Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
30-01-2023 01:35
Behavioral task
behavioral1
Sample
BlitzedGrabber_.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
BlitzedGrabber_.exe
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
BlitzedGrabber_.exe
Resource
win10v2004-20221111-en
General
-
Target
BlitzedGrabber_.exe
-
Size
1.4MB
-
MD5
ea795ffff4c8f24a343102ab0d86c010
-
SHA1
0a0dd7abf548567caccc32fd06a6f45790ffd1d4
-
SHA256
a4fad46b0ab068cb7e5de1f3e970101ff2501c5b0608ada10442bcf891c5f8bb
-
SHA512
b3f8428226e3e23febdd5f6b08f4a788cb62cc1795627b39660fafdbb810c4c7239c29f8833dbc3431a0559591958d0b2f68f36b3be065bdaa122f55666c8ae3
-
SSDEEP
24576:/40iMngrdePNzQ0ZIxNXaV9x4IUgs36BUI2So5+jnzFYCaGApu8:AsgReFs0ZM0T+Sk6BU7HIFY7G98
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2404-116-0x00000000007F0000-0x0000000000952000-memory.dmp family_stormkitty -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
BlitzedGrabber_.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\vwWhF = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BlitzedGrabber_.exe" BlitzedGrabber_.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 checkip.dyndns.org -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
BlitzedGrabber_.exedescription pid process Token: SeDebugPrivilege 2404 BlitzedGrabber_.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
BlitzedGrabber_.execmd.execmd.exedescription pid process target process PID 2404 wrote to memory of 2912 2404 BlitzedGrabber_.exe cmd.exe PID 2404 wrote to memory of 2912 2404 BlitzedGrabber_.exe cmd.exe PID 2912 wrote to memory of 3716 2912 cmd.exe chcp.com PID 2912 wrote to memory of 3716 2912 cmd.exe chcp.com PID 2912 wrote to memory of 4752 2912 cmd.exe netsh.exe PID 2912 wrote to memory of 4752 2912 cmd.exe netsh.exe PID 2912 wrote to memory of 4768 2912 cmd.exe findstr.exe PID 2912 wrote to memory of 4768 2912 cmd.exe findstr.exe PID 2404 wrote to memory of 2120 2404 BlitzedGrabber_.exe cmd.exe PID 2404 wrote to memory of 2120 2404 BlitzedGrabber_.exe cmd.exe PID 2120 wrote to memory of 4804 2120 cmd.exe chcp.com PID 2120 wrote to memory of 4804 2120 cmd.exe chcp.com PID 2120 wrote to memory of 4824 2120 cmd.exe netsh.exe PID 2120 wrote to memory of 4824 2120 cmd.exe netsh.exe PID 2120 wrote to memory of 4856 2120 cmd.exe findstr.exe PID 2120 wrote to memory of 4856 2120 cmd.exe findstr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BlitzedGrabber_.exe"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabber_.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile3⤵
-
C:\Windows\system32\findstr.exefindstr All3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name=65001 key=clear | findstr Key2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile name=65001 key=clear3⤵
-
C:\Windows\system32\findstr.exefindstr Key3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2120-123-0x0000000000000000-mapping.dmp
-
memory/2404-127-0x000000001D0F0000-0x000000001D102000-memory.dmpFilesize
72KB
-
memory/2404-117-0x00000000010A0000-0x00000000010AA000-memory.dmpFilesize
40KB
-
memory/2404-118-0x000000001B500000-0x000000001B51A000-memory.dmpFilesize
104KB
-
memory/2404-116-0x00000000007F0000-0x0000000000952000-memory.dmpFilesize
1.4MB
-
memory/2404-128-0x000000001E120000-0x000000001E15E000-memory.dmpFilesize
248KB
-
memory/2912-119-0x0000000000000000-mapping.dmp
-
memory/3716-120-0x0000000000000000-mapping.dmp
-
memory/4752-121-0x0000000000000000-mapping.dmp
-
memory/4768-122-0x0000000000000000-mapping.dmp
-
memory/4804-124-0x0000000000000000-mapping.dmp
-
memory/4824-125-0x0000000000000000-mapping.dmp
-
memory/4856-126-0x0000000000000000-mapping.dmp