Analysis
-
max time kernel
138s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-08-2024 15:43
Behavioral task
behavioral1
Sample
4556-6-0x0000000005AE0000-0x0000000005AEE000-memory.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4556-6-0x0000000005AE0000-0x0000000005AEE000-memory.exe
Resource
win10v2004-20240802-en
General
-
Target
4556-6-0x0000000005AE0000-0x0000000005AEE000-memory.exe
-
Size
56KB
-
MD5
4ddbbe456e30688cee432026609b8827
-
SHA1
a16545ba3e14bcfee49c3099424e79c62ab7de90
-
SHA256
48a965d12180f711f3faac37459576d9dd353c74a9b173debf2c24a760fd6937
-
SHA512
e35155e1a4bb274152b805d967087af6461c866a121baa6638ef0faca53c8a197490e6530cc502247f087f53f192bb72b94db5371d4b1a6e22bbd6d325522e71
-
SSDEEP
384:1EbmX5Qa+vN1h1+X3v6JFjL+g93Tm2eaFOkOdRApkFTBLTsOZwpGd2v99Ikuislj:mVa+vNtg+PB93Tw4dOdVFE9j4OjhGbP
Malware Config
Extracted
xworm
5.0
192.3.101.172:7000
NaDGFqrxW3KfaOw9
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3220-1-0x0000000000550000-0x000000000055E000-memory.dmp family_xworm -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3220-5-0x000000001C030000-0x000000001C150000-memory.dmp family_stormkitty -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4556-6-0x0000000005AE0000-0x0000000005AEE000-memory.exedescription pid process Token: SeDebugPrivilege 3220 4556-6-0x0000000005AE0000-0x0000000005AEE000-memory.exe