Analysis
-
max time kernel
93s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-12-2024 21:21
General
-
Target
3cf37367797ad61761ab44b22ec80c206d31411a604106d061be6935787b8110.exe
-
Size
80KB
-
MD5
9bcb1a253d07b610da76fd22ad176c9d
-
SHA1
e5f8196083beab009db092fe891e88551393b247
-
SHA256
3cf37367797ad61761ab44b22ec80c206d31411a604106d061be6935787b8110
-
SHA512
1d0729cbff3905f937a59a9e56ed4c65cb805395cc430035b45bb82e1b06d8cfa490466d3661ade18b05e4be74ba642df1b61c03dbf7f22740373687261c5744
-
SSDEEP
1536:FZno9xptw8VGHE1uWdas6vKPHvfpK3I5hxS9a/voKxjzxtV3wFrD:F+bZPfpK3g69a/voKhzxtdwFn
Score
10/10
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cf37367797ad61761ab44b22ec80c206d31411a604106d061be6935787b8110.exe"C:\Users\Admin\AppData\Local\Temp\3cf37367797ad61761ab44b22ec80c206d31411a604106d061be6935787b8110.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
10.8MB