stormkitty | 5982ee2f9702075b4dbc970ed9d8e142830ea74e35554c9e46ebacf2d42702c9

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 17:35

Target
0227690c43c0ff805235212dff403c1a.exe
Size 5.5MB
Sample240111-v51e6sdff2
SHA256 5982ee2f9702075b4dbc970ed9d8e142830ea74e35554c9e46ebacf2d42702c9
MD5 0227690c43c0ff805235212dff403c1a
SHA1 163b30d6c9aa13f0c60333a37e2603cf95eec233
SHA512 ec2188213c314cbc7409853bde5d42a9c184eef09e15133f636dd063074463c8ce2376e969e7f19cf312c01fcf44999b9d71904bdb6ef4bba34729594963ead6
SSDEEP 49152:WcW+05ANXBFbKL8Vz2+j4QVdRfeuF7d9xKQN8uatd6XgvNvuGv0tB1jrL3Q5fMX9:lpJKQN8uatrn41bqfRGTZ0925uFy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/memory/2056-4-0x0000000000400000-0x0000000000498000-memory.dmp	family_stormkitty
behavioral1/memory/2056-5-0x0000000000400000-0x0000000000498000-memory.dmp	family_stormkitty

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2084	0227690c43c0ff805235212dff403c1a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2084	0227690c43c0ff805235212dff403c1a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2056	2084	0227690c43c0ff805235212dff403c1a.exe	28
PID 2084 wrote to memory of 2056	2084	0227690c43c0ff805235212dff403c1a.exe	28
PID 2084 wrote to memory of 2056	2084	0227690c43c0ff805235212dff403c1a.exe	28
PID 2084 wrote to memory of 2056	2084	0227690c43c0ff805235212dff403c1a.exe	28
PID 2084 wrote to memory of 2056	2084	0227690c43c0ff805235212dff403c1a.exe	28
PID 2084 wrote to memory of 2056	2084	0227690c43c0ff805235212dff403c1a.exe	28
PID 2084 wrote to memory of 2056	2084	0227690c43c0ff805235212dff403c1a.exe	28
PID 2084 wrote to memory of 2056	2084	0227690c43c0ff805235212dff403c1a.exe	28

C:\Users\Admin\AppData\Local\Temp\0227690c43c0ff805235212dff403c1a.exe
"C:\Users\Admin\AppData\Local\Temp\0227690c43c0ff805235212dff403c1a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:2056

memory/2056-0-0x0000000000400000-0x0000000000498000-memory.dmp

Download

memory/2056-2-0x0000000000400000-0x0000000000498000-memory.dmp

Download

memory/2056-4-0x0000000000400000-0x0000000000498000-memory.dmp

Download

memory/2056-5-0x0000000000400000-0x0000000000498000-memory.dmp

Download