stormkitty | 7e17af3f5e7833fd956910e2500a0b97104248d4a12ddce524a88bad28ff4e87

General

Target
Inquiry - RFQ HMGU66 sw5558.exe
Size 331KB
Sample220121-3maqssdbg7
SHA256 1d8ab5bfd618f9c1b5ca0eb61023d1128f3229e1b74764fd1eab57df5f170dc0
MD5 91ce934b3ddcb118e3511762faec0617
SHA1 7a06b47645944a01c96de2ee6006905222c477bd
SHA512 b40543a3884a4d1a0c28e3c90d786bffbf0b24943d98064fa4b83403e875c2d95abd5dea45ec6210717a95ef4173e52bcc8c626e2978447e9a273d32e896e490
MD5 SHA1 SHA512

Score

10^/10

stormkitty collection spyware stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty Payload 1 IoCs

resource	yara_rule
behavioral2/memory/916-118-0x0000000000400000-0x0000000000412000-memory.dmp	family_stormkitty

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	icanhazip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2668 set thread context of 3612	2668	Inquiry - RFQ HMGU66 sw5558.exe	68
PID 3612 set thread context of 1316	3612	Inquiry - RFQ HMGU66 sw5558.exe	69
PID 3612 set thread context of 916	3612	Inquiry - RFQ HMGU66 sw5558.exe	71

Program crash 2 IoCs

pid	pid_target	Process	procid_target
848	1316	WerFault.exe	69
4004	3612	WerFault.exe	68

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2668	Inquiry - RFQ HMGU66 sw5558.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	RegSvcs.exe
Token: SeRestorePrivilege	4004	WerFault.exe
Token: SeBackupPrivilege	4004	WerFault.exe
Token: SeDebugPrivilege	4004	WerFault.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3612	Inquiry - RFQ HMGU66 sw5558.exe
3612	Inquiry - RFQ HMGU66 sw5558.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 3612	2668	Inquiry - RFQ HMGU66 sw5558.exe	68
PID 2668 wrote to memory of 3612	2668	Inquiry - RFQ HMGU66 sw5558.exe	68
PID 2668 wrote to memory of 3612	2668	Inquiry - RFQ HMGU66 sw5558.exe	68
PID 2668 wrote to memory of 3612	2668	Inquiry - RFQ HMGU66 sw5558.exe	68
PID 3612 wrote to memory of 1316	3612	Inquiry - RFQ HMGU66 sw5558.exe	69
PID 3612 wrote to memory of 1316	3612	Inquiry - RFQ HMGU66 sw5558.exe	69
PID 3612 wrote to memory of 1316	3612	Inquiry - RFQ HMGU66 sw5558.exe	69
PID 3612 wrote to memory of 1316	3612	Inquiry - RFQ HMGU66 sw5558.exe	69
PID 3612 wrote to memory of 916	3612	Inquiry - RFQ HMGU66 sw5558.exe	71
PID 3612 wrote to memory of 916	3612	Inquiry - RFQ HMGU66 sw5558.exe	71
PID 3612 wrote to memory of 916	3612	Inquiry - RFQ HMGU66 sw5558.exe	71
PID 3612 wrote to memory of 916	3612	Inquiry - RFQ HMGU66 sw5558.exe	71
PID 3612 wrote to memory of 916	3612	Inquiry - RFQ HMGU66 sw5558.exe	71
PID 3612 wrote to memory of 916	3612	Inquiry - RFQ HMGU66 sw5558.exe	71
PID 3612 wrote to memory of 916	3612	Inquiry - RFQ HMGU66 sw5558.exe	71
PID 3612 wrote to memory of 916	3612	Inquiry - RFQ HMGU66 sw5558.exe	71

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Inquiry - RFQ HMGU66 sw5558.exe
"C:\Users\Admin\AppData\Local\Temp\Inquiry - RFQ HMGU66 sw5558.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\Inquiry - RFQ HMGU66 sw5558.exe
  "C:\Users\Admin\AppData\Local\Temp\Inquiry - RFQ HMGU66 sw5558.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:1316
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 88
      4⤵
      Program crash
      PID:848
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 728
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-118-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/916-120-0x0000000005700000-0x0000000005766000-memory.dmp

Download

memory/916-121-0x0000000005810000-0x00000000058AC000-memory.dmp

Download

memory/916-122-0x0000000005960000-0x0000000005961000-memory.dmp

Download

memory/3612-119-0x0000000000400000-0x0000000000431000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads