Analysis
-
max time kernel
93s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 14:29
Behavioral task
behavioral1
Sample
PcFire.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
PcFire.exe
Resource
win10v2004-20241007-en
General
-
Target
PcFire.exe
-
Size
74KB
-
MD5
5869edd76793fdda010c3191d14a38af
-
SHA1
aacad694e1334c037e68db2201173a8347afff78
-
SHA256
9b1e17bfb91e74ba74e0b00fba0fa0c71316994cca8145207f3dd0f0e41f1ed5
-
SHA512
3a0cf7e4d6315ca2be833336f579d1d421d03dda2adcf5fc02ee8880bbb4251b8544528e5bc0c0598447dac49dd6dfb357f42b7bab55ecc792e6f82334091d82
-
SSDEEP
1536:fZno9xptw8VGHE1uWdas6vKPHvfpK3INcwqE49aSvwKxjzxt6e:f+bZPfpK3qDqP9aSvwKhzxtz
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/1624-1-0x0000000000010000-0x0000000000028000-memory.dmp disable_win_def -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/1624-1-0x0000000000010000-0x0000000000028000-memory.dmp family_stormkitty -
Stormkitty family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nvidiaDValueOn = "C:\\Users\\Admin\\AppData\\Local\\NVIDIA Local Drivers\\DriversUpdateProcess_x64.exe" PcFire.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 checkip.dyndns.org -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1624 PcFire.exe
Processes
Network
-
Remote address:8.8.8.8:53Requestcheckip.dyndns.orgIN AResponsecheckip.dyndns.orgIN CNAMEcheckip.dyndns.comcheckip.dyndns.comIN A193.122.130.0checkip.dyndns.comIN A132.226.247.73checkip.dyndns.comIN A193.122.6.168checkip.dyndns.comIN A132.226.8.169checkip.dyndns.comIN A158.101.44.242
-
Remote address:193.122.130.0:80RequestGET / HTTP/1.1
Host: checkip.dyndns.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 56126b4a78fd7d7eeb9894777bb3d7f0
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request0.130.122.193.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request145.197.77.23.in-addr.arpaIN PTRResponse145.197.77.23.in-addr.arpaIN PTRa23-77-197-145deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request72.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.42.69.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request22.236.111.52.in-addr.arpaIN PTRResponse
-
298 B 455 B 5 3
HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200
-
64 B 176 B 1 1
DNS Request
checkip.dyndns.org
DNS Response
193.122.130.0132.226.247.73193.122.6.168132.226.8.169158.101.44.242
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
0.130.122.193.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
145.197.77.23.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
72.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
197.87.175.4.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
241.42.69.40.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
22.236.111.52.in-addr.arpa