stormkitty | 030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe
Size

656KB
MD5

ca2ed1b927f4bee1cd1f24bb19f4c0e1
SHA1

d1b7dc1cc0412301c61660d0d5cb02d20a6aa77d
SHA256

030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b
SHA512

153939e1eeaeb2e3d4fc9f487ce039fde403a18ea94466c55c53ce5e00aefa59ae3324c03687c1794c7d321da9b2dced1bca2a658d5da54e0acb76dfff4d3da7
SSDEEP

12288:cT02YrvZq2mPKxG3sfYFwJH9ZzkwGQWOsKWLCp6X9uruAK5Gi:cTbYdqfKxG3swyVk7QWOhW+p6NBAWGi

Score

10^/10

stormkitty xworm discovery execution rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

176.9.162.125:4060

Mutex

znPInVDrQ2IiwTWB

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/672-23-0x00000000004B0000-0x00000000004C0000-memory.dmp	family_xworm

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/672-144-0x00000000390F0000-0x0000000039210000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1920	powershell.exe
3148	powershell.exe
2620	powershell.exe
1932	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe

Loads dropped DLL 1 IoCs

pid	Process
2640	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2640	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe
672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2640 set thread context of 672	2640	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	92

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\slutstrenge.tri	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Semiprofessionalized248\evaluxir.pra	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1920	powershell.exe
1920	powershell.exe
3148	powershell.exe
3148	powershell.exe
2620	powershell.exe
2620	powershell.exe
1932	powershell.exe
1932	powershell.exe
672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2640	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	3148	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 672	2640	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	92
PID 2640 wrote to memory of 672	2640	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	92
PID 2640 wrote to memory of 672	2640	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	92
PID 2640 wrote to memory of 672	2640	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	92
PID 2640 wrote to memory of 672	2640	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	92
PID 672 wrote to memory of 1920	672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	95
PID 672 wrote to memory of 1920	672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	95
PID 672 wrote to memory of 1920	672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	95
PID 672 wrote to memory of 3148	672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	97
PID 672 wrote to memory of 3148	672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	97
PID 672 wrote to memory of 3148	672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	97
PID 672 wrote to memory of 2620	672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	99
PID 672 wrote to memory of 2620	672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	99
PID 672 wrote to memory of 2620	672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	99
PID 672 wrote to memory of 1932	672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	101
PID 672 wrote to memory of 1932	672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	101
PID 672 wrote to memory of 1932	672	030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe	101

C:\Users\Admin\AppData\Local\Temp\030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe
"C:\Users\Admin\AppData\Local\Temp\030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe
  "C:\Users\Admin\AppData\Local\Temp\030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1920
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '030324e0a31427fd63213acd29f3cdf5b445a6ec03eb803fb08dbf3a0c1b258b.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3148
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
6b342930680066ed1696e0e4b9a9b137

SHA1
c0d6017a5d733f39f76aa56a7c415ad83d520f9c

SHA256
896254646934dc3af5f74ff035dcb2c9a488aa99dee13afd6c7b1b9e3e1044f1

SHA512
dcc9ff22c3d63e473e237585e9c100dc52fb529d3f4db68fc4c44f5d589e6e1f171cdadac3a38000a6928c1356954e6096e557b84d58956d25c6575d1ed8cee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
07e55af57ca08f315954a51d1b129d03

SHA1
7f6d3708ad808cebf2f08ea43274698a283f0023

SHA256
eb590b417ed2eac7cda7ae382787734f9210ab55e6655a4a1677ab9ca839c277

SHA512
9f2d28fcf9610f9d45aa858d98c9ac087e065fd19a74c54338f90bcf585477adbc160fccdd1fe7f22e093339c8553ee942ace11697bb9ef34a26bd8a7cf1c8db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
e8e63d7c434efed3259dde9cfb826a76

SHA1
5c803ebc6ca3d8f1bf0d93e7ab4e17f350ae0fc2

SHA256
e589a02db910631c5dbba158300c0a5a2e94b16672e4d02d67b7dba0b44bad6c

SHA512
3ef28db3e44c0a54cec0288887f050bd86e268fef459682436384af8936c902da41bbdd3bd968654539992d90ff352a93e846f8735ad44cd9adaebe20e4498d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ycthkpci.ph5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa6DFD.tmp\System.dll

Filesize
12KB

MD5
564bb0373067e1785cba7e4c24aab4bf

SHA1
7c9416a01d821b10b2eef97b80899d24014d6fc1

SHA256
7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

SHA512
22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

Download Submit
memory/672-24-0x0000000037690000-0x000000003772C000-memory.dmp

Filesize
624KB

Download
memory/672-141-0x0000000038820000-0x000000003882A000-memory.dmp

Filesize
40KB

Download
memory/672-22-0x000000007273E000-0x000000007273F000-memory.dmp

Filesize
4KB

Download
memory/672-23-0x00000000004B0000-0x00000000004C0000-memory.dmp

Filesize
64KB

Download
memory/672-21-0x0000000077841000-0x0000000077961000-memory.dmp

Filesize
1.1MB

Download
memory/672-143-0x0000000072730000-0x0000000072EE0000-memory.dmp

Filesize
7.7MB

Download
memory/672-13-0x00000000778E5000-0x00000000778E6000-memory.dmp

Filesize
4KB

Download
memory/672-20-0x00000000004B0000-0x0000000001704000-memory.dmp

Filesize
18.3MB

Download
memory/672-140-0x0000000038760000-0x00000000387F2000-memory.dmp

Filesize
584KB

Download
memory/672-138-0x0000000038150000-0x00000000386F4000-memory.dmp

Filesize
5.6MB

Download
memory/672-12-0x00000000778C8000-0x00000000778C9000-memory.dmp

Filesize
4KB

Download
memory/672-139-0x0000000072730000-0x0000000072EE0000-memory.dmp

Filesize
7.7MB

Download
memory/672-144-0x00000000390F0000-0x0000000039210000-memory.dmp

Filesize
1.1MB

Download
memory/672-111-0x000000007273E000-0x000000007273F000-memory.dmp

Filesize
4KB

Download
memory/672-145-0x0000000039230000-0x0000000039584000-memory.dmp

Filesize
3.3MB

Download
memory/672-146-0x00000000395E0000-0x000000003962C000-memory.dmp

Filesize
304KB

Download
memory/1920-27-0x0000000004DA0000-0x00000000053C8000-memory.dmp

Filesize
6.2MB

Download
memory/1920-44-0x000000006E7F0000-0x000000006E83C000-memory.dmp

Filesize
304KB

Download
memory/1920-56-0x00000000074E0000-0x0000000007B5A000-memory.dmp

Filesize
6.5MB

Download
memory/1920-57-0x0000000006EA0000-0x0000000006EBA000-memory.dmp

Filesize
104KB

Download
memory/1920-58-0x0000000006F10000-0x0000000006F1A000-memory.dmp

Filesize
40KB

Download
memory/1920-59-0x0000000007120000-0x00000000071B6000-memory.dmp

Filesize
600KB

Download
memory/1920-60-0x00000000070A0000-0x00000000070B1000-memory.dmp

Filesize
68KB

Download
memory/1920-61-0x00000000070D0000-0x00000000070DE000-memory.dmp

Filesize
56KB

Download
memory/1920-62-0x00000000070E0000-0x00000000070F4000-memory.dmp

Filesize
80KB

Download
memory/1920-63-0x00000000071E0000-0x00000000071FA000-memory.dmp

Filesize
104KB

Download
memory/1920-64-0x00000000071C0000-0x00000000071C8000-memory.dmp

Filesize
32KB

Download
memory/1920-54-0x0000000006150000-0x000000000616E000-memory.dmp

Filesize
120KB

Download
memory/1920-26-0x0000000000DB0000-0x0000000000DE6000-memory.dmp

Filesize
216KB

Download
memory/1920-55-0x0000000006D60000-0x0000000006E03000-memory.dmp

Filesize
652KB

Download
memory/1920-28-0x0000000005400000-0x0000000005422000-memory.dmp

Filesize
136KB

Download
memory/1920-43-0x0000000006D20000-0x0000000006D52000-memory.dmp

Filesize
200KB

Download
memory/1920-29-0x00000000054A0000-0x0000000005506000-memory.dmp

Filesize
408KB

Download
memory/1920-42-0x0000000005BA0000-0x0000000005BEC000-memory.dmp

Filesize
304KB

Download
memory/1920-41-0x0000000005B70000-0x0000000005B8E000-memory.dmp

Filesize
120KB

Download
memory/1920-30-0x0000000005510000-0x0000000005576000-memory.dmp

Filesize
408KB

Download
memory/1920-40-0x0000000005680000-0x00000000059D4000-memory.dmp

Filesize
3.3MB

Download
memory/1932-122-0x000000006E7F0000-0x000000006E83C000-memory.dmp

Filesize
304KB

Download
memory/2620-100-0x000000006E7F0000-0x000000006E83C000-memory.dmp

Filesize
304KB

Download
memory/2640-10-0x0000000077841000-0x0000000077961000-memory.dmp

Filesize
1.1MB

Download
memory/2640-11-0x0000000074535000-0x0000000074536000-memory.dmp

Filesize
4KB

Download
memory/2640-9-0x0000000077841000-0x0000000077961000-memory.dmp

Filesize
1.1MB

Download
memory/3148-79-0x000000006E7F0000-0x000000006E83C000-memory.dmp

Filesize
304KB

Download
memory/3148-77-0x00000000054D0000-0x0000000005824000-memory.dmp

Filesize
3.3MB

Download