Analysis
-
max time kernel
72s -
max time network
67s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
20-01-2023 23:01
Behavioral task
behavioral1
Sample
Eulen crack.exe
Resource
win10-20220901-en
General
-
Target
Eulen crack.exe
-
Size
1.3MB
-
MD5
faaf569803539174ef02b5b53e0388e2
-
SHA1
ed13d220b1b822ad8032e69983a4197e5d72473f
-
SHA256
683ea882def71b5bdc826c866e57825076d032c06b74702d500d62e756c3235f
-
SHA512
a60aecffe4813415feaac01d4494cb71f6f2ff297661da426eca95bbeff26e1c40080ef4a7637086393a2f1a66cc18a263e0313834fe88d81827c48c0cfaa251
-
SSDEEP
24576:AEiMngrdePNzQ0ZIxNXaV9x4IUgs36BUI2So5+jnzFoCaGApu8F:3gReFs0ZM0T+Sk6BU7HIFo7G98F
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2484-120-0x00000000006B0000-0x0000000000808000-memory.dmp family_stormkitty -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 checkip.dyndns.org -
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
taskmgr.exepid process 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Eulen crack.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 2484 Eulen crack.exe Token: SeDebugPrivilege 1316 taskmgr.exe Token: SeSystemProfilePrivilege 1316 taskmgr.exe Token: SeCreateGlobalPrivilege 1316 taskmgr.exe Token: 33 1316 taskmgr.exe Token: SeIncBasePriorityPrivilege 1316 taskmgr.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
Processes:
taskmgr.exepid process 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe -
Suspicious use of SendNotifyMessage 57 IoCs
Processes:
taskmgr.exepid process 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe 1316 taskmgr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Eulen crack.execmd.execmd.exedescription pid process target process PID 2484 wrote to memory of 4816 2484 Eulen crack.exe cmd.exe PID 2484 wrote to memory of 4816 2484 Eulen crack.exe cmd.exe PID 4816 wrote to memory of 3880 4816 cmd.exe chcp.com PID 4816 wrote to memory of 3880 4816 cmd.exe chcp.com PID 4816 wrote to memory of 1864 4816 cmd.exe netsh.exe PID 4816 wrote to memory of 1864 4816 cmd.exe netsh.exe PID 4816 wrote to memory of 4884 4816 cmd.exe findstr.exe PID 4816 wrote to memory of 4884 4816 cmd.exe findstr.exe PID 2484 wrote to memory of 4052 2484 Eulen crack.exe cmd.exe PID 2484 wrote to memory of 4052 2484 Eulen crack.exe cmd.exe PID 4052 wrote to memory of 3480 4052 cmd.exe chcp.com PID 4052 wrote to memory of 3480 4052 cmd.exe chcp.com PID 4052 wrote to memory of 3308 4052 cmd.exe netsh.exe PID 4052 wrote to memory of 3308 4052 cmd.exe netsh.exe PID 4052 wrote to memory of 3460 4052 cmd.exe findstr.exe PID 4052 wrote to memory of 3460 4052 cmd.exe findstr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Eulen crack.exe"C:\Users\Admin\AppData\Local\Temp\Eulen crack.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile3⤵
-
C:\Windows\system32\findstr.exefindstr All3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name=65001 key=clear | findstr Key2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile name=65001 key=clear3⤵
-
C:\Windows\system32\findstr.exefindstr Key3⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1864-125-0x0000000000000000-mapping.dmp
-
memory/2484-131-0x00000000010D0000-0x00000000010E2000-memory.dmpFilesize
72KB
-
memory/2484-121-0x0000000000FA0000-0x0000000000FAA000-memory.dmpFilesize
40KB
-
memory/2484-122-0x0000000001070000-0x000000000108A000-memory.dmpFilesize
104KB
-
memory/2484-120-0x00000000006B0000-0x0000000000808000-memory.dmpFilesize
1.3MB
-
memory/2484-132-0x000000001C5F0000-0x000000001C62E000-memory.dmpFilesize
248KB
-
memory/3308-129-0x0000000000000000-mapping.dmp
-
memory/3460-130-0x0000000000000000-mapping.dmp
-
memory/3480-128-0x0000000000000000-mapping.dmp
-
memory/3880-124-0x0000000000000000-mapping.dmp
-
memory/4052-127-0x0000000000000000-mapping.dmp
-
memory/4816-123-0x0000000000000000-mapping.dmp
-
memory/4884-126-0x0000000000000000-mapping.dmp