Analysis
- max time kernel
142s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
30/06/2024, 05:09
General
- Target 63c4e17fa9b6d87a9f4b68b854cae50e95f8de2a86929fecb8f34af0d15798e7.exe
- Size 808KB
- Sample240630-fs4vhatgka
- SHA256 63c4e17fa9b6d87a9f4b68b854cae50e95f8de2a86929fecb8f34af0d15798e7
Malware Config
Signatures
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Delays execution with timeout.exe 1 IoCs
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63c4e17fa9b6d87a9f4b68b854cae50e95f8de2a86929fecb8f34af0d15798e7.exe"C:\Users\Admin\AppData\Local\Temp\63c4e17fa9b6d87a9f4b68b854cae50e95f8de2a86929fecb8f34af0d15798e7.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\63c4e17fa9b6d87a9f4b68b854cae50e95f8de2a86929fecb8f34af0d15798e7.exe"C:\Users\Admin\AppData\Local\Temp\63c4e17fa9b6d87a9f4b68b854cae50e95f8de2a86929fecb8f34af0d15798e7.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp4CAF.tmp.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
-
C:\Windows\SysWOW64\taskkill.exeTaskKill /F /IM 36644⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\timeout.exeTimeout /T 2 /Nobreak4⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
AgileDotNetRT.dll
tmp4CAF.tmp.bat
memory/3540-0-0x0000000074ABE000-0x0000000074ABF000-memory.dmp
memory/3540-1-0x00000000001B0000-0x000000000027E000-memory.dmp
memory/3540-2-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/3540-3-0x0000000004B80000-0x0000000004BB8000-memory.dmp
memory/3540-73-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-71-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-55-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-39-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-31-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-11-0x0000000073540000-0x00000000735C9000-memory.dmp
memory/3540-69-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-67-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-66-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-63-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-61-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-59-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-57-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-53-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-51-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-50-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-47-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-45-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-43-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-41-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-37-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-35-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-33-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-29-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-27-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-25-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-23-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-21-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-19-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-17-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-15-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-13-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-12-0x0000000004B80000-0x0000000004BB2000-memory.dmp
memory/3540-194-0x0000000074ABE000-0x0000000074ABF000-memory.dmp
memory/3540-195-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/3540-196-0x0000000005C20000-0x00000000061C4000-memory.dmp
memory/3540-197-0x0000000005710000-0x00000000057A2000-memory.dmp
memory/3540-198-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/3540-199-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/3540-200-0x00000000056E0000-0x00000000056FC000-memory.dmp
memory/3540-260-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/3664-259-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/3664-258-0x0000000000400000-0x0000000000430000-memory.dmp
memory/3664-261-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/3664-262-0x00000000034A0000-0x0000000003506000-memory.dmp
memory/3664-263-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/3664-266-0x0000000074AB0000-0x0000000075260000-memory.dmp