Overview
overview
10Static
static
10BlitzedGra...12.exe
windows7-x64
10BlitzedGra...12.exe
windows10-2004-x64
10BlitzedGra...OR.dll
windows7-x64
1BlitzedGra...OR.dll
windows10-2004-x64
1BlitzedGra...to.dll
windows7-x64
1BlitzedGra...to.dll
windows10-2004-x64
1BlitzedGra...on.dll
windows7-x64
1BlitzedGra...on.dll
windows10-2004-x64
1BlitzedGra...le.exe
windows7-x64
3BlitzedGra...le.exe
windows10-2004-x64
3BlitzedGra...ww.exe
windows7-x64
10BlitzedGra...ww.exe
windows10-2004-x64
10BlitzedGra...y5.exe
windows7-x64
10BlitzedGra...y5.exe
windows10-2004-x64
10Analysis
-
max time kernel
449s -
max time network
454s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 13:20
Behavioral task
behavioral1
Sample
BlitzedGrabberV12/BlitzedGrabberV12.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
BlitzedGrabberV12/BlitzedGrabberV12.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
BlitzedGrabberV12/Resources/APIFOR.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
BlitzedGrabberV12/Resources/APIFOR.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
BlitzedGrabberV12/Resources/BouncyCastle.Crypto.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
BlitzedGrabberV12/Resources/BouncyCastle.Crypto.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
BlitzedGrabberV12/Resources/Newtonsoft.Json.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
BlitzedGrabberV12/Resources/Newtonsoft.Json.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
BlitzedGrabberV12/Resources/UltraEmbeddable.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
BlitzedGrabberV12/Resources/UltraEmbeddable.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
BlitzedGrabberV12/Resources/ww.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
BlitzedGrabberV12/Resources/ww.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
BlitzedGrabberV12/Resources/yhyty5.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
BlitzedGrabberV12/Resources/yhyty5.exe
Resource
win10v2004-20240419-en
General
-
Target
BlitzedGrabberV12/Resources/ww.exe
-
Size
59KB
-
MD5
21d2cd5e50a4fea2868725cbf2bd43dd
-
SHA1
2eede1b89427f9cf5b9c144f9ab2cac79439e029
-
SHA256
809236959232884def77d8da2aa283a8ad4c77824932cd06a4188a21a6581bc3
-
SHA512
1eacde6ef8c47fe8f6b1d6b8479453fbddd4531fb4dc3bec83eaaa261b5ae3ed963c6d862b4e92862aefa4bc069c5a190390df6edfdfded69e0778651c1bfca8
-
SSDEEP
768:bv8q4lFep7sfOCROyzDxEQK76Yt5Qb7jTIajt9K0fZOv11yL6N9gE5WHpGV:Dt4lffROyzECZ41yLg9gEgJS
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
Processes:
resource yara_rule behavioral12/memory/3004-1-0x0000000000A30000-0x0000000000A46000-memory.dmp family_stormkitty -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 23 discord.com 29 discord.com 33 discord.com 34 discord.com 22 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 16 checkip.dyndns.org -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ww.exedescription pid process Token: SeDebugPrivilege 3004 ww.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
ww.execmd.execmd.exedescription pid process target process PID 3004 wrote to memory of 1924 3004 ww.exe cmd.exe PID 3004 wrote to memory of 1924 3004 ww.exe cmd.exe PID 1924 wrote to memory of 1496 1924 cmd.exe chcp.com PID 1924 wrote to memory of 1496 1924 cmd.exe chcp.com PID 1924 wrote to memory of 3056 1924 cmd.exe netsh.exe PID 1924 wrote to memory of 3056 1924 cmd.exe netsh.exe PID 1924 wrote to memory of 920 1924 cmd.exe findstr.exe PID 1924 wrote to memory of 920 1924 cmd.exe findstr.exe PID 3004 wrote to memory of 1900 3004 ww.exe cmd.exe PID 3004 wrote to memory of 1900 3004 ww.exe cmd.exe PID 1900 wrote to memory of 1512 1900 cmd.exe chcp.com PID 1900 wrote to memory of 1512 1900 cmd.exe chcp.com PID 1900 wrote to memory of 4696 1900 cmd.exe netsh.exe PID 1900 wrote to memory of 4696 1900 cmd.exe netsh.exe PID 1900 wrote to memory of 832 1900 cmd.exe findstr.exe PID 1900 wrote to memory of 832 1900 cmd.exe findstr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12\Resources\ww.exe"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12\Resources\ww.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile3⤵
-
C:\Windows\system32\findstr.exefindstr All3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name=65001 key=clear | findstr Key2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile name=65001 key=clear3⤵
-
C:\Windows\system32\findstr.exefindstr Key3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\passwords.txtFilesize
1B
MD568b329da9893e34099c7d8ad5cb9c940
SHA1adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA25601ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
SHA512be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
-
memory/3004-1-0x0000000000A30000-0x0000000000A46000-memory.dmpFilesize
88KB
-
memory/3004-0-0x00007FFBB1833000-0x00007FFBB1835000-memory.dmpFilesize
8KB
-
memory/3004-2-0x0000000002B80000-0x0000000002B8A000-memory.dmpFilesize
40KB
-
memory/3004-3-0x0000000002BB0000-0x0000000002BCA000-memory.dmpFilesize
104KB
-
memory/3004-4-0x00007FFBB1830000-0x00007FFBB22F1000-memory.dmpFilesize
10.8MB
-
memory/3004-26-0x000000001D880000-0x000000001D892000-memory.dmpFilesize
72KB
-
memory/3004-27-0x000000001D8E0000-0x000000001D91C000-memory.dmpFilesize
240KB
-
memory/3004-29-0x00007FFBB1830000-0x00007FFBB22F1000-memory.dmpFilesize
10.8MB