stormkitty | 75bc18011ab2a39bdd97e241ee748399fa0fdf7fbd51a640abe5067cee34abcc

Analysis

max time kernel
40s
max time network
42s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
14-08-2024 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ProtectPass.exe
Size

320KB
MD5

d91ce8584e3ea4ab871df46a5691ad55
SHA1

1a8d835fc8b40731181b71a230837d71fc183e2f
SHA256

75bc18011ab2a39bdd97e241ee748399fa0fdf7fbd51a640abe5067cee34abcc
SHA512

2db75e9d2833a7bd086548f59cf1abc264b7a499382e09e343fa101b953fb390f64ff605e6cdc19423009332bc7cce4a6871f99c6404e6c49e7ecc5c337974ab
SSDEEP

6144:3m/Q1Q5Ng68j/svmHC40+XIzFUygWK0tWrcBOvN:3m/Q6P8j/svm1TXI5tZB

Score

10^/10

stormkitty collection credential_access discovery spyware stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2960-1-0x00000000002D0000-0x0000000000326000-memory.dmp	family_stormkitty

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

ProtectPass.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ProtectPass.exe
Key opened	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ProtectPass.exe
Key opened	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ProtectPass.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

Processes:

ProtectPass.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\NPCDUADC\FileGrabber\Desktop\desktop.ini	ProtectPass.exe
File created	C:\Users\Admin\AppData\Local\NPCDUADC\FileGrabber\Pictures\desktop.ini	ProtectPass.exe

Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 api.ipify.org
2 freegeoip.app
2 ip-api.com
4 freegeoip.app
6 api.ipify.org
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

ProtectPass.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ProtectPass.exe

flow	ioc
20	api.ipify.org
2	freegeoip.app
2	ip-api.com
4	freegeoip.app
6	api.ipify.org

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProtectPass.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ProtectPass.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	ProtectPass.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ProtectPass.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

ProtectPass.exe

pid	process
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe
2960	ProtectPass.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ProtectPass.exe

description pid process

Token: SeDebugPrivilege 2960 ProtectPass.exe

description	pid	process
Token: SeDebugPrivilege	2960	ProtectPass.exe

outlook_office_path 1 IoCs

Processes:

ProtectPass.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ProtectPass.exe

outlook_win_path 1 IoCs

Processes:

ProtectPass.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ProtectPass.exe

C:\Users\Admin\AppData\Local\Temp\ProtectPass.exe
"C:\Users\Admin\AppData\Local\Temp\ProtectPass.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\NPCDUADC\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\NPCDUADC\FileGrabber\Desktop\JoinPush.jpeg

Filesize
316KB

MD5
b2ba33342da479a4beb29b07b046f335

SHA1
f54d5a0bf0fa0a24cc697ec303906558070fb390

SHA256
81e35f1b5d66d97f4c03681598ab54c3d7615636feec61d280e08fc77a64d501

SHA512
5875b234145ac72e743d554336070e515ca5cda2bfa7c382eabeb776c2aac16bea8631005d3f2651b834301b9e3b6e2e00baf4c5671bcf32a3e6c6ac7c9b0af0

Download Submit
C:\Users\Admin\AppData\Local\NPCDUADC\FileGrabber\Documents\ConvertResume.docx

Filesize
672KB

MD5
b1db2182baf53630ada9ab61240de025

SHA1
5e3c8c425927c457a8b37e184544f808e6bbcae2

SHA256
5a841083e4752d899584d9c0bd762d72c7abbfc1a78a54c08340daea432ae20c

SHA512
aa71facbfd8dc312e52b06d846123923ae77983cefc5640b3ae5b9d36f733da59e6f6b76b34ae1e36957382c9db1f848ca676bb05e1e2c7e2f630e3fa1bacb87

Download Submit
C:\Users\Admin\AppData\Local\NPCDUADC\FileGrabber\Documents\DebugLock.ppt

Filesize
728KB

MD5
842a7b61ba1e294e580e91b78242f334

SHA1
2630755cbc5be7fc9afd0c49512ee28c530af46d

SHA256
39d4db9bebe50fe4385098b73c678304977b2328d99de710945605fd5465db76

SHA512
ecaa1255c953390b291a0e2e667fef30a9bea4858c850dc263499325c4c53cb81d912bcbfd27b90a4c1bc25e9dfa8b4e239ed22b33bb00b6accb27bfaa69e92d

Download Submit
C:\Users\Admin\AppData\Local\NPCDUADC\FileGrabber\Downloads\AddCopy.jpeg

Filesize
554KB

MD5
ba5fc3ae229b3fbb9dcfb48fa288d953

SHA1
ee405bb7460806615e9c0f74d9bf9ca067d43d2b

SHA256
1db097456ddd266c70035cf429f962361014cd27e53fc4597a0f4647eaf31775

SHA512
53e52afd6b012c823defb74789b5078c7776cf0fcf9e6b557a1128182633c7bbd8ad69167b8b58d0d83f078dcfbd370397dc2682767e2c50d75b07f5ff8d0cbd

Download Submit
C:\Users\Admin\AppData\Local\NPCDUADC\FileGrabber\Downloads\ConvertToSubmit.css

Filesize
1.0MB

MD5
a740f445183c1eb9a96570ea4c6f3b61

SHA1
4983c8f2baf81e43e0012e27526ebac50c62bdd4

SHA256
b24fd75dd171cb0ac7deff828288b08ae99867516131ffb95435316de0730ce4

SHA512
b27ea65aa5d82d157c47b7699ad1ca278d8bb809ad85a63b47c66a40979cb21190c49115ddd3090216dd70085354032e4202f966c3d9a8a3ad9536843a9cf836

Download Submit
C:\Users\Admin\AppData\Local\NPCDUADC\FileGrabber\Pictures\ImportRequest.svg

Filesize
382KB

MD5
b2570ce85fa542b07a0c599a5332e094

SHA1
c41a3046b70d35ef40bb7c4fc49486ca480f1253

SHA256
e745149c6bf9137ab07ae91e40d549755f307db212d9c378e7be5c617aa054c7

SHA512
e5189eca2a3e04d208f9f7743fa4d7cc98872e549cac6890c79de745309ed37af7c21434be8bc0c6151cb4022097a9339156b75276b3cd65fd06ce31fd6d9c92

Download Submit
C:\Users\Admin\AppData\Local\NPCDUADC\FileGrabber\Pictures\InvokePing.jpeg

Filesize
148KB

MD5
f521b860284736f67bbe93daa418cbc7

SHA1
f0242f541dcea0c938139a3149255e99a4e38b21

SHA256
0e0332da2186f027363b6b5880c4896269ca59fc1d0724cc630a45ec6e0d0246

SHA512
549283621769eb7c8d793ba15c5e343e0205407fd26c8901505e89bc90418059532cc979c4d92f9fc90b80ff8e26d2252d48208093c7b5ba37eea5e35e26bade

Download Submit
C:\Users\Admin\AppData\Local\NPCDUADC\FileGrabber\Pictures\OutUnprotect.jpg

Filesize
187KB

MD5
f81f014ee668b6f6725c400a52460a09

SHA1
f9d48c060da51ab262a597ed44483c21c73570df

SHA256
b5dcb4b68bffdd76b93495869a169087cc61f347a5d2d378b34afae537d23af7

SHA512
07fe653ec1d8477caa2fb5756d50bf70ea67519338ca3f8e5ef93d5ce884b0343c22c5c1b63ba6326250de50f51a5b09418c6544b20b1f63522ab3ca40f5176a

Download Submit
C:\Users\Admin\AppData\Local\NPCDUADC\FileGrabber\Pictures\PingJoin.jpg

Filesize
265KB

MD5
97a1f0e3085693b44c26961d51e9e21f

SHA1
90cab9133bc51789f1e250ee08efb5013b7708c7

SHA256
e5e6d0dda6bedab0791d6400c44001da9b6aaf1e202c33606bf99b2cef5253a8

SHA512
bcb09682e2a00b8dcd8f4ebcd83b5bcd6da9fe0785dc038771f1c48433e6d53230d00ecc85315034d3ef6d491e4ef4467e919fcc8be15d06ac3ef0b39d17f9fc

Download Submit
C:\Users\Admin\AppData\Local\NPCDUADC\FileGrabber\Pictures\PublishSwitch.svg

Filesize
327KB

MD5
0b0e3bd28b272b15a7678b69e5109634

SHA1
8fddf8b791ba7397c2033be8a8469f9709f2f11b

SHA256
04c0933cd67185f0a6cc66aca1ffe8beadb66e9b19843de67787294b74b6aa2b

SHA512
e3e621a9de567cb7902f72e1302cb1c840a5ef84be77f4121626040a7106aec82a96090a0f1c76eda13c01b3a25bf1ea385a3840b06b7e9e9f9e99b2cb52e4c5

Download Submit
C:\Users\Admin\AppData\Local\NPCDUADC\Process.txt

Filesize
4KB

MD5
ce714ed04de89371bbc8f1d68bc94682

SHA1
1cf1613ea6299098de09113c67d3901d250b255c

SHA256
560f7ee3ed2fc2ceace395de8be09af90c732cf3831e9f59166ae3d2f0fb07bb

SHA512
aae5b90861a48b00ef268279012ebd962775449dd1de9e14dd26b32afbfc26c93f3039d64f57d1a4547111fb2b7d2953778c7c3905e07edc7cf3b951b36f2d19

Download Submit
memory/2960-34-0x0000000006520000-0x0000000006586000-memory.dmp

Filesize
408KB

Download
memory/2960-32-0x0000000006750000-0x0000000006CF6000-memory.dmp

Filesize
5.6MB

Download
memory/2960-29-0x0000000006100000-0x0000000006192000-memory.dmp

Filesize
584KB

Download
memory/2960-2-0x0000000074680000-0x0000000074E31000-memory.dmp

Filesize
7.7MB

Download
memory/2960-1-0x00000000002D0000-0x0000000000326000-memory.dmp

Filesize
344KB

Download
memory/2960-0-0x000000007468E000-0x000000007468F000-memory.dmp

Filesize
4KB

Download
memory/2960-233-0x000000007468E000-0x000000007468F000-memory.dmp

Filesize
4KB

Download
memory/2960-234-0x0000000074680000-0x0000000074E31000-memory.dmp

Filesize
7.7MB

Download
memory/2960-260-0x0000000074680000-0x0000000074E31000-memory.dmp

Filesize
7.7MB

Download