Analysis
- max time kernel
139s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
27/07/2024, 22:29
General
- Target StormKittyBuild.exe
- Size 367KB
- Sample240727-2efrea1hpm
- SHA256 f358c27c2be46076eaf3f199f1c8d726b1ff747971490cd04f931263cf199c6a
Score
10/10
Malware Config
Signatures
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe"C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4136-0-0x00007FFC7DB13000-0x00007FFC7DB15000-memory.dmp
memory/4136-1-0x00000000004F0000-0x0000000000550000-memory.dmp
memory/4136-2-0x000000001B140000-0x000000001B1C6000-memory.dmp
memory/4136-3-0x0000000000DF0000-0x0000000000DF6000-memory.dmp
memory/4136-4-0x00007FFC7DB10000-0x00007FFC7E5D1000-memory.dmp
memory/4136-5-0x00007FFC7DB13000-0x00007FFC7DB15000-memory.dmp
memory/4136-6-0x00007FFC7DB10000-0x00007FFC7E5D1000-memory.dmp