thunderkittystealer | b27b31d0ace71e743e05e7fc14d66fe0884c5dc4f9312d91b9346c05fd0a9ee7

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ThunderKitty-Built.sfx.exe
Size

3.9MB
MD5

02b1176cf08691be00f90181f6627324
SHA1

630161e9332a8ab8e4d8e96091f0d1427faa44c6
SHA256

b27b31d0ace71e743e05e7fc14d66fe0884c5dc4f9312d91b9346c05fd0a9ee7
SHA512

4c4ee6c1c044b964d807676ed30608cbba5c4f92218ca12e4a03d16b8b67948728ce995e398cfc913cfc21063945af5c902b64f6f244763a7b08cd1e268bad7a
SSDEEP

98304:0qwCxfzSG0PsDj1WG3zx7aDo8DZOyo1TGO:0qwCpWGsKj1x3zxeh9IX

Score

10^/10

thunderkittystealer stealer

Malware Config

Extracted

Family

thunderkittystealer

https://api.telegram.org/bot7152695840:AAGDjisoA8pdr2R0G01XrqjqSwITZtC9buY/sendMessage?chat_id=6426393261

Signatures

ThunderKitty Stealer
ThunderKitty Stealer is an open-source stealer written in Golang.
stealer thunderkittystealer

Executes dropped EXE 1 IoCs

pid	Process
1344	ThunderKitty-Built.exe

Loads dropped DLL 2 IoCs

pid	Process
2088	ThunderKitty-Built.sfx.exe
2088	ThunderKitty-Built.sfx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1344	2088	ThunderKitty-Built.sfx.exe	31
PID 2088 wrote to memory of 1344	2088	ThunderKitty-Built.sfx.exe	31
PID 2088 wrote to memory of 1344	2088	ThunderKitty-Built.sfx.exe	31

C:\Users\Admin\AppData\Local\Temp\ThunderKitty-Built.sfx.exe
"C:\Users\Admin\AppData\Local\Temp\ThunderKitty-Built.sfx.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\ThunderKitty-Built.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ThunderKitty-Built.exe"
  2⤵
  - Executes dropped EXE
  PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\RarSFX0\ThunderKitty-Built.exe

Filesize
9.8MB

MD5
2adb55dd2dbb6f50de78f19d158a1302

SHA1
88d59831897c608da2317c70e412124dc93d12eb

SHA256
cb70b5efc101cc7446faa510535b759dd3d31d6a18ac343bf36827111373767b

SHA512
2b4a7c90bba4f87aa646ae7a2809862bbd901afe34cd97a90f49805a6ab7be02b1f6f6cdef25ed89bd1b8007a6782e2d259e37156c1fcf651fd544019d37425f

Download Submit