Analysis

  • max time kernel
    581s
  • max time network
    866s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28-04-2024 03:29

General

  • Target

    SilverClient.exe

  • Size

    41KB

  • MD5

    fabd8535478bee89be312833f6089099

  • SHA1

    e14e26e8f6d05929e9a24a3b523d0a8ec2535f11

  • SHA256

    47ba6b08c23ebfa7813dcd10cebe93876e7c972718151a018b11ff51085c4382

  • SHA512

    6b12403e742230504a543c7135b4a20af31be1c21649904463bd0cee00fd9e0e08953f0b854089619cc0abba96cd8f1831e4799f7dc81ab600529e3f3a00c04b

  • SSDEEP

    768:bXbSqna7XKuvHWVcxMX0RhiCpme8d3XHQPRsrZ9PDexz1QB6SED0vrmljlE:bXbSqduvH+cPRhBMe8d3XCCZ9+1Qo/D4

Malware Config

Signatures

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SilverClient.exe
    "C:\Users\Admin\AppData\Local\Temp\SilverClient.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\UserProfile"
      2⤵
      • Sets file to hidden
      • Views/modifies file attributes
      PID:200
    • C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\UserProfile\$77svchost.exe"
      2⤵
      • Sets file to hidden
      • Views/modifies file attributes
      PID:236
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB594.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:2148
      • C:\Users\Admin\UserProfile\$77svchost.exe
        "C:\Users\Admin\UserProfile\$77svchost.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • Sets desktop wallpaper using registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5060
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks.exe" /query /TN $77svchost.exe
          4⤵
            PID:2700
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks.exe" /Create /SC ONCE /TN "$77svchost.exe" /TR "C:\Users\Admin\UserProfile\$77svchost.exe \"\$77svchost.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
            4⤵
            • Creates scheduled task(s)
            PID:3896
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks.exe" /query /TN $77svchost.exe
            4⤵
              PID:4248
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5044
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "svchost_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00
              4⤵
              • Creates scheduled task(s)
              PID:5004
            • C:\Windows\system32\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YOUR FILES HAS BEEN ENCRYPTED!!!.txt
              4⤵
                PID:1248
              • C:\Windows\SYSTEM32\Cmd.exe
                "Cmd"
                4⤵
                  PID:4976
                • C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
                  "PowerShell"
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:856
          • C:\Program Files\VideoLAN\VLC\vlc.exe
            "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\TestComplete.m4v"
            1⤵
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:3000

          Network

          MITRE ATT&CK Matrix ATT&CK v13

          Execution

          Scheduled Task/Job

          1
          T1053

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Defense Evasion

          Hide Artifacts

          2
          T1564

          Hidden Files and Directories

          2
          T1564.001

          Modify Registry

          2
          T1112

          Discovery

          System Information Discovery

          1
          T1082

          Query Registry

          1
          T1012

          Command and Control

          Web Service

          1
          T1102

          Impact

          Defacement

          1
          T1491

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PowerShell.exe.log
            Filesize

            3KB

            MD5

            8592ba100a78835a6b94d5949e13dfc1

            SHA1

            63e901200ab9a57c7dd4c078d7f75dcd3b357020

            SHA256

            fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

            SHA512

            87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cykgxcwd.q3t.ps1
            Filesize

            1B

            MD5

            c4ca4238a0b923820dcc509a6f75849b

            SHA1

            356a192b7913b04c54574d18c28d46e6395428ab

            SHA256

            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

            SHA512

            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

          • C:\Users\Admin\AppData\Local\Temp\tmpB594.tmp.bat
            Filesize

            150B

            MD5

            8d88e82f52cf8f1f1d616e864fb6924d

            SHA1

            050ee5fc9b565db20fadb71608f7c3b82ad32bde

            SHA256

            cb726a8755e86adaf7b495a227ac7199a779c243cd4a3a6e859788b3820aa68c

            SHA512

            20c84ec49681fd2f839e83c3c80bfce1c78eb8b6bb0844c558739dbb13a1cbc9bb02120a9a2e2b685d680dca75f9e1018e9d5be74fd279f7c85441c9b8aa5fe0

          • C:\Users\Admin\UserProfile\$77svchost.exe
            Filesize

            41KB

            MD5

            fabd8535478bee89be312833f6089099

            SHA1

            e14e26e8f6d05929e9a24a3b523d0a8ec2535f11

            SHA256

            47ba6b08c23ebfa7813dcd10cebe93876e7c972718151a018b11ff51085c4382

            SHA512

            6b12403e742230504a543c7135b4a20af31be1c21649904463bd0cee00fd9e0e08953f0b854089619cc0abba96cd8f1831e4799f7dc81ab600529e3f3a00c04b

          • memory/856-128-0x00000243ED4B0000-0x00000243ED4EC000-memory.dmp
            Filesize

            240KB

          • memory/3000-91-0x000001D74D970000-0x000001D74EA20000-memory.dmp
            Filesize

            16.7MB

          • memory/3000-90-0x00007FFF004A0000-0x00007FFF00756000-memory.dmp
            Filesize

            2.7MB

          • memory/3000-89-0x00007FFF19D10000-0x00007FFF19D44000-memory.dmp
            Filesize

            208KB

          • memory/3000-88-0x00007FF7F9650000-0x00007FF7F9748000-memory.dmp
            Filesize

            992KB

          • memory/3188-9-0x00007FFF04D80000-0x00007FFF0576C000-memory.dmp
            Filesize

            9.9MB

          • memory/3188-0-0x0000000000F20000-0x0000000000F2E000-memory.dmp
            Filesize

            56KB

          • memory/3188-4-0x00007FFF04D80000-0x00007FFF0576C000-memory.dmp
            Filesize

            9.9MB

          • memory/3188-2-0x000000001CA50000-0x000000001CA60000-memory.dmp
            Filesize

            64KB

          • memory/3188-1-0x00007FFF04D80000-0x00007FFF0576C000-memory.dmp
            Filesize

            9.9MB

          • memory/5044-20-0x000001B5BC0A0000-0x000001B5BC116000-memory.dmp
            Filesize

            472KB

          • memory/5044-17-0x000001B5BBD70000-0x000001B5BBD92000-memory.dmp
            Filesize

            136KB

          • memory/5060-68-0x00000000036E0000-0x0000000003700000-memory.dmp
            Filesize

            128KB

          • memory/5060-69-0x00000000016A0000-0x0000000001826000-memory.dmp
            Filesize

            1.5MB

          • memory/5060-70-0x0000000001870000-0x000000000189A000-memory.dmp
            Filesize

            168KB

          • memory/5060-71-0x00000000018A0000-0x00000000018AE000-memory.dmp
            Filesize

            56KB

          • memory/5060-92-0x00000000018C0000-0x00000000018D0000-memory.dmp
            Filesize

            64KB

          • memory/5060-93-0x0000000000010000-0x0000000000066000-memory.dmp
            Filesize

            344KB