Analysis
-
max time kernel
226s -
max time network
252s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2023 01:35
Behavioral task
behavioral1
Sample
BlitzedGrabber_.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
BlitzedGrabber_.exe
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
BlitzedGrabber_.exe
Resource
win10v2004-20221111-en
General
-
Target
BlitzedGrabber_.exe
-
Size
1.4MB
-
MD5
ea795ffff4c8f24a343102ab0d86c010
-
SHA1
0a0dd7abf548567caccc32fd06a6f45790ffd1d4
-
SHA256
a4fad46b0ab068cb7e5de1f3e970101ff2501c5b0608ada10442bcf891c5f8bb
-
SHA512
b3f8428226e3e23febdd5f6b08f4a788cb62cc1795627b39660fafdbb810c4c7239c29f8833dbc3431a0559591958d0b2f68f36b3be065bdaa122f55666c8ae3
-
SSDEEP
24576:/40iMngrdePNzQ0ZIxNXaV9x4IUgs36BUI2So5+jnzFYCaGApu8:AsgReFs0ZM0T+Sk6BU7HIFY7G98
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
Processes:
resource yara_rule behavioral3/memory/2420-132-0x0000000000880000-0x00000000009E2000-memory.dmp family_stormkitty -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
BlitzedGrabber_.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FykXC = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BlitzedGrabber_.exe" BlitzedGrabber_.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
BlitzedGrabber_.exedescription pid process Token: SeDebugPrivilege 2420 BlitzedGrabber_.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
BlitzedGrabber_.execmd.execmd.exedescription pid process target process PID 2420 wrote to memory of 3208 2420 BlitzedGrabber_.exe cmd.exe PID 2420 wrote to memory of 3208 2420 BlitzedGrabber_.exe cmd.exe PID 3208 wrote to memory of 4564 3208 cmd.exe chcp.com PID 3208 wrote to memory of 4564 3208 cmd.exe chcp.com PID 3208 wrote to memory of 5020 3208 cmd.exe netsh.exe PID 3208 wrote to memory of 5020 3208 cmd.exe netsh.exe PID 3208 wrote to memory of 1768 3208 cmd.exe findstr.exe PID 3208 wrote to memory of 1768 3208 cmd.exe findstr.exe PID 2420 wrote to memory of 2612 2420 BlitzedGrabber_.exe cmd.exe PID 2420 wrote to memory of 2612 2420 BlitzedGrabber_.exe cmd.exe PID 2612 wrote to memory of 2260 2612 cmd.exe chcp.com PID 2612 wrote to memory of 2260 2612 cmd.exe chcp.com PID 2612 wrote to memory of 3668 2612 cmd.exe netsh.exe PID 2612 wrote to memory of 3668 2612 cmd.exe netsh.exe PID 2612 wrote to memory of 1632 2612 cmd.exe findstr.exe PID 2612 wrote to memory of 1632 2612 cmd.exe findstr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BlitzedGrabber_.exe"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabber_.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile3⤵
-
C:\Windows\system32\findstr.exefindstr All3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name=65001 key=clear | findstr Key2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\findstr.exefindstr Key3⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile name=65001 key=clear3⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1632-143-0x0000000000000000-mapping.dmp
-
memory/1768-139-0x0000000000000000-mapping.dmp
-
memory/2260-141-0x0000000000000000-mapping.dmp
-
memory/2420-144-0x0000000002A90000-0x0000000002AA2000-memory.dmpFilesize
72KB
-
memory/2420-133-0x000000001B530000-0x000000001B54A000-memory.dmpFilesize
104KB
-
memory/2420-134-0x00007FF84FDF0000-0x00007FF8508B1000-memory.dmpFilesize
10.8MB
-
memory/2420-135-0x00007FF84FDF0000-0x00007FF8508B1000-memory.dmpFilesize
10.8MB
-
memory/2420-146-0x00007FF84FDF0000-0x00007FF8508B1000-memory.dmpFilesize
10.8MB
-
memory/2420-145-0x000000001DA50000-0x000000001DA8C000-memory.dmpFilesize
240KB
-
memory/2420-132-0x0000000000880000-0x00000000009E2000-memory.dmpFilesize
1.4MB
-
memory/2612-140-0x0000000000000000-mapping.dmp
-
memory/3208-136-0x0000000000000000-mapping.dmp
-
memory/3668-142-0x0000000000000000-mapping.dmp
-
memory/4564-137-0x0000000000000000-mapping.dmp
-
memory/5020-138-0x0000000000000000-mapping.dmp