Analysis

  • max time kernel
    165s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-01-2024 20:18

General

  • Target

    41c3b05debb26645393a5c7253f28e77.exe

  • Size

    594KB

  • MD5

    41c3b05debb26645393a5c7253f28e77

  • SHA1

    e1e8fcfdc15c34f7e1ce974e4278e79879fe86ae

  • SHA256

    584a847c7e779a2951440152072b93e4ecccb1b86148a2e289c2ccb86962ac34

  • SHA512

    c24771dee7d0e7651b2530623332c28b434da98cc3dbadf3af597225d71a9f2c699bd65f9155424ded2e3902ca1a2f63bc234345b10db9f06e724e9d90ec8351

  • SSDEEP

    12288:SfX25LrCxNuYlc+zakllH7RaR00QHtHx6fsZAvantxK13v6pcL4cUikDXR6sVc+i:SfX25LrCxNuYlcSXt0ehkASIN3CTmv+

Malware Config

Signatures

  • A310logger

    A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • A310logger Executable 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41c3b05debb26645393a5c7253f28e77.exe
    "C:\Users\Admin\AppData\Local\Temp\41c3b05debb26645393a5c7253f28e77.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Users\Admin\AppData\Local\Temp\41c3b05debb26645393a5c7253f28e77.exe
      "C:\Users\Admin\AppData\Local\Temp\41c3b05debb26645393a5c7253f28e77.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:408
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"
        3⤵
          PID:748
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"
          3⤵
            PID:5048
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 748 -ip 748
        1⤵
          PID:1672

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/408-3-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/408-5-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/408-8-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/3768-1-0x0000000001200000-0x0000000001300000-memory.dmp

          Filesize

          1024KB

        • memory/3768-2-0x0000000001AA0000-0x0000000001AA2000-memory.dmp

          Filesize

          8KB

        • memory/5048-11-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

        • memory/5048-12-0x0000000074540000-0x0000000074AF1000-memory.dmp

          Filesize

          5.7MB

        • memory/5048-13-0x0000000074540000-0x0000000074AF1000-memory.dmp

          Filesize

          5.7MB

        • memory/5048-14-0x00000000010C0000-0x00000000010D0000-memory.dmp

          Filesize

          64KB