Analysis
-
max time kernel
91s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2023 23:08
Behavioral task
behavioral1
Sample
Eulen crack.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Eulen crack.exe
Resource
win10v2004-20221111-en
General
-
Target
Eulen crack.exe
-
Size
1.3MB
-
MD5
faaf569803539174ef02b5b53e0388e2
-
SHA1
ed13d220b1b822ad8032e69983a4197e5d72473f
-
SHA256
683ea882def71b5bdc826c866e57825076d032c06b74702d500d62e756c3235f
-
SHA512
a60aecffe4813415feaac01d4494cb71f6f2ff297661da426eca95bbeff26e1c40080ef4a7637086393a2f1a66cc18a263e0313834fe88d81827c48c0cfaa251
-
SSDEEP
24576:AEiMngrdePNzQ0ZIxNXaV9x4IUgs36BUI2So5+jnzFoCaGApu8F:3gReFs0ZM0T+Sk6BU7HIFo7G98F
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3304-132-0x0000000000520000-0x0000000000678000-memory.dmp family_stormkitty -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 checkip.dyndns.org -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Eulen crack.exedescription pid process Token: SeDebugPrivilege 3304 Eulen crack.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Eulen crack.execmd.execmd.exedescription pid process target process PID 3304 wrote to memory of 3788 3304 Eulen crack.exe cmd.exe PID 3304 wrote to memory of 3788 3304 Eulen crack.exe cmd.exe PID 3788 wrote to memory of 4560 3788 cmd.exe chcp.com PID 3788 wrote to memory of 4560 3788 cmd.exe chcp.com PID 3788 wrote to memory of 3884 3788 cmd.exe netsh.exe PID 3788 wrote to memory of 3884 3788 cmd.exe netsh.exe PID 3788 wrote to memory of 4276 3788 cmd.exe findstr.exe PID 3788 wrote to memory of 4276 3788 cmd.exe findstr.exe PID 3304 wrote to memory of 2856 3304 Eulen crack.exe cmd.exe PID 3304 wrote to memory of 2856 3304 Eulen crack.exe cmd.exe PID 2856 wrote to memory of 1584 2856 cmd.exe chcp.com PID 2856 wrote to memory of 1584 2856 cmd.exe chcp.com PID 2856 wrote to memory of 2692 2856 cmd.exe netsh.exe PID 2856 wrote to memory of 2692 2856 cmd.exe netsh.exe PID 2856 wrote to memory of 1136 2856 cmd.exe findstr.exe PID 2856 wrote to memory of 1136 2856 cmd.exe findstr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Eulen crack.exe"C:\Users\Admin\AppData\Local\Temp\Eulen crack.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile3⤵
-
C:\Windows\system32\findstr.exefindstr All3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name=65001 key=clear | findstr Key2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile name=65001 key=clear3⤵
-
C:\Windows\system32\findstr.exefindstr Key3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1136-142-0x0000000000000000-mapping.dmp
-
memory/1584-140-0x0000000000000000-mapping.dmp
-
memory/2692-141-0x0000000000000000-mapping.dmp
-
memory/2856-139-0x0000000000000000-mapping.dmp
-
memory/3304-143-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/3304-133-0x0000000001000000-0x000000000101A000-memory.dmpFilesize
104KB
-
memory/3304-134-0x00007FFA23010000-0x00007FFA23AD1000-memory.dmpFilesize
10.8MB
-
memory/3304-132-0x0000000000520000-0x0000000000678000-memory.dmpFilesize
1.3MB
-
memory/3304-146-0x00007FFA23010000-0x00007FFA23AD1000-memory.dmpFilesize
10.8MB
-
memory/3304-145-0x00007FFA23010000-0x00007FFA23AD1000-memory.dmpFilesize
10.8MB
-
memory/3304-144-0x000000001CE70000-0x000000001CEAC000-memory.dmpFilesize
240KB
-
memory/3788-135-0x0000000000000000-mapping.dmp
-
memory/3884-137-0x0000000000000000-mapping.dmp
-
memory/4276-138-0x0000000000000000-mapping.dmp
-
memory/4560-136-0x0000000000000000-mapping.dmp