Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2024 10:22
Behavioral task
behavioral1
Sample
Vynx-Hypixel-Skyblock-Minecraft-.jar-rat-builder-main/VynxRatBuilderV1/Vynx.exe
Resource
win7-20240705-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Vynx-Hypixel-Skyblock-Minecraft-.jar-rat-builder-main/VynxRatBuilderV1/Vynx.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
Vynx-Hypixel-Skyblock-Minecraft-.jar-rat-builder-main/VynxRatBuilderV1/Vynx.exe
-
Size
1.5MB
-
MD5
4586542b09bc8e8f7165ad1a1c8ca340
-
SHA1
c05a77a93d124b81c98b0af5a8b3a22c345cb113
-
SHA256
b5305d8ffa960b6b7988cc51c35e4af3aa87cd0a03eb68c49eb862142506ca5a
-
SHA512
62454140b73edec586113620265ef76da6e220c24632c2ec7d53abd41180170ab811f796321578f2260d3b0906c2da3bde63d9580b0a88c6eb1c6bdc6dbf5c13
-
SSDEEP
24576:47zNXaV9x4IUgs36BUI2So5+jnzFoCaGApu8p:4f0T+Sk6BU7HIFo7G98
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/2832-0-0x0000000000D40000-0x0000000000EC4000-memory.dmp family_stormkitty -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 26 discord.com 4 discord.com 5 discord.com 14 discord.com 25 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 checkip.dyndns.org -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2904 cmd.exe 2472 netsh.exe 2432 cmd.exe 4656 netsh.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4720 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2832 Vynx.exe Token: SeDebugPrivilege 4720 taskmgr.exe Token: SeSystemProfilePrivilege 4720 taskmgr.exe Token: SeCreateGlobalPrivilege 4720 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2832 wrote to memory of 2904 2832 Vynx.exe 87 PID 2832 wrote to memory of 2904 2832 Vynx.exe 87 PID 2904 wrote to memory of 4400 2904 cmd.exe 89 PID 2904 wrote to memory of 4400 2904 cmd.exe 89 PID 2904 wrote to memory of 2472 2904 cmd.exe 90 PID 2904 wrote to memory of 2472 2904 cmd.exe 90 PID 2904 wrote to memory of 3004 2904 cmd.exe 91 PID 2904 wrote to memory of 3004 2904 cmd.exe 91 PID 2832 wrote to memory of 2432 2832 Vynx.exe 92 PID 2832 wrote to memory of 2432 2832 Vynx.exe 92 PID 2432 wrote to memory of 4724 2432 cmd.exe 94 PID 2432 wrote to memory of 4724 2432 cmd.exe 94 PID 2432 wrote to memory of 4656 2432 cmd.exe 95 PID 2432 wrote to memory of 4656 2432 cmd.exe 95 PID 2432 wrote to memory of 2892 2432 cmd.exe 96 PID 2432 wrote to memory of 2892 2432 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vynx-Hypixel-Skyblock-Minecraft-.jar-rat-builder-main\VynxRatBuilderV1\Vynx.exe"C:\Users\Admin\AppData\Local\Temp\Vynx-Hypixel-Skyblock-Minecraft-.jar-rat-builder-main\VynxRatBuilderV1\Vynx.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:4400
-
-
C:\Windows\system32\netsh.exenetsh wlan show profile3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2472
-
-
C:\Windows\system32\findstr.exefindstr All3⤵PID:3004
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name=65001 key=clear | findstr Key2⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:4724
-
-
C:\Windows\system32\netsh.exenetsh wlan show profile name=65001 key=clear3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4656
-
-
C:\Windows\system32\findstr.exefindstr Key3⤵PID:2892
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4720
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD568b329da9893e34099c7d8ad5cb9c940
SHA1adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA25601ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
SHA512be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09