Malware Analysis Report

2024-10-18 21:25

Sample ID 210905-lw8krahea4
Target 090009000N.exe
SHA256 7a30162550b7e83cf48b73ad034251cbc6e053f9d20809c4f4beefaef28c8754
Tags
a310logger stormkitty spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7a30162550b7e83cf48b73ad034251cbc6e053f9d20809c4f4beefaef28c8754

Threat Level: Known bad

The file 090009000N.exe was found to be: Known bad.

Malicious Activity Summary

a310logger stormkitty spyware stealer

A310logger

StormKitty

StormKitty Payload

A310logger Executable

Executes dropped EXE

Reads user/profile data of web browsers

Reads local data of messenger clients

Looks up external IP address via web service

Looks up geolocation information via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-05 09:54

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-05 09:54

Reported

2021-09-05 09:56

Platform

win7-en

Max time kernel

142s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\090009000N.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\090009000N.exe

"C:\Users\Admin\AppData\Local\Temp\090009000N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 img.neko.airforce udp
US 167.172.239.151:443 img.neko.airforce tcp
US 167.172.239.151:443 img.neko.airforce tcp
US 167.172.239.151:443 img.neko.airforce tcp
US 167.172.239.151:443 img.neko.airforce tcp

Files

memory/1868-53-0x00000000766B1000-0x00000000766B3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-05 09:54

Reported

2021-09-05 09:56

Platform

win10v20210408

Max time kernel

155s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\090009000N.exe"

Signatures

A310logger

stealer spyware a310logger

StormKitty

stealer stormkitty

StormKitty Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

A310logger Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Looks up geolocation information via web service

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 804 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Users\Admin\AppData\Local\Temp\090009000N.exe
PID 804 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Users\Admin\AppData\Local\Temp\090009000N.exe
PID 804 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Users\Admin\AppData\Local\Temp\090009000N.exe
PID 804 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Users\Admin\AppData\Local\Temp\090009000N.exe
PID 4000 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 500 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
PID 500 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
PID 4000 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 4000 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\090009000N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 3180 wrote to memory of 4004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
PID 3180 wrote to memory of 4004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

Processes

C:\Users\Admin\AppData\Local\Temp\090009000N.exe

"C:\Users\Admin\AppData\Local\Temp\090009000N.exe"

C:\Users\Admin\AppData\Local\Temp\090009000N.exe

"C:\Users\Admin\AppData\Local\Temp\090009000N.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 88

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 img.neko.airforce udp
US 167.172.239.151:443 img.neko.airforce tcp
US 8.8.8.8:53 icanhazip.com udp
US 104.18.7.156:80 icanhazip.com tcp
US 8.8.8.8:53 api.mylnikov.org udp
US 172.67.160.130:443 api.mylnikov.org tcp
US 104.18.7.156:80 icanhazip.com tcp
US 172.67.160.130:443 api.mylnikov.org tcp

Files

memory/4000-114-0x00000000004024E0-mapping.dmp

memory/804-116-0x0000000003240000-0x0000000003242000-memory.dmp

memory/4000-117-0x0000000000400000-0x0000000000430000-memory.dmp

memory/500-119-0x0000000000400000-0x0000000000418000-memory.dmp

memory/500-120-0x0000000000412452-mapping.dmp

memory/500-121-0x0000000002840000-0x0000000002841000-memory.dmp

memory/2152-122-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

MD5 1bad0cbd09b05a21157d8255dc801778
SHA1 ff284bba12f011b72e20d4c9537d6c455cdbf228
SHA256 218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9
SHA512 4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

MD5 1bad0cbd09b05a21157d8255dc801778
SHA1 ff284bba12f011b72e20d4c9537d6c455cdbf228
SHA256 218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9
SHA512 4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

memory/2152-125-0x00000000029E0000-0x00000000029E2000-memory.dmp

memory/996-127-0x0000000000412452-mapping.dmp

memory/3180-129-0x0000000000412452-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\InstallUtil.exe.log

MD5 a62535934fa7300b21d015be8236a2e5
SHA1 d94f020f9f0f299c46c0ce9b141a3b9da0f32814
SHA256 3efaf87f4602570f0be76f4bd246425060a2731f83aec474d7f354f8e6f62c70
SHA512 69761425416d2de37dc8934232160e2b8912b433cf8cbfc5505bc00d0c227624808c6414297addb91c966ff27045e9c4679af916efb563576c6fa23fdff1c5a5

memory/3180-131-0x0000000002D80000-0x0000000002D81000-memory.dmp

memory/4004-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

MD5 1bad0cbd09b05a21157d8255dc801778
SHA1 ff284bba12f011b72e20d4c9537d6c455cdbf228
SHA256 218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9
SHA512 4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

MD5 1bad0cbd09b05a21157d8255dc801778
SHA1 ff284bba12f011b72e20d4c9537d6c455cdbf228
SHA256 218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9
SHA512 4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\MZ.exe.log

MD5 0d96352b982082afe2903d10c1b819a2
SHA1 37067f1193b4a3deaf27f35a09ddba8e2adee680
SHA256 825a471d43d2b81bed778b2bd7a3bf1a2b22a81c3b0de3c68bc2aa9c5bebcec2
SHA512 e55862d182b1f1bc1b296cb213e2c576f545120678e2be930dbcf764069ecb9eb3737cfa010c0a4861a5a20605bfae42a49b955d80006c52bd1486b7134bc2af

memory/4004-136-0x00000000023F0000-0x00000000023F2000-memory.dmp