Malware Analysis Report

2025-06-16 03:29

Sample ID 230505-zp3yksge8t
Target PaymentDetailsPDF.ace
SHA256 2ba004b6efeff55a066db441bba450821db12621087194916c50bd52b4094fdf
Tags
snakekeylogger stormkitty collection keylogger spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2ba004b6efeff55a066db441bba450821db12621087194916c50bd52b4094fdf

Threat Level: Known bad

The file PaymentDetailsPDF.ace was found to be: Known bad.

Malicious Activity Summary

snakekeylogger stormkitty collection keylogger spyware stealer

Snake Keylogger

StormKitty

StormKitty payload

Snake Keylogger payload

Reads user/profile data of web browsers

Checks computer location settings

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Enumerates physical storage devices

outlook_win_path

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

outlook_office_path

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-05 20:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-05 20:54

Reported

2023-05-05 23:08

Platform

win7-20230220-en

Max time kernel

72s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe"

Signatures

Snake Keylogger

stealer keylogger snakekeylogger

Snake Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1960 set thread context of 568 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1960 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Windows\SysWOW64\schtasks.exe
PID 1960 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Windows\SysWOW64\schtasks.exe
PID 1960 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Windows\SysWOW64\schtasks.exe
PID 1960 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Windows\SysWOW64\schtasks.exe
PID 1960 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe
PID 1960 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe
PID 1960 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe
PID 1960 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe
PID 1960 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe
PID 1960 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe
PID 1960 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe
PID 1960 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe
PID 1960 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe

"C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JSkmEG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBE8F.tmp"

C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe

"{path}"

Network

Country Destination Domain Proto
US 8.8.8.8:53 checkip.dyndns.org udp
US 193.122.130.0:80 checkip.dyndns.org tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp

Files

memory/1960-54-0x0000000000CE0000-0x0000000000D78000-memory.dmp

memory/1960-55-0x0000000004DF0000-0x0000000004E30000-memory.dmp

memory/1960-56-0x0000000000340000-0x000000000034C000-memory.dmp

memory/1960-57-0x0000000004DF0000-0x0000000004E30000-memory.dmp

memory/1960-58-0x0000000005110000-0x0000000005184000-memory.dmp

memory/1960-59-0x0000000000450000-0x0000000000476000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpBE8F.tmp

MD5 6b7793e8871108034653dddbfe160e57
SHA1 fe9bf05bf4a12184ea7cd831791359334824f5f7
SHA256 e1ac77f2cf87df20f73fc65e2ba5682b42f6b5402026a3cc765f854e7789d982
SHA512 936ae56074fc69b7fa807511627dcd7d752fb0f049538f3a01b25ea4d15ba065834f0c0cbe05364c47e59dcddf9bd1fb2c9c5ebffb75e9e4bc21c593381a7b1e

memory/568-63-0x0000000000400000-0x0000000000426000-memory.dmp

memory/568-64-0x0000000000400000-0x0000000000426000-memory.dmp

memory/568-65-0x0000000000400000-0x0000000000426000-memory.dmp

memory/568-66-0x0000000000400000-0x0000000000426000-memory.dmp

memory/568-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/568-68-0x0000000000400000-0x0000000000426000-memory.dmp

memory/568-70-0x0000000000400000-0x0000000000426000-memory.dmp

memory/568-72-0x0000000000400000-0x0000000000426000-memory.dmp

memory/568-73-0x00000000049A0000-0x00000000049E0000-memory.dmp

memory/568-74-0x00000000049A0000-0x00000000049E0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-05 20:54

Reported

2023-05-05 23:08

Platform

win10v2004-20230220-en

Max time kernel

158s

Max time network

170s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe"

Signatures

Snake Keylogger

stealer keylogger snakekeylogger

Snake Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 632 set thread context of 3716 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 632 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Windows\SysWOW64\schtasks.exe
PID 632 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Windows\SysWOW64\schtasks.exe
PID 632 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Windows\SysWOW64\schtasks.exe
PID 632 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe
PID 632 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe
PID 632 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe
PID 632 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe
PID 632 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe
PID 632 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe
PID 632 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe
PID 632 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe

"C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JSkmEG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp53EC.tmp"

C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe

"{path}"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3716 -ip 3716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 1540

Network

Country Destination Domain Proto
US 93.184.221.240:80 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
IE 13.69.239.74:443 tcp
US 40.125.122.176:443 tcp
US 8.248.3.254:80 tcp
US 8.8.8.8:53 checkip.dyndns.org udp
US 8.8.8.8:53 36.146.190.20.in-addr.arpa udp
BR 132.226.247.73:80 checkip.dyndns.org tcp
US 40.125.122.176:443 tcp
NL 173.223.113.164:443 tcp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 76.38.195.152.in-addr.arpa udp
US 40.125.122.176:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 193.122.130.0:80 checkip.dyndns.org tcp
US 40.125.122.176:443 tcp
JP 132.226.8.169:80 checkip.dyndns.org tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 158.101.44.242:80 checkip.dyndns.org tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/632-133-0x0000000000A80000-0x0000000000B18000-memory.dmp

memory/632-134-0x0000000005B30000-0x00000000060D4000-memory.dmp

memory/632-135-0x00000000054A0000-0x0000000005532000-memory.dmp

memory/632-136-0x0000000005620000-0x00000000056BC000-memory.dmp

memory/632-137-0x0000000005560000-0x000000000556A000-memory.dmp

memory/632-138-0x0000000005860000-0x0000000005870000-memory.dmp

memory/632-139-0x0000000005860000-0x0000000005870000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp53EC.tmp

MD5 704ba8ca112e912ed21908b7b07e3428
SHA1 9bde540f3da0967d4bf09319739e69114e78bac5
SHA256 cf88f704f9a2d99d072a464b4f0c3f6921e47975377d0f1fee2796fe005c9c2a
SHA512 22a89e0bd6b45a75f22eb8c0b9cda0e1ee0bd8ed8c2f0a1ce367839dec145856fa23715d0d55a50c80527500fb03fec7e96be071c193b6e2377a94295129dcb4

memory/3716-143-0x0000000000400000-0x0000000000426000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment Details PDF.exe.log

MD5 84e77a587d94307c0ac1357eb4d3d46f
SHA1 83cc900f9401f43d181207d64c5adba7a85edc1e
SHA256 e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
SHA512 aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691

memory/3716-146-0x0000000005850000-0x0000000005860000-memory.dmp

memory/3716-147-0x0000000005850000-0x0000000005860000-memory.dmp