stormkitty | dd6f0b9730529cfe145d5585eccfb6c68510758d16ffd02043bd1fe73842ee1b

Resubmissions

07-11-2024 16:29

241107-tzeqvawbpe 10

07-11-2024 06:54

241107-hpd6sazqap 10

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
Size

118KB
MD5

95c93ba88cbebbf97fa7aec965dac908
SHA1

d71ca71cdcf375b7f55cf26d66e5f4b2b387bec4
SHA256

78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6
SHA512

4bddaca540dc9ea0039a735d254e4a30b06cd5a24dc696bcc9820126b00eae57977d80ffc3528e3c92b9981dbd241276132616e29ccf47a6adc044d65258f64a
SSDEEP

3072:QjPR+2iJ6Cr/B+PHbsVLK3usN9bAeiLZU6pmoXX1:K+2i7/B+gMec9bdg

Score

10^/10

stormkitty discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral10/memory/5016-1-0x0000000000F10000-0x0000000000F32000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Downloads MZ/PE file
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\0e4ee70d89575d257d7ab2a752a7290f\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
File created	C:\Users\Admin\AppData\Local\0e4ee70d89575d257d7ab2a752a7290f\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
File created	C:\Users\Admin\AppData\Local\0e4ee70d89575d257d7ab2a752a7290f\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
File created	C:\Users\Admin\AppData\Local\0e4ee70d89575d257d7ab2a752a7290f\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
File created	C:\Users\Admin\AppData\Local\0e4ee70d89575d257d7ab2a752a7290f\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
File created	C:\Users\Admin\AppData\Local\0e4ee70d89575d257d7ab2a752a7290f\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
15	raw.githubusercontent.com
14	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	5016	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4744	cmd.exe
2108	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5016	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
5016	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
5016	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
5016	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
5016	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
5016	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
5016	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
5016	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
Token: SeDebugPrivilege	2960	taskmgr.exe
Token: SeSystemProfilePrivilege	2960	taskmgr.exe
Token: SeCreateGlobalPrivilege	2960	taskmgr.exe
Token: 33	2960	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2960	taskmgr.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe
2960	taskmgr.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4744	5016	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe	92
PID 5016 wrote to memory of 4744	5016	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe	92
PID 5016 wrote to memory of 4744	5016	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe	92
PID 4744 wrote to memory of 3668	4744	cmd.exe	94
PID 4744 wrote to memory of 3668	4744	cmd.exe	94
PID 4744 wrote to memory of 3668	4744	cmd.exe	94
PID 4744 wrote to memory of 2108	4744	cmd.exe	95
PID 4744 wrote to memory of 2108	4744	cmd.exe	95
PID 4744 wrote to memory of 2108	4744	cmd.exe	95
PID 4744 wrote to memory of 3196	4744	cmd.exe	96
PID 4744 wrote to memory of 3196	4744	cmd.exe	96
PID 4744 wrote to memory of 3196	4744	cmd.exe	96
PID 5016 wrote to memory of 2568	5016	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe	101
PID 5016 wrote to memory of 2568	5016	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe	101
PID 5016 wrote to memory of 2568	5016	78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe	101
PID 2568 wrote to memory of 1628	2568	cmd.exe	103
PID 2568 wrote to memory of 1628	2568	cmd.exe	103
PID 2568 wrote to memory of 1628	2568	cmd.exe	103
PID 2568 wrote to memory of 4944	2568	cmd.exe	104
PID 2568 wrote to memory of 4944	2568	cmd.exe	104
PID 2568 wrote to memory of 4944	2568	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
"C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe"
1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3668
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2108
- - C:\Windows\SysWOW64\findstr.exe
    findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 2692
  2⤵
  - Program crash
  PID:2612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1628
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5016 -ip 5016
1⤵
PID:2684

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\0e4ee70d89575d257d7ab2a752a7290f\Admin@GYHASOLS_en-US\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\DotNetZip.dll

Filesize
448KB

MD5
6d1c62ec1c2ef722f49b2d8dd4a4df16

SHA1
1bb08a979b7987bc7736a8cfa4779383cb0ecfa6

SHA256
00da1597d92235d3f84da979e2fa5dbf049bafb52c33bd6fc8ee7b29570c124c

SHA512
c0dce8eaa52eb6c319d4be2eec4622bb3380c65b659cfb77ff51a4ada7d3e591e791ee823dad67b5556ffac5c060ff45d09dd1cc21baaf70ba89806647cb3bd2

Download Submit
memory/2960-92-0x00000242A5460000-0x00000242A5461000-memory.dmp

Filesize
4KB

Download
memory/2960-95-0x00000242A5460000-0x00000242A5461000-memory.dmp

Filesize
4KB

Download
memory/2960-91-0x00000242A5460000-0x00000242A5461000-memory.dmp

Filesize
4KB

Download
memory/2960-93-0x00000242A5460000-0x00000242A5461000-memory.dmp

Filesize
4KB

Download
memory/2960-94-0x00000242A5460000-0x00000242A5461000-memory.dmp

Filesize
4KB

Download
memory/2960-96-0x00000242A5460000-0x00000242A5461000-memory.dmp

Filesize
4KB

Download
memory/2960-97-0x00000242A5460000-0x00000242A5461000-memory.dmp

Filesize
4KB

Download
memory/2960-87-0x00000242A5460000-0x00000242A5461000-memory.dmp

Filesize
4KB

Download
memory/2960-86-0x00000242A5460000-0x00000242A5461000-memory.dmp

Filesize
4KB

Download
memory/2960-85-0x00000242A5460000-0x00000242A5461000-memory.dmp

Filesize
4KB

Download
memory/5016-0-0x000000007449E000-0x000000007449F000-memory.dmp

Filesize
4KB

Download
memory/5016-84-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/5016-69-0x0000000007B30000-0x00000000080D4000-memory.dmp

Filesize
5.6MB

Download
memory/5016-3-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/5016-66-0x0000000007290000-0x0000000007322000-memory.dmp

Filesize
584KB

Download
memory/5016-1-0x0000000000F10000-0x0000000000F32000-memory.dmp

Filesize
136KB

Download
memory/5016-2-0x0000000005900000-0x0000000005966000-memory.dmp

Filesize
408KB

Download