General

  • Target

    ProtectPass.exe

  • Size

    320KB

  • Sample

    240814-x3wejszckb

  • MD5

    d91ce8584e3ea4ab871df46a5691ad55

  • SHA1

    1a8d835fc8b40731181b71a230837d71fc183e2f

  • SHA256

    75bc18011ab2a39bdd97e241ee748399fa0fdf7fbd51a640abe5067cee34abcc

  • SHA512

    2db75e9d2833a7bd086548f59cf1abc264b7a499382e09e343fa101b953fb390f64ff605e6cdc19423009332bc7cce4a6871f99c6404e6c49e7ecc5c337974ab

  • SSDEEP

    6144:3m/Q1Q5Ng68j/svmHC40+XIzFUygWK0tWrcBOvN:3m/Q6P8j/svm1TXI5tZB

Malware Config

Targets

    • Target

      ProtectPass.exe

    • Size

      320KB

    • MD5

      d91ce8584e3ea4ab871df46a5691ad55

    • SHA1

      1a8d835fc8b40731181b71a230837d71fc183e2f

    • SHA256

      75bc18011ab2a39bdd97e241ee748399fa0fdf7fbd51a640abe5067cee34abcc

    • SHA512

      2db75e9d2833a7bd086548f59cf1abc264b7a499382e09e343fa101b953fb390f64ff605e6cdc19423009332bc7cce4a6871f99c6404e6c49e7ecc5c337974ab

    • SSDEEP

      6144:3m/Q1Q5Ng68j/svmHC40+XIzFUygWK0tWrcBOvN:3m/Q6P8j/svm1TXI5tZB

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks