General

  • Target

    wert.exe

  • Size

    83KB

  • Sample

    240503-njzs7adc91

  • MD5

    299057a5ffbb5e70f8514df5f9796b9e

  • SHA1

    c9eb1364dd1220c074af581343b636995eea4288

  • SHA256

    5ac2fcc4daab08132ad947ffedcf88286f2af526a260111f3ae00de9ba0a6283

  • SHA512

    7b898cce4b6b252fa8b7bb5be36fcf98c191e59de655fcb2733f5263adc53ad06c0fb094d7df29d6cb872825c2e0d92ca1b2509519ce9ab317804bf949ece4c2

  • SSDEEP

    1536:yAMfrTX01OrGpRZNdbv66Claewnph6Nu3qdMhXWxZiXQv6Qd+FUf9bfNhExjDkOc:ZDewnphbwxfrff9bHEhDkOed

Malware Config

Targets

    • Target

      wert.exe

    • Size

      83KB

    • MD5

      299057a5ffbb5e70f8514df5f9796b9e

    • SHA1

      c9eb1364dd1220c074af581343b636995eea4288

    • SHA256

      5ac2fcc4daab08132ad947ffedcf88286f2af526a260111f3ae00de9ba0a6283

    • SHA512

      7b898cce4b6b252fa8b7bb5be36fcf98c191e59de655fcb2733f5263adc53ad06c0fb094d7df29d6cb872825c2e0d92ca1b2509519ce9ab317804bf949ece4c2

    • SSDEEP

      1536:yAMfrTX01OrGpRZNdbv66Claewnph6Nu3qdMhXWxZiXQv6Qd+FUf9bfNhExjDkOc:ZDewnphbwxfrff9bHEhDkOed

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks