Overview
overview
10Static
static
1015a83de318...fa.exe
windows7-x64
615a83de318...fa.exe
windows10-2004-x64
6304f9bc7de...1b.exe
windows7-x64
10304f9bc7de...1b.exe
windows10-2004-x64
1043087ea949...eb.exe
windows7-x64
1043087ea949...eb.exe
windows10-2004-x64
1061bb2c746d...fd.exe
windows7-x64
1061bb2c746d...fd.exe
windows10-2004-x64
1078ae7a93d9...b6.exe
windows7-x64
1078ae7a93d9...b6.exe
windows10-2004-x64
10878487e25e...53.exe
windows7-x64
10878487e25e...53.exe
windows10-2004-x64
10922135a10e...54.exe
windows7-x64
10922135a10e...54.exe
windows10-2004-x64
1098e12d1098...ad.exe
windows7-x64
1098e12d1098...ad.exe
windows10-2004-x64
10b67bc3d957...8f.exe
windows7-x64
8b67bc3d957...8f.exe
windows10-2004-x64
8Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-11-2024 16:29
Behavioral task
behavioral1
Sample
15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
b67bc3d9578e037d7cf91795a1015008d2ee5629c5b8089a16ae3d3bac92168f.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
b67bc3d9578e037d7cf91795a1015008d2ee5629c5b8089a16ae3d3bac92168f.exe
Resource
win10v2004-20241007-en
General
-
Target
78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
-
Size
118KB
-
MD5
95c93ba88cbebbf97fa7aec965dac908
-
SHA1
d71ca71cdcf375b7f55cf26d66e5f4b2b387bec4
-
SHA256
78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6
-
SHA512
4bddaca540dc9ea0039a735d254e4a30b06cd5a24dc696bcc9820126b00eae57977d80ffc3528e3c92b9981dbd241276132616e29ccf47a6adc044d65258f64a
-
SSDEEP
3072:QjPR+2iJ6Cr/B+PHbsVLK3usN9bAeiLZU6pmoXX1:K+2i7/B+gMec9bdg
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral9/memory/2588-1-0x0000000000C80000-0x0000000000CA2000-memory.dmp family_stormkitty -
Stormkitty family
-
Deletes itself 1 IoCs
pid Process 2964 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 8 raw.githubusercontent.com 9 raw.githubusercontent.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1260 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 992 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2588 78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe Token: SeDebugPrivilege 992 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2588 wrote to memory of 2964 2588 78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe 32 PID 2588 wrote to memory of 2964 2588 78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe 32 PID 2588 wrote to memory of 2964 2588 78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe 32 PID 2588 wrote to memory of 2964 2588 78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe 32 PID 2964 wrote to memory of 1212 2964 cmd.exe 34 PID 2964 wrote to memory of 1212 2964 cmd.exe 34 PID 2964 wrote to memory of 1212 2964 cmd.exe 34 PID 2964 wrote to memory of 1212 2964 cmd.exe 34 PID 2964 wrote to memory of 992 2964 cmd.exe 35 PID 2964 wrote to memory of 992 2964 cmd.exe 35 PID 2964 wrote to memory of 992 2964 cmd.exe 35 PID 2964 wrote to memory of 992 2964 cmd.exe 35 PID 2964 wrote to memory of 1260 2964 cmd.exe 36 PID 2964 wrote to memory of 1260 2964 cmd.exe 36 PID 2964 wrote to memory of 1260 2964 cmd.exe 36 PID 2964 wrote to memory of 1260 2964 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe"C:\Users\Admin\AppData\Local\Temp\78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpD81D.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpD81D.tmp.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:1212
-
-
C:\Windows\SysWOW64\taskkill.exeTaskKill /F /IM 25883⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:992
-
-
C:\Windows\SysWOW64\timeout.exeTimeout /T 2 /Nobreak3⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1260
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dfd529a13f9a5cc45b9d4cde3092e2ac
SHA1ad06e46671a8a0b571b67d9ef784498adbd0f74d
SHA2562ab9de0d2b0ade90048b497828966ae80faf5960a050c40792148dbb6c710c0f
SHA512c368e9e907eb78cf0bb2fd6e23b652e35834e44d16ded636b5bc863b7632411cffaa96481ff6623dd71fb90670dde4e3d2a466a62928dff96de8067fc34c7110
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
171B
MD5e55c91983cc8bdfec3057011b1869b81
SHA1a60846fdc465110e37c6afdb9497abee7e477eb1
SHA256af8b2e1b27ee04afe8b7f88fc31d4efd39e304ffbd1442a99e719a98ccc04f74
SHA5120f6b4a3dbbe4cb3c6bafc1e71115f112190d9ba1f51d58649639e11b4fbf0a5293ca9051e47f5d3ec8337ac11f99feb54b6150b28a3b7e39d6e38eea3e9b600d