stormkitty | d4561d80d1bcb093a570698bcf6ac849f934ec93808d08e584b8494cf3541633

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 20:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
Size 1.1MB
Sample240407-zkhf3sed86
SHA256 d4561d80d1bcb093a570698bcf6ac849f934ec93808d08e584b8494cf3541633
MD5 e5d281474a6cc282d0305b2850c2122d
SHA1 3c22a7febebc72a4491c625becbeb514fde8bfcc
SHA512 3f060b1e7c26a73f9e70bba6e8314f0549b20fcbf402c79cde51dedfc0fdb10af858c2d5101e6e688ba9f64c222493e20ec2e2bee83ee1ff99d5e6171b94b978
SSDEEP 24576:75gUrEymgelv0b26vtSlzSkUByRjGWBaRnrDB6qWIwjM1BMwnFfFFQs:op6lS9U45na5H4qffo+V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stormkitty spyware stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/3516-8-0x0000000000400000-0x0000000000428000-memory.dmp	family_stormkitty

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\366ed57b903cf6eeb1dd488e6d8bf7b2\Admin@QMWIRSIY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\366ed57b903cf6eeb1dd488e6d8bf7b2\Admin@QMWIRSIY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\366ed57b903cf6eeb1dd488e6d8bf7b2\Admin@QMWIRSIY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\366ed57b903cf6eeb1dd488e6d8bf7b2\Admin@QMWIRSIY_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\366ed57b903cf6eeb1dd488e6d8bf7b2\Admin@QMWIRSIY_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\366ed57b903cf6eeb1dd488e6d8bf7b2\Admin@QMWIRSIY_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4468 set thread context of 3516	4468	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe	97

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3552	3516	WerFault.exe	97

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3516	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
3516	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
3516	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
3516	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
3516	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
3516	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
3516	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
3516	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4468	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
Token: SeDebugPrivilege	3516	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 3516	4468	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe	97
PID 4468 wrote to memory of 3516	4468	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe	97
PID 4468 wrote to memory of 3516	4468	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe	97
PID 4468 wrote to memory of 3516	4468	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe	97
PID 4468 wrote to memory of 3516	4468	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe	97
PID 4468 wrote to memory of 3516	4468	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe	97
PID 4468 wrote to memory of 3516	4468	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe	97
PID 4468 wrote to memory of 3516	4468	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe	97
PID 3516 wrote to memory of 1416	3516	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe	98
PID 3516 wrote to memory of 1416	3516	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe	98
PID 3516 wrote to memory of 1416	3516	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe	98
PID 1416 wrote to memory of 220	1416	cmd.exe	100
PID 1416 wrote to memory of 220	1416	cmd.exe	100
PID 1416 wrote to memory of 220	1416	cmd.exe	100
PID 1416 wrote to memory of 3872	1416	cmd.exe	101
PID 1416 wrote to memory of 3872	1416	cmd.exe	101
PID 1416 wrote to memory of 3872	1416	cmd.exe	101
PID 1416 wrote to memory of 4920	1416	cmd.exe	102
PID 1416 wrote to memory of 4920	1416	cmd.exe	102
PID 1416 wrote to memory of 4920	1416	cmd.exe	102
PID 3516 wrote to memory of 2468	3516	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe	106
PID 3516 wrote to memory of 2468	3516	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe	106
PID 3516 wrote to memory of 2468	3516	e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe	106
PID 2468 wrote to memory of 1816	2468	cmd.exe	108
PID 2468 wrote to memory of 1816	2468	cmd.exe	108
PID 2468 wrote to memory of 1816	2468	cmd.exe	108
PID 2468 wrote to memory of 2452	2468	cmd.exe	109
PID 2468 wrote to memory of 2452	2468	cmd.exe	109
PID 2468 wrote to memory of 2452	2468	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe
  2⤵
  - Drops desktop.ini file(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:220
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      PID:3872
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      PID:4920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 1540
    3⤵
    - Program crash
    PID:3552
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:1816
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3516 -ip 3516
1⤵
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\366ed57b903cf6eeb1dd488e6d8bf7b2\Admin@QMWIRSIY_en-US\Browsers\Firefox\Bookmarks.txt
Size 105B
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
MD5 SHA1 SHA512

Submit Download

e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e5d281474a6cc282d0305b2850c2122d_JaffaCakes118.exe.log
Size 1KB
SHA256 ec6d19eb08b687204fa86c258bf922e7e33a738b569679b052f5fc0042890462
MD5 89dc1f962a60648e2bfaf5172aaac2fc
SHA1 f451c0e5977d03484599a3064da7a25e7cba2ea3
SHA512 851a45870b76082b6d4e763d2386c1d4306e910cc4f4330f3f05d2dc48ef4cb37253aff477bf39e1eeae7770930497d1c9c5f405b565ececcad421600b0b2d62
MD5 SHA1 SHA512

Submit Download

memory/3516-11-0x0000000005380000-0x00000000053E6000-memory.dmp

Download

memory/3516-8-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3516-90-0x00000000753C0000-0x0000000075B70000-memory.dmp

Download

memory/3516-14-0x0000000005580000-0x0000000005590000-memory.dmp

Download

memory/3516-13-0x00000000753C0000-0x0000000075B70000-memory.dmp

Download

memory/4468-2-0x0000000005370000-0x0000000005380000-memory.dmp

Download

memory/4468-7-0x0000000005470000-0x0000000005492000-memory.dmp

Download

memory/4468-3-0x0000000005A50000-0x0000000005FF4000-memory.dmp

Download

memory/4468-6-0x0000000006530000-0x0000000006A5C000-memory.dmp

Download

memory/4468-12-0x00000000753C0000-0x0000000075B70000-memory.dmp

Download

memory/4468-0-0x0000000000A10000-0x0000000000B26000-memory.dmp

Download

memory/4468-5-0x00000000053C0000-0x00000000053CA000-memory.dmp

Download

memory/4468-1-0x00000000753C0000-0x0000000075B70000-memory.dmp

Download

memory/4468-4-0x00000000054A0000-0x0000000005532000-memory.dmp

Download