Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
-
submitted
16-04-2024 18:27
General
-
Target
HEUR-Trojan-PSW.MSIL.Stealer.exe
-
Size
117KB
-
MD5
4c4f07c6d9f0b73193ddd3406201e900
-
SHA1
4786a21d01abbe48fbb0e3943aa43366200d8ef4
-
SHA256
302dd23d469643215e54a187e4127b50df5bbcdef4c5924193dc6815ba5c2e34
-
SHA512
dbc27b759dd275465027d0079d924ad203c2a09cf5e073c9134962a3c38ccd434798392c9218cec7ea532adccf70916fa69e866aa6425f3cd38f064cece645ae
-
SSDEEP
3072:daOqc4zX7NtM0NN7Uj2D9bW0YBDrUbpODw4:rF4zX7NlYjg9ba
Score
10/10
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-PSW.MSIL.Stealer.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-PSW.MSIL.Stealer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/964-0-0x00000167DEFD0000-0x00000167DEFF2000-memory.dmpFilesize
136KB
-
memory/964-1-0x00007FFADB4D0000-0x00007FFADBF92000-memory.dmpFilesize
10.8MB
-
memory/964-2-0x00000167F95A0000-0x00000167F95B0000-memory.dmpFilesize
64KB
-
memory/964-3-0x00007FFADB4D0000-0x00007FFADBF92000-memory.dmpFilesize
10.8MB