Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
10-08-2023 13:44
Behavioral task
behavioral1
Sample
161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe
Resource
win7-20230712-en
General
-
Target
161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe
-
Size
232KB
-
MD5
2edd2a16ac037ec6ec19b7ec1de8d158
-
SHA1
d9ba0bce953bf5f42962e61fd0eb17ac86d83643
-
SHA256
161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63
-
SHA512
a6eff00a9a7114aa230144e1de3d50ff19b7203e437bbabf61d86fb2758e0e7bc2a8d409cbf46dcafaf79ad993ffe6afaa6110433df5429be926b41ac9f5eb85
-
SSDEEP
6144:HDubaBBOBIIj6HLLYLCYJqvc1DcCCB1ZHbu3Mi3//RBJpfq:SbaDCCdapp
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot5528293567:AAEvVqFZRYkeHFch3_kTGdMV2u4Swi0-pT8/sendMessage?chat_id=1787677484
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/3924-134-0x00000000001C0000-0x0000000000200000-memory.dmp family_stormkitty -
Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/3924-134-0x00000000001C0000-0x0000000000200000-memory.dmp asyncrat -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 9 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\917285dd49ea028f474fd9f7383ad889\Admin@YACSFKWT_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe File opened for modification C:\Users\Admin\AppData\Local\917285dd49ea028f474fd9f7383ad889\Admin@YACSFKWT_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe File created C:\Users\Admin\AppData\Local\917285dd49ea028f474fd9f7383ad889\Admin@YACSFKWT_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe File created C:\Users\Admin\AppData\Local\917285dd49ea028f474fd9f7383ad889\Admin@YACSFKWT_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe File created C:\Users\Admin\AppData\Local\917285dd49ea028f474fd9f7383ad889\Admin@YACSFKWT_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe File opened for modification C:\Users\Admin\AppData\Local\917285dd49ea028f474fd9f7383ad889\Admin@YACSFKWT_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe File opened for modification C:\Users\Admin\AppData\Local\917285dd49ea028f474fd9f7383ad889\Admin@YACSFKWT_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe File created C:\Users\Admin\AppData\Local\917285dd49ea028f474fd9f7383ad889\Admin@YACSFKWT_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe File created C:\Users\Admin\AppData\Local\917285dd49ea028f474fd9f7383ad889\Admin@YACSFKWT_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4908 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe Token: SeDebugPrivilege 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3924 wrote to memory of 1924 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 90 PID 3924 wrote to memory of 1924 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 90 PID 3924 wrote to memory of 1924 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 90 PID 1924 wrote to memory of 2092 1924 cmd.exe 92 PID 1924 wrote to memory of 2092 1924 cmd.exe 92 PID 1924 wrote to memory of 2092 1924 cmd.exe 92 PID 1924 wrote to memory of 688 1924 cmd.exe 93 PID 1924 wrote to memory of 688 1924 cmd.exe 93 PID 1924 wrote to memory of 688 1924 cmd.exe 93 PID 1924 wrote to memory of 4832 1924 cmd.exe 94 PID 1924 wrote to memory of 4832 1924 cmd.exe 94 PID 1924 wrote to memory of 4832 1924 cmd.exe 94 PID 3924 wrote to memory of 4616 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 95 PID 3924 wrote to memory of 4616 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 95 PID 3924 wrote to memory of 4616 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 95 PID 4616 wrote to memory of 3236 4616 cmd.exe 97 PID 4616 wrote to memory of 3236 4616 cmd.exe 97 PID 4616 wrote to memory of 3236 4616 cmd.exe 97 PID 4616 wrote to memory of 4836 4616 cmd.exe 98 PID 4616 wrote to memory of 4836 4616 cmd.exe 98 PID 4616 wrote to memory of 4836 4616 cmd.exe 98 PID 3924 wrote to memory of 4908 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 100 PID 3924 wrote to memory of 4908 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 100 PID 3924 wrote to memory of 4908 3924 161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe"C:\Users\Admin\AppData\Local\Temp\161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:2092
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵PID:688
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵PID:4832
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:3236
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵PID:4836
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\AppData\Local\Temp\161b63a97d89bf3531175f3de3ade5c1c4eab758530943f018906ea26310ed63.exe"2⤵
- Creates scheduled task(s)
PID:4908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\917285dd49ea028f474fd9f7383ad889\Admin@YACSFKWT_en-US\Browsers\Firefox\Bookmarks.txt
Filesize105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\Users\Admin\AppData\Local\917285dd49ea028f474fd9f7383ad889\Admin@YACSFKWT_en-US\System\Process.txt
Filesize4KB
MD59a237eb6afb31e775989d5a2f5ef63fa
SHA1f5935186fdc15957d26a5f19ee4c58754b1e51b6
SHA2560fcbbc13d3b6f6fe05932ac2a012ea5081a2892769e55c99bffea316828b2c22
SHA5121f8b04942b10edae1793c6e5ed890e6714526d869b0a161c056e1353838de269a7cb5468ec7ce42f2e573bef7ffeb7ca347087a7c67ad9a2a7edaca762cee219
-
Filesize
6B
MD50cd9bd0c2aff58c347c9d512127d7e2c
SHA1cf40cf73d318e1c3cdbac684ac5c696713e147ae
SHA2564cf1a1c089ca12a669060c472f0b4e22b97d3c8887382c65badf527885e34752
SHA512a166414ab94d8bfee56ef8c2b18f155698da374138b2394d660760b5e6461ba869daa7bc963f8ff6c98055bacdee2838fc8fee87ef97755290710f294b7d3e40