stormkitty | 9e1dd477999ef5e83ef7e238a8c1df3b1b618c1f5cc72a8a98dd4352b06267a5

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c177d70d7e3fd9c9499011cce57cc800.exe
Size

1.3MB
MD5

c177d70d7e3fd9c9499011cce57cc800
SHA1

418e8e996d6e2e5e0d58a74276a771492b0e7283
SHA256

9e1dd477999ef5e83ef7e238a8c1df3b1b618c1f5cc72a8a98dd4352b06267a5
SHA512

2055b5f3ab4376c49f5ab055b09ced4c0bf4a484cd6aae94d1b6bbc9dfecc6e28c9d7c57f97ef64588bc9249e5c7cf25c24acbeb5cf5b02a8e44b022b00c7281
SSDEEP

24576:1LF7NWgiaJrPJTLbGi777hcCwJ5sfeKuCdeMj65PJUSJ+QRZKiCoXvHUZC8ur8h9:NthjlpLbGCwJOfrn45prP/0Rur8hfl

Score

10^/10

stormkitty evasion stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/2448-24-0x0000000004B90000-0x0000000004C4E000-memory.dmp	family_stormkitty

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	c177d70d7e3fd9c9499011cce57cc800.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	c177d70d7e3fd9c9499011cce57cc800.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c177d70d7e3fd9c9499011cce57cc800.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c177d70d7e3fd9c9499011cce57cc800.exe

Executes dropped EXE 1 IoCs

pid	Process
2176	ctfmom.exe

Loads dropped DLL 1 IoCs

pid	Process
2448	c177d70d7e3fd9c9499011cce57cc800.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	c177d70d7e3fd9c9499011cce57cc800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	c177d70d7e3fd9c9499011cce57cc800.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2728 set thread context of 2448	2728	c177d70d7e3fd9c9499011cce57cc800.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2176	ctfmom.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2448	c177d70d7e3fd9c9499011cce57cc800.exe
2448	c177d70d7e3fd9c9499011cce57cc800.exe
2448	c177d70d7e3fd9c9499011cce57cc800.exe
2448	c177d70d7e3fd9c9499011cce57cc800.exe
2448	c177d70d7e3fd9c9499011cce57cc800.exe
2448	c177d70d7e3fd9c9499011cce57cc800.exe
2448	c177d70d7e3fd9c9499011cce57cc800.exe
2448	c177d70d7e3fd9c9499011cce57cc800.exe
2448	c177d70d7e3fd9c9499011cce57cc800.exe
2448	c177d70d7e3fd9c9499011cce57cc800.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	c177d70d7e3fd9c9499011cce57cc800.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2448	2728	c177d70d7e3fd9c9499011cce57cc800.exe	29
PID 2728 wrote to memory of 2448	2728	c177d70d7e3fd9c9499011cce57cc800.exe	29
PID 2728 wrote to memory of 2448	2728	c177d70d7e3fd9c9499011cce57cc800.exe	29
PID 2728 wrote to memory of 2448	2728	c177d70d7e3fd9c9499011cce57cc800.exe	29
PID 2728 wrote to memory of 2448	2728	c177d70d7e3fd9c9499011cce57cc800.exe	29
PID 2728 wrote to memory of 2448	2728	c177d70d7e3fd9c9499011cce57cc800.exe	29
PID 2728 wrote to memory of 2448	2728	c177d70d7e3fd9c9499011cce57cc800.exe	29
PID 2728 wrote to memory of 2448	2728	c177d70d7e3fd9c9499011cce57cc800.exe	29
PID 2728 wrote to memory of 2448	2728	c177d70d7e3fd9c9499011cce57cc800.exe	29
PID 2448 wrote to memory of 2768	2448	c177d70d7e3fd9c9499011cce57cc800.exe	32
PID 2448 wrote to memory of 2768	2448	c177d70d7e3fd9c9499011cce57cc800.exe	32
PID 2448 wrote to memory of 2768	2448	c177d70d7e3fd9c9499011cce57cc800.exe	32
PID 2448 wrote to memory of 2768	2448	c177d70d7e3fd9c9499011cce57cc800.exe	32
PID 2448 wrote to memory of 2920	2448	c177d70d7e3fd9c9499011cce57cc800.exe	33
PID 2448 wrote to memory of 2920	2448	c177d70d7e3fd9c9499011cce57cc800.exe	33
PID 2448 wrote to memory of 2920	2448	c177d70d7e3fd9c9499011cce57cc800.exe	33
PID 2448 wrote to memory of 2920	2448	c177d70d7e3fd9c9499011cce57cc800.exe	33
PID 2448 wrote to memory of 580	2448	c177d70d7e3fd9c9499011cce57cc800.exe	34
PID 2448 wrote to memory of 580	2448	c177d70d7e3fd9c9499011cce57cc800.exe	34
PID 2448 wrote to memory of 580	2448	c177d70d7e3fd9c9499011cce57cc800.exe	34
PID 2448 wrote to memory of 580	2448	c177d70d7e3fd9c9499011cce57cc800.exe	34
PID 2448 wrote to memory of 2916	2448	c177d70d7e3fd9c9499011cce57cc800.exe	35
PID 2448 wrote to memory of 2916	2448	c177d70d7e3fd9c9499011cce57cc800.exe	35
PID 2448 wrote to memory of 2916	2448	c177d70d7e3fd9c9499011cce57cc800.exe	35
PID 2448 wrote to memory of 2916	2448	c177d70d7e3fd9c9499011cce57cc800.exe	35
PID 2448 wrote to memory of 380	2448	c177d70d7e3fd9c9499011cce57cc800.exe	36
PID 2448 wrote to memory of 380	2448	c177d70d7e3fd9c9499011cce57cc800.exe	36
PID 2448 wrote to memory of 380	2448	c177d70d7e3fd9c9499011cce57cc800.exe	36
PID 2448 wrote to memory of 380	2448	c177d70d7e3fd9c9499011cce57cc800.exe	36
PID 2448 wrote to memory of 2176	2448	c177d70d7e3fd9c9499011cce57cc800.exe	37
PID 2448 wrote to memory of 2176	2448	c177d70d7e3fd9c9499011cce57cc800.exe	37
PID 2448 wrote to memory of 2176	2448	c177d70d7e3fd9c9499011cce57cc800.exe	37
PID 2448 wrote to memory of 2176	2448	c177d70d7e3fd9c9499011cce57cc800.exe	37

C:\Users\Admin\AppData\Local\Temp\c177d70d7e3fd9c9499011cce57cc800.exe
"C:\Users\Admin\AppData\Local\Temp\c177d70d7e3fd9c9499011cce57cc800.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\AppData\Local\Temp\c177d70d7e3fd9c9499011cce57cc800.exe
  "{path}"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2768
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2920
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:580
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2916
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:380
- - C:\Users\Admin\AppData\Roaming\Microsoft\ctfmom.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\ctfmom.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\ctfmom.exe

Filesize
42KB

MD5
998d4888b99734c60802f93fb2daf940

SHA1
297a395d096ca67b885134dea1147c270b402c1a

SHA256
d63c4166014d50c6321e82e1c6de7c1a2207b0e09f541d1275d0109aa1d191b5

SHA512
2658aab48807606dc83c4b822438b5454a3df19f4db015d30b8b330baab6218a8a259bb33a2e57398e3c6823059ea49477b4d79df63fe383a9f4725359899190

Download Submit
memory/2176-37-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2176-35-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2176-34-0x0000000000A20000-0x0000000000A30000-memory.dmp

Filesize
64KB

Download
memory/2448-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2448-17-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2448-36-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2448-24-0x0000000004B90000-0x0000000004C4E000-memory.dmp

Filesize
760KB

Download
memory/2448-23-0x00000000003C0000-0x00000000003D4000-memory.dmp

Filesize
80KB

Download
memory/2448-10-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2448-11-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2448-12-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2448-19-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2448-9-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2448-20-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2448-15-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2448-22-0x0000000000580000-0x00000000005C0000-memory.dmp

Filesize
256KB

Download
memory/2728-5-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2728-0-0x00000000009D0000-0x0000000000B18000-memory.dmp

Filesize
1.3MB

Download
memory/2728-21-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2728-8-0x0000000005940000-0x0000000005A12000-memory.dmp

Filesize
840KB

Download
memory/2728-7-0x0000000005380000-0x00000000054A8000-memory.dmp

Filesize
1.2MB

Download
memory/2728-4-0x00000000003C0000-0x00000000003C8000-memory.dmp

Filesize
32KB

Download
memory/2728-3-0x00000000049B0000-0x00000000049F0000-memory.dmp

Filesize
256KB

Download
memory/2728-2-0x0000000006EA0000-0x0000000006FCE000-memory.dmp

Filesize
1.2MB

Download
memory/2728-6-0x00000000049B0000-0x00000000049F0000-memory.dmp

Filesize
256KB

Download
memory/2728-1-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download