Malware Analysis Report

2024-10-18 21:25

Sample ID 210906-hlrbyaafc2
Target NKPOY00987900K.zip
SHA256 2079e40b5cbdef00232f13d540bb2e057952692a184d7a4c41daffe882943d4a
Tags
a310logger stormkitty spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2079e40b5cbdef00232f13d540bb2e057952692a184d7a4c41daffe882943d4a

Threat Level: Known bad

The file NKPOY00987900K.zip was found to be: Known bad.

Malicious Activity Summary

a310logger stormkitty spyware stealer

A310logger

StormKitty Payload

StormKitty

A310logger Executable

Executes dropped EXE

Reads local data of messenger clients

Reads user/profile data of web browsers

Looks up external IP address via web service

Looks up geolocation information via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-06 06:49

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-06 06:49

Reported

2021-09-06 06:49

Platform

win7-en

Max time network

7s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 10.0.0.1:67 udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-06 06:49

Reported

2021-09-06 06:52

Platform

win10-en

Max time kernel

151s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe"

Signatures

A310logger

stealer spyware a310logger

StormKitty

stealer stormkitty

StormKitty Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

A310logger Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Looks up geolocation information via web service

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2280 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe
PID 2280 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe
PID 2280 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe
PID 2280 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe
PID 2820 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 3368 wrote to memory of 3820 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
PID 3368 wrote to memory of 3820 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
PID 2820 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 3504 wrote to memory of 2024 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
PID 3504 wrote to memory of 2024 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
PID 2820 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 2820 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
PID 1272 wrote to memory of 812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe
PID 1272 wrote to memory of 812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

Processes

C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe

"C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe"

C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe

"C:\Users\Admin\AppData\Local\Temp\NKPOY00987900K.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 img.neko.airforce udp
US 167.172.239.151:443 img.neko.airforce tcp
US 8.8.8.8:53 icanhazip.com udp
US 104.18.7.156:80 icanhazip.com tcp
US 8.8.8.8:53 api.mylnikov.org udp
US 104.21.9.139:443 api.mylnikov.org tcp
US 104.18.7.156:80 icanhazip.com tcp
US 104.21.9.139:443 api.mylnikov.org tcp
US 104.18.7.156:80 icanhazip.com tcp
US 104.21.9.139:443 api.mylnikov.org tcp
NL 23.209.125.83:80 tcp

Files

memory/2820-115-0x00000000004024E0-mapping.dmp

memory/3368-118-0x0000000000400000-0x0000000000418000-memory.dmp

memory/3368-119-0x0000000000412452-mapping.dmp

memory/2820-121-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2280-120-0x000000000F3C0000-0x000000000F3C2000-memory.dmp

memory/3368-122-0x0000000001410000-0x0000000001411000-memory.dmp

memory/3820-123-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

MD5 1bad0cbd09b05a21157d8255dc801778
SHA1 ff284bba12f011b72e20d4c9537d6c455cdbf228
SHA256 218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9
SHA512 4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

MD5 1bad0cbd09b05a21157d8255dc801778
SHA1 ff284bba12f011b72e20d4c9537d6c455cdbf228
SHA256 218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9
SHA512 4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

memory/3820-126-0x0000000002260000-0x0000000002262000-memory.dmp

memory/3504-128-0x0000000000412452-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\InstallUtil.exe.log

MD5 a62535934fa7300b21d015be8236a2e5
SHA1 d94f020f9f0f299c46c0ce9b141a3b9da0f32814
SHA256 3efaf87f4602570f0be76f4bd246425060a2731f83aec474d7f354f8e6f62c70
SHA512 69761425416d2de37dc8934232160e2b8912b433cf8cbfc5505bc00d0c227624808c6414297addb91c966ff27045e9c4679af916efb563576c6fa23fdff1c5a5

memory/3504-130-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

memory/2024-131-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

MD5 1bad0cbd09b05a21157d8255dc801778
SHA1 ff284bba12f011b72e20d4c9537d6c455cdbf228
SHA256 218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9
SHA512 4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

MD5 1bad0cbd09b05a21157d8255dc801778
SHA1 ff284bba12f011b72e20d4c9537d6c455cdbf228
SHA256 218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9
SHA512 4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\MZ.exe.log

MD5 0d96352b982082afe2903d10c1b819a2
SHA1 37067f1193b4a3deaf27f35a09ddba8e2adee680
SHA256 825a471d43d2b81bed778b2bd7a3bf1a2b22a81c3b0de3c68bc2aa9c5bebcec2
SHA512 e55862d182b1f1bc1b296cb213e2c576f545120678e2be930dbcf764069ecb9eb3737cfa010c0a4861a5a20605bfae42a49b955d80006c52bd1486b7134bc2af

memory/2024-135-0x0000000000FC0000-0x0000000000FC2000-memory.dmp

memory/1272-137-0x0000000000412452-mapping.dmp

memory/1272-138-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

memory/812-139-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

MD5 1bad0cbd09b05a21157d8255dc801778
SHA1 ff284bba12f011b72e20d4c9537d6c455cdbf228
SHA256 218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9
SHA512 4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MZ.exe

MD5 1bad0cbd09b05a21157d8255dc801778
SHA1 ff284bba12f011b72e20d4c9537d6c455cdbf228
SHA256 218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9
SHA512 4fea56812eba1f1bba17f20d06b509e2a3b4e138562e53c230d0736d596abed4a6a3e43e26936fcd6d107924c8bba41885f34901afa4fd0d37d7e4a93c9b8533

memory/812-142-0x0000000000C40000-0x0000000000C42000-memory.dmp