stormkitty | 6ef09a9d766a9ca209da5fc075de5c3e7152c3f49e88bb2db61e061f0bd2184d

General

Target

cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
Size

3.4MB
MD5

cdcc0ad2446684e736fa5813caee0a57
SHA1

21aad2f791e2c12deed221484ff00ed8a0edb799
SHA256

6ef09a9d766a9ca209da5fc075de5c3e7152c3f49e88bb2db61e061f0bd2184d
SHA512

6d17654a61116fab4b0b1128699dbbf2751d63e78615f822452a9a1ebe62889df401ed1ba795a04535446c86d4b122036f346e8744e6ac15d6e9c8a1240ec6c2
SSDEEP

98304:lnbDOSv7J7SvNZZToTcMBailCO3QBKGFqL9z/2MSbB:xOKF7SJToAMU8uBK2qL9ZSF

Score

10^/10

stormkitty discovery evasion stealer themida trojan

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2448-30-0x0000000001160000-0x00000000019F6000-memory.dmp	family_stormkitty
behavioral1/memory/2448-31-0x0000000001160000-0x00000000019F6000-memory.dmp	family_stormkitty
behavioral1/memory/2448-42-0x0000000001160000-0x00000000019F6000-memory.dmp	family_stormkitty

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2608 cmd.exe

pid	process
2608	cmd.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2448-30-0x0000000001160000-0x00000000019F6000-memory.dmp	themida
behavioral1/memory/2448-31-0x0000000001160000-0x00000000019F6000-memory.dmp	themida
behavioral1/memory/2448-42-0x0000000001160000-0x00000000019F6000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

Processes:

cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe

pid	process
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.execmd.exetimeout.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2004 timeout.exe

pid	process
2004	timeout.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe

pid	process
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2448 cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 2448 wrote to memory of 2608	2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe	cmd.exe
PID 2448 wrote to memory of 2608	2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe	cmd.exe
PID 2448 wrote to memory of 2608	2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe	cmd.exe
PID 2448 wrote to memory of 2608	2448	cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe	cmd.exe
PID 2608 wrote to memory of 2004	2608	cmd.exe	timeout.exe
PID 2608 wrote to memory of 2004	2608	cmd.exe	timeout.exe
PID 2608 wrote to memory of 2004	2608	cmd.exe	timeout.exe
PID 2608 wrote to memory of 2004	2608	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cdcc0ad2446684e736fa5813caee0a57_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp868E.tmp.cmd""
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\timeout.exe
    timeout 4
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp868E.tmp.cmd

Filesize
228B

MD5
c40a90a01cf637a85e218ba328315658

SHA1
e4d301899defe6ed8adee4d24f606d6ccacceb54

SHA256
f42c218c3ac43942c5354fdd4f554a7596fd8bf1b5a792f3e0fe3efef80e2b39

SHA512
0cf3d760a1121a0e74dc5e5007df993c1b20c31c0cfcf0dc26578e0aabf8912db3f37a572dd1f5d4965ee802ee3459d50f1683fbd8ea98ee3b17d2cd92976981

Download Submit
memory/2448-15-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-1-0x0000000076E04000-0x0000000076E05000-memory.dmp

Filesize
4KB

Download
memory/2448-2-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-9-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-26-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-25-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-14-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-23-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-22-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-21-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-20-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-19-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-18-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-17-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-43-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-8-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-24-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-13-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-12-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-11-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-10-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-7-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-6-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-5-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-4-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-3-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download
memory/2448-30-0x0000000001160000-0x00000000019F6000-memory.dmp

Filesize
8.6MB

Download
memory/2448-31-0x0000000001160000-0x00000000019F6000-memory.dmp

Filesize
8.6MB

Download
memory/2448-32-0x0000000005A20000-0x0000000005A96000-memory.dmp

Filesize
472KB

Download
memory/2448-0-0x0000000001160000-0x00000000019F6000-memory.dmp

Filesize
8.6MB

Download
memory/2448-42-0x0000000001160000-0x00000000019F6000-memory.dmp

Filesize
8.6MB

Download
memory/2448-16-0x0000000076DF0000-0x0000000076F00000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads