Resubmissions

07/11/2024, 16:29

241107-tzeqvawbpe 10

07/11/2024, 06:54

241107-hpd6sazqap 10

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2024, 16:29

General

  • Target

    78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe

  • Size

    118KB

  • MD5

    95c93ba88cbebbf97fa7aec965dac908

  • SHA1

    d71ca71cdcf375b7f55cf26d66e5f4b2b387bec4

  • SHA256

    78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6

  • SHA512

    4bddaca540dc9ea0039a735d254e4a30b06cd5a24dc696bcc9820126b00eae57977d80ffc3528e3c92b9981dbd241276132616e29ccf47a6adc044d65258f64a

  • SSDEEP

    3072:QjPR+2iJ6Cr/B+PHbsVLK3usN9bAeiLZU6pmoXX1:K+2i7/B+gMec9bdg

Malware Config

Signatures

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Stormkitty family
  • Deletes itself 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
    "C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpD81D.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpD81D.tmp.bat
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2964
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1212
      • C:\Windows\SysWOW64\taskkill.exe
        TaskKill /F /IM 2588
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:992
      • C:\Windows\SysWOW64\timeout.exe
        Timeout /T 2 /Nobreak
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:1260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dfd529a13f9a5cc45b9d4cde3092e2ac

    SHA1

    ad06e46671a8a0b571b67d9ef784498adbd0f74d

    SHA256

    2ab9de0d2b0ade90048b497828966ae80faf5960a050c40792148dbb6c710c0f

    SHA512

    c368e9e907eb78cf0bb2fd6e23b652e35834e44d16ded636b5bc863b7632411cffaa96481ff6623dd71fb90670dde4e3d2a466a62928dff96de8067fc34c7110

  • C:\Users\Admin\AppData\Local\Temp\CabAD61.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarAD83.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\tmpD81D.tmp.bat

    Filesize

    171B

    MD5

    e55c91983cc8bdfec3057011b1869b81

    SHA1

    a60846fdc465110e37c6afdb9497abee7e477eb1

    SHA256

    af8b2e1b27ee04afe8b7f88fc31d4efd39e304ffbd1442a99e719a98ccc04f74

    SHA512

    0f6b4a3dbbe4cb3c6bafc1e71115f112190d9ba1f51d58649639e11b4fbf0a5293ca9051e47f5d3ec8337ac11f99feb54b6150b28a3b7e39d6e38eea3e9b600d

  • memory/2588-0-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

    Filesize

    4KB

  • memory/2588-1-0x0000000000C80000-0x0000000000CA2000-memory.dmp

    Filesize

    136KB

  • memory/2588-2-0x0000000074BD0000-0x00000000752BE000-memory.dmp

    Filesize

    6.9MB

  • memory/2588-99-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

    Filesize

    4KB

  • memory/2588-100-0x0000000074BD0000-0x00000000752BE000-memory.dmp

    Filesize

    6.9MB

  • memory/2588-103-0x0000000074BD0000-0x00000000752BE000-memory.dmp

    Filesize

    6.9MB