stormkitty | 0db34a2edc14731f5a5b0a0cd0ce855f76a43f0279d0259383682ee59eba43f2

Analysis

max time kernel
13s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2023, 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZAZAgenv2.exe (1).exe
Size

3.8MB
MD5

5adc42fc3c4641933072fd628c07778b
SHA1

88dacdf1ab3aea812c7aaeb0e532edddf22c1ef4
SHA256

0db34a2edc14731f5a5b0a0cd0ce855f76a43f0279d0259383682ee59eba43f2
SHA512

9fcfda10612301d90846042b8a8ee5519012727caf5c4138037934b6ccd12cd9808c2e1c8378e54cc72b7a26fbc1274224179bb36e17f937b2254ba4b4dc7678
SSDEEP

98304:Qu0T+Srp3YVrsk9N8ivyhAdsPSQxhsnWJLXq0f9ogdCyb:QtfSVN8iNISOlJzqwf

Score

10^/10

stormkitty spyware stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/808-132-0x0000000000B00000-0x0000000000EE0000-memory.dmp	family_stormkitty

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/808-132-0x0000000000B00000-0x0000000000EE0000-memory.dmp	WebBrowserPassView
behavioral1/files/0x0006000000022f85-135.dat	WebBrowserPassView
behavioral1/files/0x0006000000022f85-138.dat	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral1/memory/808-132-0x0000000000B00000-0x0000000000EE0000-memory.dmp	Nirsoft
behavioral1/files/0x0006000000022f85-135.dat	Nirsoft
behavioral1/files/0x0006000000022f85-138.dat	Nirsoft

Executes dropped EXE 1 IoCs

pid	Process
1224	svchoster.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	ZAZAgenv2.exe (1).exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	checkip.dyndns.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1224	svchoster.exe
1224	svchoster.exe
1224	svchoster.exe
1224	svchoster.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	808	ZAZAgenv2.exe (1).exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
808	ZAZAgenv2.exe (1).exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 4816	808	ZAZAgenv2.exe (1).exe	80
PID 808 wrote to memory of 4816	808	ZAZAgenv2.exe (1).exe	80
PID 808 wrote to memory of 4816	808	ZAZAgenv2.exe (1).exe	80
PID 4816 wrote to memory of 1224	4816	cmd.exe	82
PID 4816 wrote to memory of 1224	4816	cmd.exe	82
PID 4816 wrote to memory of 1224	4816	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\ZAZAgenv2.exe (1).exe
"C:\Users\Admin\AppData\Local\Temp\ZAZAgenv2.exe (1).exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C start %temp%\svchoster.exe /stext "%temp%\Passes.cpp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Users\Admin\AppData\Local\Temp\svchoster.exe
    C:\Users\Admin\AppData\Local\Temp\svchoster.exe /stext "C:\Users\Admin\AppData\Local\Temp\Passes.cpp"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchoster.exe

Filesize
391KB

MD5
053778713819beab3df309df472787cd

SHA1
99c7b5827df89b4fafc2b565abed97c58a3c65b8

SHA256
f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe

SHA512
35a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchoster.exe

Filesize
391KB

MD5
053778713819beab3df309df472787cd

SHA1
99c7b5827df89b4fafc2b565abed97c58a3c65b8

SHA256
f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe

SHA512
35a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb

Download Submit
memory/808-132-0x0000000000B00000-0x0000000000EE0000-memory.dmp

Filesize
3.9MB

Download
memory/808-136-0x00000000067F0000-0x0000000006882000-memory.dmp

Filesize
584KB

Download
memory/808-137-0x0000000006E40000-0x00000000073E4000-memory.dmp

Filesize
5.6MB

Download
memory/808-139-0x0000000007C90000-0x0000000007D06000-memory.dmp

Filesize
472KB

Download
memory/808-140-0x0000000006DE0000-0x0000000006DFE000-memory.dmp

Filesize
120KB

Download