmp
        Download
      • memory/1404-83-0x0000000000420000-0x0000000000438000-memory.dmp
        Filesize

        96KB

        Download
      • memory/1404-79-0x0000000000000000-mapping.dmp
        Download
      • memory/1736-71-0x0000000000404212-mapping.dmp
        Download
      • memory/1736-74-0x0000000000400000-0x000000000040A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/1736-70-0x0000000000400000-0x000000000040A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/1928-73-0x0000000000400000-0x00000000004B2000-memory.dmp
        Filesize

        712KB

        Download
      • memory/1928-67-0x00000000004A734E-mapping.dmp
        Download
      • memory/1928-81-0x0000000005040000-0x0000000005041000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1928-66-0x0000000000400000-0x00000000004B2000-memory.dmp
        Filesize

        712KB

        Download
      • memory/1952-72-0x0000000000400000-0x00000000004CF000-memory.dmp
        Filesize

        828KB

        Download
      • memory/1952-82-0x00000000025E0000-0x00000000025E1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1952-61-0x00000000004025C4-mapping.dmp
        Download