stormkitty | hxxps://github[.]com/slackinofff/BlitzedGrabberV12

Analysis

max time kernel
112s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 17:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/slackinofff/BlitzedGrabberV12

Score

10^/10

stormkitty credential_access discovery persistence privilege_escalation stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/4372-237-0x00000000004A0000-0x00000000005F0000-memory.dmp	family_stormkitty

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
83	discord.com
86	discord.com
102	discord.com
81	discord.com
92	discord.com
105	discord.com
87	discord.com
103	discord.com
90	discord.com
91	discord.com
93	discord.com
104	discord.com
80	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
66	checkip.dyndns.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5836	5712	WerFault.exe	131

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UltraEmbeddable.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 12 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1240	netsh.exe
5284	cmd.exe
4476	netsh.exe
5516	cmd.exe
5580	netsh.exe
6100	cmd.exe
5148	netsh.exe
4584	cmd.exe
5392	cmd.exe
5456	netsh.exe
4952	netsh.exe
464	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
4288	msedge.exe
4288	msedge.exe
4748	identity_helper.exe
4748	identity_helper.exe
2428	msedge.exe
2428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4372	BlitzedGrabberV12.exe
Token: SeDebugPrivilege	5896	BlitzedGrabberV12.exe
Token: SeDebugPrivilege	5392	BlitzedGrabberV12.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
5896	BlitzedGrabberV12.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 208	4288	msedge.exe	84
PID 4288 wrote to memory of 208	4288	msedge.exe	84
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 1624	4288	msedge.exe	85
PID 4288 wrote to memory of 388	4288	msedge.exe	86
PID 4288 wrote to memory of 388	4288	msedge.exe	86
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87
PID 4288 wrote to memory of 1960	4288	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/slackinofff/BlitzedGrabberV12
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaba0546f8,0x7ffaba054708,0x7ffaba054718
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,4067507495115657648,14911384936661536987,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,4067507495115657648,14911384936661536987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,4067507495115657648,14911384936661536987,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4067507495115657648,14911384936661536987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4067507495115657648,14911384936661536987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,4067507495115657648,14911384936661536987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,4067507495115657648,14911384936661536987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4067507495115657648,14911384936661536987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4067507495115657648,14911384936661536987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4067507495115657648,14911384936661536987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4067507495115657648,14911384936661536987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2032,4067507495115657648,14911384936661536987,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4067507495115657648,14911384936661536987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2032,4067507495115657648,14911384936661536987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2084

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3852

C:\Users\Admin\Desktop\BlitzedGrabberV12-main\BlitzedGrabberV12.exe
"C:\Users\Admin\Desktop\BlitzedGrabberV12-main\BlitzedGrabberV12.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4372
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:5392
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5440
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5456
- - C:\Windows\system32\findstr.exe
    findstr All
    3⤵
    PID:5464
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile name=65001 key=clear | findstr Key
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:5516
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5564
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name=65001 key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5580
- - C:\Windows\system32\findstr.exe
    findstr Key
    3⤵
    PID:5588

C:\Users\Admin\Desktop\BlitzedGrabberV12-main\resources\UltraEmbeddable.exe
"C:\Users\Admin\Desktop\BlitzedGrabberV12-main\resources\UltraEmbeddable.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 872
  2⤵
  - Program crash
  PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5712 -ip 5712
1⤵
PID:5812

C:\Users\Admin\Desktop\BlitzedGrabberV12-main\BlitzedGrabberV12.exe
"C:\Users\Admin\Desktop\BlitzedGrabberV12-main\BlitzedGrabberV12.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5896
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:6100
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5132
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5148
- - C:\Windows\system32\findstr.exe
    findstr All
    3⤵
    PID:4280
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile name=65001 key=clear | findstr Key
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4584
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3704
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name=65001 key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4952
- - C:\Windows\system32\findstr.exe
    findstr Key
    3⤵
    PID:4348

C:\Users\Admin\Desktop\BlitzedGrabberV12-main\BlitzedGrabberV12.exe
"C:\Users\Admin\Desktop\BlitzedGrabberV12-main\BlitzedGrabberV12.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5392
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:464
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1932
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1240
- - C:\Windows\system32\findstr.exe
    findstr All
    3⤵
    PID:2296
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile name=65001 key=clear | findstr Key
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:5284
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3488
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name=65001 key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4476
- - C:\Windows\system32\findstr.exe
    findstr Key
    3⤵
    PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BlitzedGrabberV12.exe.log

Filesize
2KB

MD5
aa5e10ba513d67a6cb6027291d4a10fa

SHA1
a1aad42b594ba7d9acf955285dfe178c57c4f3e2

SHA256
5fb3dee804190de9ddde4915e6201cb8542c88d3b06fd0b521adb2536a23988f

SHA512
247433e3247a0240e2769554d050783cc9343c61a1eaa9d4770c94592097654aa28d86a67f0cd70e0207e380841594d3196c73f37fa4d840ebc5c1f1a0a2bc33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
90340d37db7bed1f158b78f9e0aca544

SHA1
d999db0e70f887923574d3bd54b9bd91a78d892e

SHA256
a1b925fd465983efcf91476b5e69a02fdcdca5cf1562b85e3a9c80ba36c43c75

SHA512
7e8ed632c512e55e9790128598b921f110dd21bba088c2ff33fd9deac803978868bf5b8945afb1f7ca88bebd544c685a3274278a815374c44980998f8c9cceda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
0028a1a5c441a3cd5a60c34da771564f

SHA1
e15d27a8322b435564ebcd36467b997d0fa8ef32

SHA256
8dc36283781a25af9e2ae76d255ae311b2715396f710ff0e9850b0e64525759d

SHA512
e26efd2be3114e733acdc00fb54150790872b10c88a7c4d3a19a16383bf58897ad89f14b3255a984f836666b98bafc099d8988532d03acda0dee7a7a7da3f40e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6a75c45d58603d1e8c113a28d0d5d92d

SHA1
e5cb0ef8b2c62925d483b69d0a896cc6d4a168e2

SHA256
17a998dd0740261cf7765bc60684b9fb50e7d15338eb8b22b48c12371156062a

SHA512
1c3dcb7b7f92c49566f0c8305f54475c62a7e417f6eec9d5c5390f373db10cc2406077a223c8fbe86050312b955f834c2d9c923c5fcb245e3298dd5daa01c0ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fcd13a0a323cb33f8bbed957fc3eb347

SHA1
a011516df03be79de07fdc433f8e20deab310175

SHA256
d9097eb10ff9cc3ae8611e0e26b58461db510940a67424d82e597fd86040a009

SHA512
40872476722be34b20a2f7083cb188009fdedafcc1bcf1f1973e499735f33b59e28bf63a5002db2935e360e1906a46d5f0265ad5abbfdea7b8030fee4b94fa88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fc059add57d40d0e017c7c65971833ac

SHA1
719cdfa3dd924f0ab0383b3d76dd16255052e023

SHA256
c0a55687ac130bc2a97fd413094a471e858147eca36ab1e8afe8ea3af3b5fe21

SHA512
3821c2a45e62104abb888181c304d6aea6d662e73440408c3e64bbe8fa656a5bccaad3c7d317fdc9e1954f060b011461d2a6fadc783bf069cc9e82bd5fb2c7ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b0ccdaacab8c05b1a16aa0e21dd99b1e

SHA1
7d8529c06984e08345a107854d4b952356ac2dc7

SHA256
01f713ccd4befa0818dbabc477add773b0b52534b327eb468c58098d77a08af5

SHA512
12e544379ed517c4fa45ddab7fca1fea7854cc56614fa78c8cb149e2fbe7b7e62388e480f38187cff380510e9b3b47dd3e748945e0ba98016fe4655d26cd86b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d0ae.TMP

Filesize
1KB

MD5
5ef85066bc16338cf63873ac6856a4f3

SHA1
94c2f2ba463193f1cab7a9434b4c86807683ead6

SHA256
70ff23a06c5272bca71ee63ad84a283ba2e42d88fe62b566b58cfa67f7fa6f8d

SHA512
0157fe50a8c0e37e8da2b33c0c5b42fd4775010fbad8e59e3f194625b3814aeccfa6c5d02777c0158b93c22002bb967690a6378780bd50dd4c0c655ab9ce056e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8b25a950e274057972d40c0dd6458aca

SHA1
d428a8944174e4a3b25f0a27737c240705e044ea

SHA256
b2632693d4a4af9fd3f1a6938b87cc95c355e5f56e740d25cf2b856e95d98614

SHA512
d7db2798458db949d43ac18adf48deaccbb1a826663f94270498f1a9e06b0860488cfa45bcf0ae146ce3ba81d68bad61e74a42a9620174d711ad2daaa834aa2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e5adfe6e501184df73fe3bd493e44dfb

SHA1
72041ff0435bd6c055b330a548b21490228c50ca

SHA256
1d6d01b191097e6ce6bd5f7ec3b20067b2d0d48b31d97cb5af92df829af76ae9

SHA512
1c20b43075d515601f4f78b0824c89976647058d68aea8e2f710190c6eed6cdb42ef5da50bea5a88d94c60671bab8cc130a6e2a1c94dda532ab850c52efd41ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Capture.jpg

Filesize
71KB

MD5
aa023ba6c68163879481275d9b3f6555

SHA1
74649df5ddc4638bcbce5c0fd064c7e172ad060e

SHA256
f5bd0edb4a65a6ffc4f4ce1531eb247ceecff567783f855e52e2adea00ddf945

SHA512
575bf45206ab912f906608ad53428418f42cfc8b727a0b5b77f67e963ffa351f167badfb95059652fc5c5dac66488d8a9efea753cce190cec95d9ca744cf4301

Download Submit
C:\Users\Admin\AppData\Local\Temp\Capture.jpg

Filesize
74KB

MD5
8f35c6c375d22ed0879d2771bb2c8985

SHA1
3c14fbed8d8611733224571bfedf3992b98b460d

SHA256
4241645b1ecddf69f76b3f840ae68b5974f4c0ab5fc1ece4615f049ad2dab189

SHA512
e74fa0b286a20111143dd8f1df2a32b6a89d23c66ef0aa3be0215253943057d08ec5820109c3ced91911ae47f6df1115e6cdaf53f65f48a452ed6547d587ad93

Download Submit
C:\Users\Admin\AppData\Local\Temp\NordAccounts.txt

Filesize
8B

MD5
d5f3a22de66e2e5ae394d7fb2ff28f9d

SHA1
a17d58d1c2ed96f1605ad2525bc373c3fefce5a0

SHA256
bfdaf06c736251290c0ca8bf4c28808cbcb9959e381ed2bf24bccf473382bb20

SHA512
09d3b0fe75b28f782a19e8c83ce28bbe7892da32607035569447bea131990750a7ee8973d8e4a5296fb3b2f8db93bb8eae9ccffbb414a7925b9fc22603e56c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\passwords.txt

Filesize
1B

MD5
68b329da9893e34099c7d8ad5cb9c940

SHA1
adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

SHA256
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

SHA512
be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9F0A.tmp.dat

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA043.tmp.dat

Filesize
114KB

MD5
3cfabadfcb05a77b204fe1a6b09a5c90

SHA1
f106b5ed22265e64bc61dc5cf1e2d33ed12ec18d

SHA256
693617c470d7472e751d872341061cfb663f22ee95bdb42f9db01f02cb90df9c

SHA512
d5502023a17213919e2e991f5ba2d0d2c08223fd489d876a47a37239b637d03ace9cb9b92deb71460ae4030194ca49ce9e9752e0bf2ccbcd297dc5afe62a4e7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA044.tmp.dat

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 88280.crdownload

Filesize
2.6MB

MD5
1c3a59773a10eabba9d740e795ad50f1

SHA1
dcde9cb05a58366c7beff1f6f61b3a965ce22c59

SHA256
43ee56d9325525f211d0b7176e842d8feec0b6a64a7c0ac1bcbc5ed246f53251

SHA512
f962642df418c171694a2aa2f3974764ba224ec1056eb6144ce83c05ce4aebdfdc65dd29fcff09d02b6cc8f528bced95ee43fc269e5aac68fe266dcab7adce47

Download Submit
memory/4372-275-0x000000001C5C0000-0x000000001C5D2000-memory.dmp

Filesize
72KB

Download
memory/4372-237-0x00000000004A0000-0x00000000005F0000-memory.dmp

Filesize
1.3MB

Download
memory/4372-276-0x000000001C660000-0x000000001C69C000-memory.dmp

Filesize
240KB

Download
memory/4372-239-0x000000001B7A0000-0x000000001B7BA000-memory.dmp

Filesize
104KB

Download
memory/4372-238-0x0000000002810000-0x000000000281A000-memory.dmp

Filesize
40KB

Download
memory/5712-278-0x0000000000170000-0x00000000001EA000-memory.dmp

Filesize
488KB

Download