stormkitty | b23b57a2f2668cdcae964bb464b1e8312f244c143123ab5d62bd1dba8ea078ac

Analysis

max time kernel
119s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1722924067fc8318f8c090d562f8adb507b77f61b0e263d41a3f8345496434e8ddc0ef93fc559.exe
Size

39KB
MD5

f0c26c9555c9414af344d284bcb7e0a2
SHA1

b4c1ac2c7ebf20eb0b00f0101adbbaf9523f4997
SHA256

b23b57a2f2668cdcae964bb464b1e8312f244c143123ab5d62bd1dba8ea078ac
SHA512

5eb9f7808914821319b6f835dbc37267b68fd904a523f0ab0ffe855622d425954ff8f21a589436b35d3eb0caaa4f24c8690abad1202470b9ed6d4e7680daa9c0
SSDEEP

768:XxGZOSN/3Qoub2qI7s4p1l4IHofeFv9WvO+hgq77:X8ZBu6d1lKmFv9WvO++G7

Score

10^/10

stormkitty xworm credential_access discovery rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

lisa22194141.duckdns.org:7000

Mutex

xyIsniB5c2bg0ZE4

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2168-1-0x00000000012D0000-0x00000000012E0000-memory.dmp	family_xworm

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2168-3-0x000000001D9C0000-0x000000001DADE000-memory.dmp	family_stormkitty

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

1722924067fc8318f8c090d562f8adb507b77f61b0e263d41a3f8345496434e8ddc0ef93fc559.exe

pid process

2168 1722924067fc8318f8c090d562f8adb507b77f61b0e263d41a3f8345496434e8ddc0ef93fc559.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1722924067fc8318f8c090d562f8adb507b77f61b0e263d41a3f8345496434e8ddc0ef93fc559.exe

pid process

2168 1722924067fc8318f8c090d562f8adb507b77f61b0e263d41a3f8345496434e8ddc0ef93fc559.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1722924067fc8318f8c090d562f8adb507b77f61b0e263d41a3f8345496434e8ddc0ef93fc559.exe

description pid process

Token: SeDebugPrivilege 2168 1722924067fc8318f8c090d562f8adb507b77f61b0e263d41a3f8345496434e8ddc0ef93fc559.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1722924067fc8318f8c090d562f8adb507b77f61b0e263d41a3f8345496434e8ddc0ef93fc559.exe

pid process

2168 1722924067fc8318f8c090d562f8adb507b77f61b0e263d41a3f8345496434e8ddc0ef93fc559.exe

pid	process
2168	1722924067fc8318f8c090d562f8adb507b77f61b0e263d41a3f8345496434e8ddc0ef93fc559.exe

pid	process
2168	1722924067fc8318f8c090d562f8adb507b77f61b0e263d41a3f8345496434e8ddc0ef93fc559.exe

description	pid	process
Token: SeDebugPrivilege	2168	1722924067fc8318f8c090d562f8adb507b77f61b0e263d41a3f8345496434e8ddc0ef93fc559.exe

pid	process
2168	1722924067fc8318f8c090d562f8adb507b77f61b0e263d41a3f8345496434e8ddc0ef93fc559.exe

C:\Users\Admin\AppData\Local\Temp\1722924067fc8318f8c090d562f8adb507b77f61b0e263d41a3f8345496434e8ddc0ef93fc559.exe
"C:\Users\Admin\AppData\Local\Temp\1722924067fc8318f8c090d562f8adb507b77f61b0e263d41a3f8345496434e8ddc0ef93fc559.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

Filesize
4KB

Download
memory/2168-1-0x00000000012D0000-0x00000000012E0000-memory.dmp

Filesize
64KB

Download
memory/2168-2-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/2168-3-0x000000001D9C0000-0x000000001DADE000-memory.dmp

Filesize
1.1MB

Download
memory/2168-27-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

Filesize
4KB

Download
memory/2168-28-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download