Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
11/01/2024, 17:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0227690c43c0ff805235212dff403c1a.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0227690c43c0ff805235212dff403c1a.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 0227690c43c0ff805235212dff403c1a.exe
- Size 5.5MB
- Sample240111-v51e6sdff2
- SHA256 5982ee2f9702075b4dbc970ed9d8e142830ea74e35554c9e46ebacf2d42702c9
- MD5 0227690c43c0ff805235212dff403c1a
- SHA1 163b30d6c9aa13f0c60333a37e2603cf95eec233
- SHA512 ec2188213c314cbc7409853bde5d42a9c184eef09e15133f636dd063074463c8ce2376e969e7f19cf312c01fcf44999b9d71904bdb6ef4bba34729594963ead6
- SSDEEP 49152:WcW+05ANXBFbKL8Vz2+j4QVdRfeuF7d9xKQN8uatd6XgvNvuGv0tB1jrL3Q5fMX9:lpJKQN8uatrn41bqfRGTZ0925uFy
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/5032-0-0x0000000000400000-0x0000000000498000-memory.dmp family_stormkitty - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3668 set thread context of 5032 3668 0227690c43c0ff805235212dff403c1a.exe 16 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3668 0227690c43c0ff805235212dff403c1a.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe 5032 msbuild.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3668 0227690c43c0ff805235212dff403c1a.exe Token: SeDebugPrivilege 5032 msbuild.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5032 msbuild.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3668 wrote to memory of 5032 3668 0227690c43c0ff805235212dff403c1a.exe 16 PID 3668 wrote to memory of 5032 3668 0227690c43c0ff805235212dff403c1a.exe 16 PID 3668 wrote to memory of 5032 3668 0227690c43c0ff805235212dff403c1a.exe 16 PID 3668 wrote to memory of 5032 3668 0227690c43c0ff805235212dff403c1a.exe 16 PID 3668 wrote to memory of 5032 3668 0227690c43c0ff805235212dff403c1a.exe 16 PID 3668 wrote to memory of 5032 3668 0227690c43c0ff805235212dff403c1a.exe 16 PID 3668 wrote to memory of 5032 3668 0227690c43c0ff805235212dff403c1a.exe 16 PID 3668 wrote to memory of 5032 3668 0227690c43c0ff805235212dff403c1a.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\0227690c43c0ff805235212dff403c1a.exe"C:\Users\Admin\AppData\Local\Temp\0227690c43c0ff805235212dff403c1a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5032
-