Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2023 01:30
Behavioral task
behavioral1
Sample
BlitzedGrabber_.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
BlitzedGrabber_.exe
Resource
win10v2004-20221111-en
General
-
Target
BlitzedGrabber_.exe
-
Size
1.4MB
-
MD5
ea795ffff4c8f24a343102ab0d86c010
-
SHA1
0a0dd7abf548567caccc32fd06a6f45790ffd1d4
-
SHA256
a4fad46b0ab068cb7e5de1f3e970101ff2501c5b0608ada10442bcf891c5f8bb
-
SHA512
b3f8428226e3e23febdd5f6b08f4a788cb62cc1795627b39660fafdbb810c4c7239c29f8833dbc3431a0559591958d0b2f68f36b3be065bdaa122f55666c8ae3
-
SSDEEP
24576:/40iMngrdePNzQ0ZIxNXaV9x4IUgs36BUI2So5+jnzFYCaGApu8:AsgReFs0ZM0T+Sk6BU7HIFY7G98
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3612-132-0x0000000000AD0000-0x0000000000C32000-memory.dmp family_stormkitty -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 checkip.dyndns.org -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
BlitzedGrabber_.exedescription pid process Token: SeDebugPrivilege 3612 BlitzedGrabber_.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
BlitzedGrabber_.execmd.execmd.exedescription pid process target process PID 3612 wrote to memory of 2040 3612 BlitzedGrabber_.exe cmd.exe PID 3612 wrote to memory of 2040 3612 BlitzedGrabber_.exe cmd.exe PID 2040 wrote to memory of 1416 2040 cmd.exe chcp.com PID 2040 wrote to memory of 1416 2040 cmd.exe chcp.com PID 2040 wrote to memory of 3220 2040 cmd.exe netsh.exe PID 2040 wrote to memory of 3220 2040 cmd.exe netsh.exe PID 2040 wrote to memory of 3236 2040 cmd.exe findstr.exe PID 2040 wrote to memory of 3236 2040 cmd.exe findstr.exe PID 3612 wrote to memory of 3688 3612 BlitzedGrabber_.exe cmd.exe PID 3612 wrote to memory of 3688 3612 BlitzedGrabber_.exe cmd.exe PID 3688 wrote to memory of 5088 3688 cmd.exe chcp.com PID 3688 wrote to memory of 5088 3688 cmd.exe chcp.com PID 3688 wrote to memory of 3112 3688 cmd.exe netsh.exe PID 3688 wrote to memory of 3112 3688 cmd.exe netsh.exe PID 3688 wrote to memory of 2116 3688 cmd.exe findstr.exe PID 3688 wrote to memory of 2116 3688 cmd.exe findstr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BlitzedGrabber_.exe"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabber_.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile3⤵
-
C:\Windows\system32\findstr.exefindstr All3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name=65001 key=clear | findstr Key2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile name=65001 key=clear3⤵
-
C:\Windows\system32\findstr.exefindstr Key3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1416-137-0x0000000000000000-mapping.dmp
-
memory/2040-136-0x0000000000000000-mapping.dmp
-
memory/2116-143-0x0000000000000000-mapping.dmp
-
memory/3112-142-0x0000000000000000-mapping.dmp
-
memory/3220-138-0x0000000000000000-mapping.dmp
-
memory/3236-139-0x0000000000000000-mapping.dmp
-
memory/3612-135-0x00007FFDA47E0000-0x00007FFDA52A1000-memory.dmpFilesize
10.8MB
-
memory/3612-132-0x0000000000AD0000-0x0000000000C32000-memory.dmpFilesize
1.4MB
-
memory/3612-134-0x00007FFDA47E0000-0x00007FFDA52A1000-memory.dmpFilesize
10.8MB
-
memory/3612-133-0x000000001D9A0000-0x000000001D9BA000-memory.dmpFilesize
104KB
-
memory/3612-144-0x000000001C840000-0x000000001C852000-memory.dmpFilesize
72KB
-
memory/3612-145-0x000000001E460000-0x000000001E49C000-memory.dmpFilesize
240KB
-
memory/3688-140-0x0000000000000000-mapping.dmp
-
memory/5088-141-0x0000000000000000-mapping.dmp