stormkitty | c98c7bdc88503df4eb5ef21506fc42d028f949807b959b3ff67f21964a2c0b85

Analysis

max time kernel
473s
max time network
471s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shellbag anylizer.exe
Size

303KB
MD5

88e30898471b07ab0ac563e4bdf99764
SHA1

8b07516da87dc75c9860954af5f6a3a0e7e95ac3
SHA256

c98c7bdc88503df4eb5ef21506fc42d028f949807b959b3ff67f21964a2c0b85
SHA512

b06fe916f11b09b5f98469282e99f783d380481a1bb0230be32d7853675b90f3b9110c8688532d168a80a53d4d380c4c711677b05578a10476d238db812ce591
SSDEEP

1536:T2JYEMehJ9E1QomvlGTqGXfFHfrXEvIzVAXuiRp6EE8bMlnEfwGzod8MddBK1Ohc:avhJ9E1l0cjbpxiBYe1oUJ2hsOFlD

Score

10^/10

stormkitty evasion persistence stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/3536-12-0x0000000002BA0000-0x0000000002BCA000-memory.dmp	family_stormkitty

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2844	attrib.exe
648	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	$77update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	shellbag anylizer.exe

Executes dropped EXE 1 IoCs

pid	Process
3536	$77update.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\update\\$77update.exe\""	shellbag anylizer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
68	4.tcp.eu.ngrok.io
113	pastebin.com
20	pastebin.com
21	pastebin.com
22	4.tcp.eu.ngrok.io
70	4.tcp.eu.ngrok.io
100	6.tcp.eu.ngrok.io
112	pastebin.com
114	6.tcp.eu.ngrok.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1564	timeout.exe
4460	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
396	shellbag anylizer.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe
3536	$77update.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	396	shellbag anylizer.exe
Token: SeDebugPrivilege	3536	$77update.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 2844	396	shellbag anylizer.exe	84
PID 396 wrote to memory of 2844	396	shellbag anylizer.exe	84
PID 396 wrote to memory of 648	396	shellbag anylizer.exe	86
PID 396 wrote to memory of 648	396	shellbag anylizer.exe	86
PID 396 wrote to memory of 3964	396	shellbag anylizer.exe	91
PID 396 wrote to memory of 3964	396	shellbag anylizer.exe	91
PID 3964 wrote to memory of 1564	3964	cmd.exe	93
PID 3964 wrote to memory of 1564	3964	cmd.exe	93
PID 3964 wrote to memory of 3536	3964	cmd.exe	94
PID 3964 wrote to memory of 3536	3964	cmd.exe	94
PID 3536 wrote to memory of 4704	3536	$77update.exe	95
PID 3536 wrote to memory of 4704	3536	$77update.exe	95
PID 3536 wrote to memory of 1596	3536	$77update.exe	97
PID 3536 wrote to memory of 1596	3536	$77update.exe	97
PID 3536 wrote to memory of 1776	3536	$77update.exe	99
PID 3536 wrote to memory of 1776	3536	$77update.exe	99
PID 3536 wrote to memory of 2016	3536	$77update.exe	106
PID 3536 wrote to memory of 2016	3536	$77update.exe	106
PID 3536 wrote to memory of 3680	3536	$77update.exe	108
PID 3536 wrote to memory of 3680	3536	$77update.exe	108
PID 3536 wrote to memory of 2132	3536	$77update.exe	110
PID 3536 wrote to memory of 2132	3536	$77update.exe	110
PID 3680 wrote to memory of 2064	3680	cmd.exe	112
PID 3680 wrote to memory of 2064	3680	cmd.exe	112
PID 2132 wrote to memory of 4460	2132	cmd.exe	113
PID 2132 wrote to memory of 4460	2132	cmd.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2844	attrib.exe
648	attrib.exe

C:\Users\Admin\AppData\Local\Temp\shellbag anylizer.exe
"C:\Users\Admin\AppData\Local\Temp\shellbag anylizer.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\update"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2844
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\update\$77update.exe"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4CD.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1564
- - C:\Users\Admin\update\$77update.exe
    "C:\Users\Admin\update\$77update.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN $77update.exe
      4⤵
      PID:4704
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /SC ONCE /TN "$77update.exe" /TR "C:\Users\Admin\update\$77update.exe \"\$77update.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1596
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN $77update.exe
      4⤵
      PID:1776
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN $77update.exe
      4⤵
      PID:2016
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "$77update_Task"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3680
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "$77update_Task"
        5⤵
        
        PID:2064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDEC5.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2132
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lVYIkPIIkF.jpg

Filesize
41KB

MD5
29a70f51fba901c7f93f1fb07557daf3

SHA1
6ce8bfce2cb74518675e4172bf2cb1e75975ddea

SHA256
e086beed575aa5b0be6c3ab5f07f804747415811fed9a8864782b18dfd23453e

SHA512
6a8642f0b972c8ba6b1671fea2d94bd4087d4beb7aa351b51f47b06619685fdff351788c8dbf47c5059cea1dc35a22c5df1c378e48b43ff101ecca1e4d78f256

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4CD.tmp.bat

Filesize
143B

MD5
f5aa329857f516c0048f78445355e8d1

SHA1
8620d5f7393272f537c765f8f6e9499c5642437c

SHA256
945fe868cb7df98e4bc8913de6a41ce1dcb69494effd5a58d059e79066dcaa1a

SHA512
6fdbe2d3120277384194f6106a4fe5ebaaa2772672476737e29f9a2cb13be220077f8026079cfc720b84aaf38dcf5ce7627b83ec906cc5344f6d0337cfafc364

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDEC5.tmp.bat

Filesize
219B

MD5
006ad7b07f1c9d5ac4f3c5c0360475c9

SHA1
0e52e941f6ab665156ad920d97fb6a623627cd49

SHA256
c1acb896c8efc29ede5a661bfd887bf61f8854fd19e29b3a9470375e335714c4

SHA512
93ae98e3ce18a3eb9a2de22f668a9797e2ea6e73a2691f0bded7311ab8cd6cb8426260972bb2bed11dcca0cd52cffd50c32ad4fb65816b9cc994fdcdfa8858e6

Download Submit
C:\Users\Admin\update\$77update.exe

Filesize
303KB

MD5
88e30898471b07ab0ac563e4bdf99764

SHA1
8b07516da87dc75c9860954af5f6a3a0e7e95ac3

SHA256
c98c7bdc88503df4eb5ef21506fc42d028f949807b959b3ff67f21964a2c0b85

SHA512
b06fe916f11b09b5f98469282e99f783d380481a1bb0230be32d7853675b90f3b9110c8688532d168a80a53d4d380c4c711677b05578a10476d238db812ce591

Download Submit
memory/396-1-0x00007FFB45033000-0x00007FFB45035000-memory.dmp

Filesize
8KB

Download
memory/396-2-0x00007FFB45030000-0x00007FFB45AF1000-memory.dmp

Filesize
10.8MB

Download
memory/396-8-0x00007FFB45030000-0x00007FFB45AF1000-memory.dmp

Filesize
10.8MB

Download
memory/396-0-0x0000000000BA0000-0x0000000000BF0000-memory.dmp

Filesize
320KB

Download
memory/3536-10-0x00007FFB45030000-0x00007FFB45AF1000-memory.dmp

Filesize
10.8MB

Download
memory/3536-13-0x0000000000E50000-0x0000000000E60000-memory.dmp

Filesize
64KB

Download
memory/3536-14-0x0000000001040000-0x0000000001056000-memory.dmp

Filesize
88KB

Download
memory/3536-19-0x000000001BE10000-0x000000001BE30000-memory.dmp

Filesize
128KB

Download
memory/3536-12-0x0000000002BA0000-0x0000000002BCA000-memory.dmp

Filesize
168KB

Download
memory/3536-24-0x00007FFB45030000-0x00007FFB45AF1000-memory.dmp

Filesize
10.8MB

Download
memory/3536-11-0x00007FFB45030000-0x00007FFB45AF1000-memory.dmp

Filesize
10.8MB

Download