stormkitty | 96dea95151b45309d8bda1112f842802e852a15ac2173b0023b1ba35deae5ec1

General

Target

rDoc5633276235623657_xls.exe
Size

84KB
MD5

d5489da5aa14ed9d71d8338ec41a1bc1
SHA1

fe04a678f7d95ed31bd364e0a8a4831964f2b84f
SHA256

96dea95151b45309d8bda1112f842802e852a15ac2173b0023b1ba35deae5ec1
SHA512

68ae7b3c2367f9a2124dba4549ee90dede2fd12552acb7823eae42ffa014e7f4b37cb95b836d01de1270cbc3a48d2903988dc69d1f4f7646d39a9d0b7c77a940
SSDEEP

1536:WGOLl+jxSwe51ZMXEw1PfEeRH0bndlu630VDx:WGOBCtE1ZpwJbSndTEVDx

Score

10^/10

stormkitty xworm discovery rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

178.215.236.218:16433

Mutex

OeRWZLHs1gN7FCy5

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2568-17-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/2568-15-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/2568-13-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/2568-9-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/2568-7-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2568-24-0x00000000062C0000-0x00000000063E0000-memory.dmp	family_stormkitty

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

Processes:

RegAsm.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	RegAsm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	RegAsm.exe

Loads dropped DLL 1 IoCs

Processes:

RegAsm.exe

pid process

2568 RegAsm.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Suspicious use of SetThreadContext 1 IoCs

Processes:

rDoc5633276235623657_xls.exe

description pid process target process

PID 2708 set thread context of 2568 2708 rDoc5633276235623657_xls.exe RegAsm.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2568	RegAsm.exe

description	pid	process	target process
PID 2708 set thread context of 2568	2708	rDoc5633276235623657_xls.exe	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rDoc5633276235623657_xls.exeRegAsm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rDoc5633276235623657_xls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rDoc5633276235623657_xls.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2708	rDoc5633276235623657_xls.exe
Token: SeDebugPrivilege	2568	RegAsm.exe
Token: SeDebugPrivilege	2568	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

rDoc5633276235623657_xls.exe

description	pid	process	target process
PID 2708 wrote to memory of 2568	2708	rDoc5633276235623657_xls.exe	RegAsm.exe
PID 2708 wrote to memory of 2568	2708	rDoc5633276235623657_xls.exe	RegAsm.exe
PID 2708 wrote to memory of 2568	2708	rDoc5633276235623657_xls.exe	RegAsm.exe
PID 2708 wrote to memory of 2568	2708	rDoc5633276235623657_xls.exe	RegAsm.exe
PID 2708 wrote to memory of 2568	2708	rDoc5633276235623657_xls.exe	RegAsm.exe
PID 2708 wrote to memory of 2568	2708	rDoc5633276235623657_xls.exe	RegAsm.exe
PID 2708 wrote to memory of 2568	2708	rDoc5633276235623657_xls.exe	RegAsm.exe
PID 2708 wrote to memory of 2568	2708	rDoc5633276235623657_xls.exe	RegAsm.exe
PID 2708 wrote to memory of 2568	2708	rDoc5633276235623657_xls.exe	RegAsm.exe
PID 2708 wrote to memory of 2568	2708	rDoc5633276235623657_xls.exe	RegAsm.exe
PID 2708 wrote to memory of 2568	2708	rDoc5633276235623657_xls.exe	RegAsm.exe
PID 2708 wrote to memory of 2568	2708	rDoc5633276235623657_xls.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\rDoc5633276235623657_xls.exe
"C:\Users\Admin\AppData\Local\Temp\rDoc5633276235623657_xls.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

1

T1217

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\XClient.exe

Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
memory/2568-13-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2568-3-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2568-17-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2568-15-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2568-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2568-9-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2568-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2568-5-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2568-24-0x00000000062C0000-0x00000000063E0000-memory.dmp

Filesize
1.1MB

Download
memory/2708-2-0x0000000074510000-0x0000000074BFE000-memory.dmp

Filesize
6.9MB

Download
memory/2708-0-0x000000007451E000-0x000000007451F000-memory.dmp

Filesize
4KB

Download
memory/2708-18-0x0000000074510000-0x0000000074BFE000-memory.dmp

Filesize
6.9MB

Download
memory/2708-1-0x00000000012A0000-0x00000000012BE000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads