stormkitty | b1ae4b96a33486d7abc09f7405c450934531920de0d44cde7e628f08b753e6d9

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05/05/2023, 11:18

Target

Prynt_Stealer_5.6.exe
Size

379KB
MD5

c9b42a5736dc621a27af89075e9cd8b4
SHA1

5464f9a113e2b7078c9566b87e8eec5d648a88f5
SHA256

b1ae4b96a33486d7abc09f7405c450934531920de0d44cde7e628f08b753e6d9
SHA512

c331f5352f7414bf08da0d27bf3af5235742f4edc20fda6f0f5bbc31c2787f7c753c829a89c872b39b68de348185a5dc19a9fecfd837e63109f9c4f4c951e329
SSDEEP

6144:PbAD4AecSEuNYnMuBAnLzuyvwWoSF45AcTG8OnXKxRvcSEuNYnMuBAnLzuyvwWob:3FEuNYB8z1wWo4sAIGtX+VFEuNYB8z1

Score

10^/10

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/1108-54-0x0000000000950000-0x00000000009B6000-memory.dmp	family_stormkitty

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1416	1108	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1416	1108	Prynt_Stealer_5.6.exe	28
PID 1108 wrote to memory of 1416	1108	Prynt_Stealer_5.6.exe	28
PID 1108 wrote to memory of 1416	1108	Prynt_Stealer_5.6.exe	28
PID 1108 wrote to memory of 1416	1108	Prynt_Stealer_5.6.exe	28

C:\Users\Admin\AppData\Local\Temp\Prynt_Stealer_5.6.exe
"C:\Users\Admin\AppData\Local\Temp\Prynt_Stealer_5.6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 632
  2⤵
  - Program crash
  PID:1416

memory/1108-54-0x0000000000950000-0x00000000009B6000-memory.dmp

Filesize
408KB

Download
memory/1108-55-0x00000000042D0000-0x0000000004310000-memory.dmp

Filesize
256KB

Download