Overview

overview

10

Static

static

10

1216-60-0x...ry.exe

windows7-x64

10

1216-60-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1216-60-0x0000000000400000-0x0000000000428000-memory.dmp

  • Size

    160KB

  • Sample

    220726-rwns8sadgp

  • MD5

    c93c224620bbeffcf10df8c07447c394

  • SHA1

    b4770ce3def8a09b0bb7a4bc9a05150f8c8ac666

  • SHA256

    788b02199a92e85072e007000ecc03098c2c40f74665159324a7be7e19a62f2e

  • SHA512

    6cafb342c2a7095bc8a83e9a132261e480f5e361a0c51e210067ede559eda661d17ee948c46e5aed7db298532a307ae16ec05dc3cb27ab7ac7803f5ab2aaa9f8

Score
10/10
blustealerstormkittycollectionpersistencespywarestealer

Malware Config

Targets

    • Target

      1216-60-0x0000000000400000-0x0000000000428000-memory.dmp

    • Size

      160KB

    • MD5

      c93c224620bbeffcf10df8c07447c394

    • SHA1

      b4770ce3def8a09b0bb7a4bc9a05150f8c8ac666

    • SHA256

      788b02199a92e85072e007000ecc03098c2c40f74665159324a7be7e19a62f2e

    • SHA512

      6cafb342c2a7095bc8a83e9a132261e480f5e361a0c51e210067ede559eda661d17ee948c46e5aed7db298532a307ae16ec05dc3cb27ab7ac7803f5ab2aaa9f8

    Score
    10/10
    stormkittycollectionpersistencespywarestealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks