stormkitty | e3d91cacfa390bbc7a27ba4a25005569eda0033ac5a3c7b83328be80dbde747b

General

Target

Raccoon Stealer [@INJUANKANAL].exe
Size

566KB
MD5

112d2c4d2578955d04e3eb771dd938e2
SHA1

d4f7a591ca4b073d96256860637fcc808a369ba8
SHA256

e3d91cacfa390bbc7a27ba4a25005569eda0033ac5a3c7b83328be80dbde747b
SHA512

72aaffcd1f3ca17be585259c9bf355615d24730773e720dbcf73810c92c8916a23a626d053ba1ebdf81efc4b5e6c283699990d5de6b1752b2df59f72ed8eb122
SSDEEP

12288:zwPBfv9vnnK4XFzOpElcxsIDjlk9SUEtssDDND1:MD/K4X0pej8j+9OSU

Score

10^/10

stormkitty discovery persistence stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4792-4-0x000000001D430000-0x000000001D4B0000-memory.dmp	family_stormkitty
C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe	family_stormkitty
C:\Users\Admin\AppData\Local\Temp\Builder.exe	family_stormkitty
behavioral2/memory/2016-48-0x00000000002D0000-0x000000000031E000-memory.dmp	family_stormkitty
behavioral2/memory/2016-50-0x00000000028E0000-0x0000000002954000-memory.dmp	family_stormkitty
behavioral2/memory/544-58-0x0000000000530000-0x000000000053E000-memory.dmp	family_stormkitty

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Raccoon Stealer [@INJUANKANAL].exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	Raccoon Stealer [@INJUANKANAL].exe

Executes dropped EXE 4 IoCs

Processes:

StormKittyBuild.exeWindowsDataC.exeBuilder.exeRunIt.exe

pid process

2016 StormKittyBuild.exe
4380 WindowsDataC.exe
544 Builder.exe
2952 RunIt.exe

pid	process
2016	StormKittyBuild.exe
4380	WindowsDataC.exe
544	Builder.exe
2952	RunIt.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Raccoon Stealer [@INJUANKANAL].exeRunIt.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDataC.exe = "C:\\ProgramData\\WindowsDataC.exe"	Raccoon Stealer [@INJUANKANAL].exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rnts.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Rnts.exe"	RunIt.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

21 raw.githubusercontent.com
23 raw.githubusercontent.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
21	raw.githubusercontent.com
23	raw.githubusercontent.com

flow	ioc
19	ip-api.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Builder.exeRunIt.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RunIt.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

StormKittyBuild.exe

pid process

2016 StormKittyBuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

StormKittyBuild.exeBuilder.exe

description pid process

Token: SeDebugPrivilege 2016 StormKittyBuild.exe
Token: SeDebugPrivilege 544 Builder.exe

pid	process
2016	StormKittyBuild.exe

description	pid	process
Token: SeDebugPrivilege	2016	StormKittyBuild.exe
Token: SeDebugPrivilege	544	Builder.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Raccoon Stealer [@INJUANKANAL].exe

description	pid	process	target process
PID 4792 wrote to memory of 2016	4792	Raccoon Stealer [@INJUANKANAL].exe	StormKittyBuild.exe
PID 4792 wrote to memory of 2016	4792	Raccoon Stealer [@INJUANKANAL].exe	StormKittyBuild.exe
PID 4792 wrote to memory of 4380	4792	Raccoon Stealer [@INJUANKANAL].exe	WindowsDataC.exe
PID 4792 wrote to memory of 4380	4792	Raccoon Stealer [@INJUANKANAL].exe	WindowsDataC.exe
PID 4792 wrote to memory of 544	4792	Raccoon Stealer [@INJUANKANAL].exe	Builder.exe
PID 4792 wrote to memory of 544	4792	Raccoon Stealer [@INJUANKANAL].exe	Builder.exe
PID 4792 wrote to memory of 544	4792	Raccoon Stealer [@INJUANKANAL].exe	Builder.exe
PID 4792 wrote to memory of 2952	4792	Raccoon Stealer [@INJUANKANAL].exe	RunIt.exe
PID 4792 wrote to memory of 2952	4792	Raccoon Stealer [@INJUANKANAL].exe	RunIt.exe
PID 4792 wrote to memory of 2952	4792	Raccoon Stealer [@INJUANKANAL].exe	RunIt.exe

C:\Users\Admin\AppData\Local\Temp\Raccoon Stealer [@INJUANKANAL].exe
"C:\Users\Admin\AppData\Local\Temp\Raccoon Stealer [@INJUANKANAL].exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4792
- C:\ProgramData\WindowsDataC.exe
  "C:\ProgramData\WindowsDataC.exe"
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Users\Admin\AppData\Local\Temp\Builder.exe
  "C:\Users\Admin\AppData\Local\Temp\Builder.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:544
- C:\Users\Admin\AppData\Local\Temp\RunIt.exe
  "C:\Users\Admin\AppData\Local\Temp\RunIt.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\WindowsDataC.exe

Filesize
566KB

MD5
112d2c4d2578955d04e3eb771dd938e2

SHA1
d4f7a591ca4b073d96256860637fcc808a369ba8

SHA256
e3d91cacfa390bbc7a27ba4a25005569eda0033ac5a3c7b83328be80dbde747b

SHA512
72aaffcd1f3ca17be585259c9bf355615d24730773e720dbcf73810c92c8916a23a626d053ba1ebdf81efc4b5e6c283699990d5de6b1752b2df59f72ed8eb122

Download Submit
C:\Users\Admin\AppData\Local\Temp\Builder.exe

Filesize
40KB

MD5
766b531d3ea87df07f4a30478e0b6fea

SHA1
3a723efa352eff3421bb1a6fbee9aac3c68a56bd

SHA256
d3cf46a48919b2e21163ec3a38b3212eb2a130c0c58e9797590d0ef1767583d8

SHA512
a8ba8f652cf030daad7ef4971b41253cfe57717b70c4aeed0ce1689a73d6d92562185e9b9aa672f6da1ce4ab476b152d08026060ed41d1b97f19044c135b4742

Download Submit
C:\Users\Admin\AppData\Local\Temp\RunIt.exe

Filesize
143KB

MD5
d067619856f7f3079375960f62b99369

SHA1
964d548557dec3aa8e851526b71adca4b4ddbfd5

SHA256
9770561d2a27dbc16c230fe88af51f718d7d6274fcd63a3f109c381be848b4a9

SHA512
1ec891082ac133833217ce8314f6d163451c5554b789cbf8a5ff0d5ebd0b55a7ec49ea5c408bf784e6952a37526de9e77e6c39b9a4ea3b950c3fda44e7f973b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe

Filesize
302KB

MD5
96c3df8d899558286dc9718cd94a680a

SHA1
aec23b5649301dc1642cc35ac01a261b9afccfc8

SHA256
1cba57cf25eca5211c78a90680c64b01d4b08ce191834f3dd6716c6435b4d869

SHA512
de23986e8ec4fb2f75142fe539fb1e201306e812947b2c05fb6d9ce1303db37c07516e7694839f2f657c5ecb358dcb8a5f8668a8c4f1932dbfb0911c379b8681

Download Submit
memory/544-58-0x0000000000530000-0x000000000053E000-memory.dmp

Filesize
56KB

Download
memory/2016-49-0x00007FFC5CC00000-0x00007FFC5D6C1000-memory.dmp

Filesize
10.8MB

Download
memory/2016-64-0x00007FFC5CC00000-0x00007FFC5D6C1000-memory.dmp

Filesize
10.8MB

Download
memory/2016-53-0x00000000010B0000-0x00000000010B6000-memory.dmp

Filesize
24KB

Download
memory/2016-50-0x00000000028E0000-0x0000000002954000-memory.dmp

Filesize
464KB

Download
memory/2016-48-0x00000000002D0000-0x000000000031E000-memory.dmp

Filesize
312KB

Download
memory/2952-54-0x00000000052D0000-0x0000000005874000-memory.dmp

Filesize
5.6MB

Download
memory/2952-56-0x0000000004C70000-0x0000000004D0C000-memory.dmp

Filesize
624KB

Download
memory/2952-59-0x0000000004D50000-0x0000000004D5A000-memory.dmp

Filesize
40KB

Download
memory/2952-55-0x0000000004BD0000-0x0000000004C62000-memory.dmp

Filesize
584KB

Download
memory/2952-51-0x0000000000E60000-0x0000000000E8A000-memory.dmp

Filesize
168KB

Download
memory/4380-52-0x00007FFC5CC00000-0x00007FFC5D6C1000-memory.dmp

Filesize
10.8MB

Download
memory/4380-65-0x00007FFC5CC00000-0x00007FFC5D6C1000-memory.dmp

Filesize
10.8MB

Download
memory/4380-66-0x000000001AF20000-0x000000001B0C9000-memory.dmp

Filesize
1.7MB

Download
memory/4792-3-0x00007FFC5CC00000-0x00007FFC5D6C1000-memory.dmp

Filesize
10.8MB

Download
memory/4792-1-0x00000000000B0000-0x0000000000146000-memory.dmp

Filesize
600KB

Download
memory/4792-0-0x00007FFC5CC03000-0x00007FFC5CC05000-memory.dmp

Filesize
8KB

Download
memory/4792-2-0x00007FFC5CC00000-0x00007FFC5D6C1000-memory.dmp

Filesize
10.8MB

Download
memory/4792-61-0x00007FFC5CC03000-0x00007FFC5CC05000-memory.dmp

Filesize
8KB

Download
memory/4792-62-0x00007FFC5CC00000-0x00007FFC5D6C1000-memory.dmp

Filesize
10.8MB

Download
memory/4792-63-0x000000001AEB0000-0x000000001B059000-memory.dmp

Filesize
1.7MB

Download
memory/4792-4-0x000000001D430000-0x000000001D4B0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads