stormkitty | a43561aa8487005bdf5bd8c5f82c3e4d82f19ce856f80f9be4a01796f06b140e

Analysis

max time kernel
113s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 15:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc8cd640537ae8527477e5e91a200855_JaffaCakes118.exe
Size

6.5MB
MD5

fc8cd640537ae8527477e5e91a200855
SHA1

0ab5d5c9b9a6c941744647e2e49b1f8246b574e6
SHA256

a43561aa8487005bdf5bd8c5f82c3e4d82f19ce856f80f9be4a01796f06b140e
SHA512

1901ccb239220a65543cc5f4bd1b558285ccc8d5f2e414fe54cdf6b54f755504252a85e02e00876b1a043e0b605c05b522a838feac99b5afe03acd5dda579707
SSDEEP

98304:WxLx7fVo1Wrh8XRDEfDtGFGjgnGc03zNXkuUwfaNP/s+sGb1+NdFq5lIx:q1iWmXRQbQUjgnHxuUvNP/sVssdF+A

Score

10^/10

stormkitty stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 4 IoCs

resource	yara_rule
behavioral2/memory/3352-1-0x000002ABE2C10000-0x000002ABE329C000-memory.dmp	family_stormkitty
behavioral2/files/0x00070000000234cb-15.dat	family_stormkitty
behavioral2/memory/3244-22-0x0000000000CF0000-0x0000000000D40000-memory.dmp	family_stormkitty
behavioral2/memory/3244-25-0x00000000017D0000-0x0000000001844000-memory.dmp	family_stormkitty

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	fc8cd640537ae8527477e5e91a200855_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
728	one.exe
3244	two.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
17	raw.githubusercontent.com
18	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3244	two.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3244	two.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 728	3352	fc8cd640537ae8527477e5e91a200855_JaffaCakes118.exe	82
PID 3352 wrote to memory of 728	3352	fc8cd640537ae8527477e5e91a200855_JaffaCakes118.exe	82
PID 3352 wrote to memory of 3244	3352	fc8cd640537ae8527477e5e91a200855_JaffaCakes118.exe	84
PID 3352 wrote to memory of 3244	3352	fc8cd640537ae8527477e5e91a200855_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\fc8cd640537ae8527477e5e91a200855_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc8cd640537ae8527477e5e91a200855_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\one.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\one.exe"
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\two.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\two.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\one.exe

Filesize
25KB

MD5
16dc4282b19f6785ed14da429fa5ba67

SHA1
775fe05b6840514f5728f0e142e6001abcfda445

SHA256
73d99964f4d569e435da401530db2d8edc6a79563553b88feeb9bc27989dec4c

SHA512
5ba7a40ca54b41a97010cab3aa10ae2ae1676aca773521428c2fc29e1b98d21b9b62743d8ec6920b4853e8e4d9352fd8aadd3accf8dd508adbfdf9876439a0f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\two.exe

Filesize
310KB

MD5
4fc23ea06d7e0697982c190f3c2ca01f

SHA1
bda2becd1f678c2f1311086a6a0e089404931de6

SHA256
c4bd5806146264e96b109390176c4d6fc055de9663a93bb010b50c78036c374d

SHA512
74bfbf6e280c256967f400a6aee016fd60cdc289cd780ed6531505226e475a88c6a6e66af79d68932b3ae77ca14a276464628d8742811cdaf7372053f5a717fa

Download Submit
memory/728-29-0x00007FFB61570000-0x00007FFB62031000-memory.dmp

Filesize
10.8MB

Download
memory/728-24-0x00000229CC510000-0x00000229CC51A000-memory.dmp

Filesize
40KB

Download
memory/728-32-0x00007FFB61570000-0x00007FFB62031000-memory.dmp

Filesize
10.8MB

Download
memory/3244-22-0x0000000000CF0000-0x0000000000D40000-memory.dmp

Filesize
320KB

Download
memory/3244-25-0x00000000017D0000-0x0000000001844000-memory.dmp

Filesize
464KB

Download
memory/3244-28-0x00000000016D0000-0x00000000016D6000-memory.dmp

Filesize
24KB

Download
memory/3244-27-0x00007FFB61570000-0x00007FFB62031000-memory.dmp

Filesize
10.8MB

Download
memory/3244-30-0x00007FFB61570000-0x00007FFB62031000-memory.dmp

Filesize
10.8MB

Download
memory/3244-31-0x00007FFB61570000-0x00007FFB62031000-memory.dmp

Filesize
10.8MB

Download
memory/3244-33-0x00007FFB61570000-0x00007FFB62031000-memory.dmp

Filesize
10.8MB

Download
memory/3352-0-0x00007FFB61573000-0x00007FFB61575000-memory.dmp

Filesize
8KB

Download
memory/3352-1-0x000002ABE2C10000-0x000002ABE329C000-memory.dmp

Filesize
6.5MB

Download