Overview

overview

10

Static

static

10303640_A...v1.exe

windows7_x64

10

10303640_A...v1.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    116s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    22-07-2021 07:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    10303640_APMC-TRN-C0001-Stability_Calculation_Rev1.exe

  • Size

    897KB

  • MD5

    6f260afdc367ce34cc44584c35ef7da1

  • SHA1

    b9c1be8368b9947a85e70ddee94b35c8dde43771

  • SHA256

    9e4b6c3beacf15788e4ab0c3dc67962de4e1181854ea65124ba7231ff88730dc

  • SHA512

    9ab7f18ec6bda4eb488fbf54dfb44d4554e168961559559f32d8ebbcb4af7e7cd4ea48d58a9c3206033724004ebafc71bcb04a8c9b5edd16fd4256e4442bccbb

Score
10/10
a310loggerstormkittyspywarestealer

Malware Config

Signatures

  • A310logger

    A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarea310logger
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty Payload 4 IoCs
  • A310logger Executable 10 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10303640_APMC-TRN-C0001-Stability_Calculation_Rev1.exe
    "C:\Users\Admin\AppData\Local\Temp\10303640_APMC-TRN-C0001-Stability_Calculation_Rev1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3692
    • C:\Users\Admin\AppData\Local\Temp\10303640_APMC-TRN-C0001-Stability_Calculation_Rev1.exe
      "C:\Users\Admin\AppData\Local\Temp\10303640_APMC-TRN-C0001-Stability_Calculation_Rev1.exe"
      2⤵
        PID:2908
      • C:\Users\Admin\AppData\Local\Temp\10303640_APMC-TRN-C0001-Stability_Calculation_Rev1.exe
        "C:\Users\Admin\AppData\Local\Temp\10303640_APMC-TRN-C0001-Stability_Calculation_Rev1.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3952
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"
          3⤵
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2292
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3052
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"
          3⤵
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2592
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:856
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"
          3⤵
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1348
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2804

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    System Information Discovery

    2
    T1082

    Query Registry

    1
    T1012

    Lateral Movement

    Collection

    Data from Local System

    2
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\MZ.exe.log
      MD5

      0d96352b982082afe2903d10c1b819a2

      SHA1

      37067f1193b4a3deaf27f35a09ddba8e2adee680

      SHA256

      825a471d43d2b81bed778b2bd7a3bf1a2b22a81c3b0de3c68bc2aa9c5bebcec2

      SHA512

      e55862d182b1f1bc1b296cb213e2c576f545120678e2be930dbcf764069ecb9eb3737cfa010c0a4861a5a20605bfae42a49b955d80006c52bd1486b7134bc2af

      Download Submit
    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\InstallUtil.exe.log
      MD5

      a62535934fa7300b21d015be8236a2e5

      SHA1

      d94f020f9f0f299c46c0ce9b141a3b9da0f32814

      SHA256

      3efaf87f4602570f0be76f4bd246425060a2731f83aec474d7f354f8e6f62c70

      SHA512

      69761425416d2de37dc8934232160e2b8912b433cf8cbfc5505bc00d0c227624808c6414297addb91c966ff27045e9c4679af916efb563576c6fa23fdff1c5a5

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
      MD5

      1bad0cbd09b05a21157d8255dc801778

      SHA1

      ff284bba12f011b72e20d4c9537d6c455cdbf228

      SHA256

      218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9

      SHA512

      4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
      MD5

      1bad0cbd09b05a21157d8255dc801778

      SHA1

      ff284bba12f011b72e20d4c9537d6c455cdbf228

      SHA256

      218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9

      SHA512

      4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
      MD5

      1bad0cbd09b05a21157d8255dc801778

      SHA1

      ff284bba12f011b72e20d4c9537d6c455cdbf228

      SHA256

      218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9

      SHA512

      4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
      MD5

      1bad0cbd09b05a21157d8255dc801778

      SHA1

      ff284bba12f011b72e20d4c9537d6c455cdbf228

      SHA256

      218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9

      SHA512

      4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
      MD5

      1bad0cbd09b05a21157d8255dc801778

      SHA1

      ff284bba12f011b72e20d4c9537d6c455cdbf228

      SHA256

      218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9

      SHA512

      4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
      MD5

      1bad0cbd09b05a21157d8255dc801778

      SHA1

      ff284bba12f011b72e20d4c9537d6c455cdbf228

      SHA256

      218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9

      SHA512

      4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

      Download Submit
    • memory/856-139-0x0000000000000000-mapping.dmp
      Download
    • memory/856-143-0x0000000002BE0000-0x0000000002BE2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1348-146-0x0000000002A70000-0x0000000002A71000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1348-145-0x0000000000412452-mapping.dmp
      Download
    • memory/2292-128-0x0000000000400000-0x0000000000418000-memory.dmp
      Filesize

      96KB

      Download
    • memory/2292-129-0x0000000000412452-mapping.dmp
      Download
    • memory/2292-130-0x0000000002820000-0x0000000002821000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2592-136-0x0000000000412452-mapping.dmp
      Download
    • memory/2592-138-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2804-150-0x0000000000830000-0x0000000000832000-memory.dmp
      Filesize

      8KB

      Download
    • memory/2804-147-0x0000000000000000-mapping.dmp
      Download
    • memory/3052-134-0x0000000002EC0000-0x0000000002EC2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/3052-131-0x0000000000000000-mapping.dmp
      Download
    • memory/3692-120-0x0000000004A60000-0x0000000004A61000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3692-119-0x0000000004B80000-0x0000000004B81000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3692-126-0x0000000004B80000-0x000000000507E000-memory.dmp
      Filesize

      5.0MB

      Download
    • memory/3692-116-0x0000000005080000-0x0000000005081000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3692-122-0x0000000004B60000-0x0000000004B6F000-memory.dmp
      Filesize

      60KB

      Download
    • memory/3692-114-0x0000000000180000-0x0000000000181000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3692-121-0x0000000004D40000-0x0000000004DB1000-memory.dmp
      Filesize

      452KB

      Download
    • memory/3692-118-0x0000000004C20000-0x0000000004C21000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3692-117-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3952-124-0x00000000004024E0-mapping.dmp
      Download
    • memory/3952-123-0x0000000000400000-0x0000000000430000-memory.dmp
      Filesize

      192KB

      Download