0da67f4bffe1d30feabc5d784579dd119f131ae2380327d3fc32dd17aedba1f9

Analysis

max time kernel
423s
max time network
426s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2024, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ThunderKitty_Built.exe
Size

9.7MB
MD5

6fac67027fa756d82665d69627f21cd4
SHA1

cd62b5622a58f88c9a62dfa68804b1017d312f6e
SHA256

0da67f4bffe1d30feabc5d784579dd119f131ae2380327d3fc32dd17aedba1f9
SHA512

a5bbb300aaf508165e7da51d64fe54ccd4fc62401c9339444254bf05012b9dc4071c3cd6ed7651d094feced705bc9bbf601d182353d167b1e9be09c27dcedb35
SSDEEP

98304:v9Rjwt5p24UX+fgIhC+XP1chzKEuVSjMAh80q:V/WxP1clXd8D

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Kills process with taskkill 15 IoCs

evasion

pid	Process
4536	taskkill.exe
3452	taskkill.exe
8	taskkill.exe
2340	taskkill.exe
2252	taskkill.exe
1000	taskkill.exe
4424	taskkill.exe
3832	taskkill.exe
2880	taskkill.exe
4572	taskkill.exe
2740	taskkill.exe
1144	taskkill.exe
2268	taskkill.exe
4936	taskkill.exe
3564	taskkill.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	3452	taskkill.exe
Token: SeDebugPrivilege	4424	taskkill.exe
Token: SeDebugPrivilege	4936	taskkill.exe
Token: SeDebugPrivilege	8	taskkill.exe
Token: SeDebugPrivilege	2340	taskkill.exe
Token: SeDebugPrivilege	3832	taskkill.exe
Token: SeDebugPrivilege	4572	taskkill.exe
Token: SeDebugPrivilege	2740	taskkill.exe
Token: SeDebugPrivilege	3564	taskkill.exe
Token: SeDebugPrivilege	4536	taskkill.exe
Token: SeDebugPrivilege	2880	taskkill.exe
Token: SeDebugPrivilege	2252	taskkill.exe
Token: SeDebugPrivilege	1000	taskkill.exe
Token: SeDebugPrivilege	1144	taskkill.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2268	2656	ThunderKitty_Built.exe	83
PID 2656 wrote to memory of 2268	2656	ThunderKitty_Built.exe	83
PID 2656 wrote to memory of 3452	2656	ThunderKitty_Built.exe	86
PID 2656 wrote to memory of 3452	2656	ThunderKitty_Built.exe	86
PID 2656 wrote to memory of 4424	2656	ThunderKitty_Built.exe	88
PID 2656 wrote to memory of 4424	2656	ThunderKitty_Built.exe	88
PID 2656 wrote to memory of 4936	2656	ThunderKitty_Built.exe	90
PID 2656 wrote to memory of 4936	2656	ThunderKitty_Built.exe	90
PID 2656 wrote to memory of 8	2656	ThunderKitty_Built.exe	92
PID 2656 wrote to memory of 8	2656	ThunderKitty_Built.exe	92
PID 2656 wrote to memory of 2340	2656	ThunderKitty_Built.exe	94
PID 2656 wrote to memory of 2340	2656	ThunderKitty_Built.exe	94
PID 2656 wrote to memory of 3832	2656	ThunderKitty_Built.exe	96
PID 2656 wrote to memory of 3832	2656	ThunderKitty_Built.exe	96
PID 2656 wrote to memory of 4572	2656	ThunderKitty_Built.exe	98
PID 2656 wrote to memory of 4572	2656	ThunderKitty_Built.exe	98
PID 2656 wrote to memory of 2740	2656	ThunderKitty_Built.exe	100
PID 2656 wrote to memory of 2740	2656	ThunderKitty_Built.exe	100
PID 2656 wrote to memory of 3564	2656	ThunderKitty_Built.exe	102
PID 2656 wrote to memory of 3564	2656	ThunderKitty_Built.exe	102
PID 2656 wrote to memory of 4536	2656	ThunderKitty_Built.exe	104
PID 2656 wrote to memory of 4536	2656	ThunderKitty_Built.exe	104
PID 2656 wrote to memory of 2880	2656	ThunderKitty_Built.exe	106
PID 2656 wrote to memory of 2880	2656	ThunderKitty_Built.exe	106
PID 2656 wrote to memory of 2252	2656	ThunderKitty_Built.exe	108
PID 2656 wrote to memory of 2252	2656	ThunderKitty_Built.exe	108
PID 2656 wrote to memory of 1000	2656	ThunderKitty_Built.exe	110
PID 2656 wrote to memory of 1000	2656	ThunderKitty_Built.exe	110
PID 2656 wrote to memory of 1144	2656	ThunderKitty_Built.exe	112
PID 2656 wrote to memory of 1144	2656	ThunderKitty_Built.exe	112
PID 2656 wrote to memory of 2744	2656	ThunderKitty_Built.exe	114
PID 2656 wrote to memory of 2744	2656	ThunderKitty_Built.exe	114

C:\Users\Admin\AppData\Local\Temp\ThunderKitty_Built.exe
"C:\Users\Admin\AppData\Local\Temp\ThunderKitty_Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3452
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM kometa.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:8
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM orbitum.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM centbrowser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3832
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM 7star.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4572
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM sputnik.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2740
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3564
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM epicprivacybrowser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4536
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM uran.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM yandex.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1000
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM iridium.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1144
- C:\Windows\system32\reagentc.exe
  reagentc.exe /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads