stormkitty | hxxps://github[.]com/Bulldogfrfr/LaF-krunker-Client/blob/main/LaF_Setup_Windows_x64[.]exe

General

Target

https://github.com/Bulldogfrfr/LaF-krunker-Client/blob/main/LaF_Setup_Windows_x64.exe

Score

10^/10

stormkitty stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\LaF_Setup_Windows_x64.exe.v25p4cq.partial	family_stormkitty
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\LaF_Setup_Windows_x64.exe	family_stormkitty
behavioral2/memory/320-136-0x0000000000620000-0x0000000000636000-memory.dmp	family_stormkitty

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

LaF_Setup_Windows_x64.exe

pid process

320 LaF_Setup_Windows_x64.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1956 320 WerFault.exe LaF_Setup_Windows_x64.exe
4376 2488 WerFault.exe

pid	process
320	LaF_Setup_Windows_x64.exe

pid	pid_target	process	target process
1956	320	WerFault.exe	LaF_Setup_Windows_x64.exe
4376	2488	WerFault.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = e8baa059b9aed801	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "380821855"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1802186583"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7C0DB813-9747-11ED-B696-CA2A13AD51D0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000009d300cb437f324d9e09e06086447959000000000200000000001066000000010000200000000e29b2b13c331ccfd30dabced22ecb9701a80a86ae0728e0854fb20a1a2f7203000000000e8000000002000020000000127ebe3bfd5aa514208ac688dea161c7b20a493f86a1e236903adf82920e3269200000001a5715d3e6079e9edcc73578718f43c24144e6b94e042d448ab3b697d5ba2e144000000052ca536d6224a0cac96b1a0fc4f8cf026425f33e8777bd374b53344afb767df11896d3dbf46a085adc84dfb06340e516ff81d7cefc307466d929527f583cabc7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31009620"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000009d300cb437f324d9e09e0608644795900000000020000000000106600000001000020000000b9c3f2e58120cd9d136b866c0a3ca25e02e03af4bcb7b92cbcefadccae337277000000000e8000000002000020000000f106c483b5867a39314b42d3477b8053020e1d93c44780b11700f2ab2d1615c820000000fa3e97901bdfd3cbdd90bb792b292bbef2c9ceb1955f0ab3fd01d51760a2df7d4000000075a17cfe98c1aa5966bc4daff0f6070e4243aa479dcde995c7687ed6ad04685d5166a4d45923f798ba7298f51f8af67f835f334c7185afdc8f2c681e55f3b91a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a1e453542bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1802186583"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31009620"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1364836132"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{0A38699D-72D7-4B73-86B2-293BFDC444AA}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31009620"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1364836132"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04fb753542bd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31009620"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

1392 iexplore.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

1392 iexplore.exe
1392 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1392 iexplore.exe
1392 iexplore.exe
1688 IEXPLORE.EXE
1688 IEXPLORE.EXE
1688 IEXPLORE.EXE
1688 IEXPLORE.EXE

pid	process
1392	iexplore.exe

pid	process
1392	iexplore.exe
1392	iexplore.exe

pid	process
1392	iexplore.exe
1392	iexplore.exe
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1392 wrote to memory of 1688	1392	iexplore.exe	IEXPLORE.EXE
PID 1392 wrote to memory of 1688	1392	iexplore.exe	IEXPLORE.EXE
PID 1392 wrote to memory of 1688	1392	iexplore.exe	IEXPLORE.EXE
PID 1392 wrote to memory of 320	1392	iexplore.exe	LaF_Setup_Windows_x64.exe
PID 1392 wrote to memory of 320	1392	iexplore.exe	LaF_Setup_Windows_x64.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/Bulldogfrfr/LaF-krunker-Client/blob/main/LaF_Setup_Windows_x64.exe
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1392 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1688

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\LaF_Setup_Windows_x64.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\LaF_Setup_Windows_x64.exe"
2⤵
- Executes dropped EXE
PID:320

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 320 -s 1124
3⤵
- Program crash
PID:1956

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 320 -ip 320
1⤵
PID:3840

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 540 -p 2488 -ip 2488
1⤵
PID:4336

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2488 -s 1688
1⤵
- Program crash
PID:4376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
14bf85de793cea23b81c15fb4078caac

SHA1
288eb197e359344a18d65724ff854bbe482be6fb

SHA256
a6a1d1ce7bbc768eeda3b115f96805c7a7b79b2a1d456810842bad24fcf6d1f1

SHA512
cb7bfb330f21e1d4ef49d92c86c77c12a58ad8fe37e57a745539f0902ef2bb063f6e4236146584c4dbd2c5d48510c7500577e7d0b41724ccad1f017cb2da70c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
f39c8ef8fb437cd8cbe1ec633bc6c870

SHA1
5c865e53370575bcfc79176aa42aab45edd1575a

SHA256
01e31868b33dc5ea3eb3a38fb81bc155b675b67106947c844fda4f7443ff3b81

SHA512
eb5b3780d96603c63e291fea02a56fa3d413f640ada694d2e4461c698c2acdea527773cb900853e8cf17d7d6696112da9c63b60289d4da6f69ed4757cbcaee11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dqptnfu\imagestore.dat
Filesize
1KB

MD5
d48190ec76f439fdbd471873f66e257c

SHA1
77852dea806764ba6d12377432e6c29bdf3a44e7

SHA256
9fa31c9742414707a128c2d12ba6dcb100230d77fae25481ad826a0f3b0904e6

SHA512
d973ba8383ef472990a98ad7d8cd2d3e2ed4f1250017b222b8ae9dfb5fd22f8f606e8b6d447da8874dc2d5c0abafa151899da4169f522e859cfe4a11e2353fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\LaF_Setup_Windows_x64.exe
Filesize
63KB

MD5
25fc98107ffc3d6763b702f1167e913f

SHA1
aeaa8b4139771dbec081f34cd1e382e8317a9fbd

SHA256
19cd3bbcb2e7013aa7ac5240a481c059824d32ee039652a5cab79da08b84d4e6

SHA512
37a3accb6457fa7d9b8e647dab779ded49798e96efea2e11847ef354419ff39d4eb217dc3c88686bec8839b9f5be5dca2718647c93b0fdccd400928cc9457f35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\LaF_Setup_Windows_x64.exe.v25p4cq.partial
Filesize
63KB

MD5
25fc98107ffc3d6763b702f1167e913f

SHA1
aeaa8b4139771dbec081f34cd1e382e8317a9fbd

SHA256
19cd3bbcb2e7013aa7ac5240a481c059824d32ee039652a5cab79da08b84d4e6

SHA512
37a3accb6457fa7d9b8e647dab779ded49798e96efea2e11847ef354419ff39d4eb217dc3c88686bec8839b9f5be5dca2718647c93b0fdccd400928cc9457f35

Download Submit
memory/320-134-0x0000000000000000-mapping.dmp

Download
memory/320-136-0x0000000000620000-0x0000000000636000-memory.dmp

Filesize
88KB

Download
memory/320-137-0x00007FFB91930000-0x00007FFB923F1000-memory.dmp

Filesize
10.8MB

Download
memory/320-138-0x00007FFB91930000-0x00007FFB923F1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads