0da67f4bffe1d30feabc5d784579dd119f131ae2380327d3fc32dd17aedba1f9

Analysis

max time kernel
92s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
19/12/2024, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ThunderKitty_Built.exe
Size

9.7MB
MD5

6fac67027fa756d82665d69627f21cd4
SHA1

cd62b5622a58f88c9a62dfa68804b1017d312f6e
SHA256

0da67f4bffe1d30feabc5d784579dd119f131ae2380327d3fc32dd17aedba1f9
SHA512

a5bbb300aaf508165e7da51d64fe54ccd4fc62401c9339444254bf05012b9dc4071c3cd6ed7651d094feced705bc9bbf601d182353d167b1e9be09c27dcedb35
SSDEEP

98304:v9Rjwt5p24UX+fgIhC+XP1chzKEuVSjMAh80q:V/WxP1clXd8D

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Kills process with taskkill 15 IoCs

evasion

pid	Process
960	taskkill.exe
2036	taskkill.exe
1964	taskkill.exe
4780	taskkill.exe
2704	taskkill.exe
3100	taskkill.exe
2836	taskkill.exe
3440	taskkill.exe
3992	taskkill.exe
3080	taskkill.exe
956	taskkill.exe
1436	taskkill.exe
4988	taskkill.exe
4044	taskkill.exe
4068	taskkill.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	taskkill.exe
Token: SeDebugPrivilege	960	taskkill.exe
Token: SeDebugPrivilege	2704	taskkill.exe
Token: SeDebugPrivilege	3080	taskkill.exe
Token: SeDebugPrivilege	956	taskkill.exe
Token: SeDebugPrivilege	1436	taskkill.exe
Token: SeDebugPrivilege	3100	taskkill.exe
Token: SeDebugPrivilege	2036	taskkill.exe
Token: SeDebugPrivilege	2836	taskkill.exe
Token: SeDebugPrivilege	3440	taskkill.exe
Token: SeDebugPrivilege	4044	taskkill.exe
Token: SeDebugPrivilege	4068	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	3992	taskkill.exe
Token: SeDebugPrivilege	4780	taskkill.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 4988	3264	ThunderKitty_Built.exe	78
PID 3264 wrote to memory of 4988	3264	ThunderKitty_Built.exe	78
PID 3264 wrote to memory of 960	3264	ThunderKitty_Built.exe	81
PID 3264 wrote to memory of 960	3264	ThunderKitty_Built.exe	81
PID 3264 wrote to memory of 2704	3264	ThunderKitty_Built.exe	83
PID 3264 wrote to memory of 2704	3264	ThunderKitty_Built.exe	83
PID 3264 wrote to memory of 3080	3264	ThunderKitty_Built.exe	85
PID 3264 wrote to memory of 3080	3264	ThunderKitty_Built.exe	85
PID 3264 wrote to memory of 956	3264	ThunderKitty_Built.exe	87
PID 3264 wrote to memory of 956	3264	ThunderKitty_Built.exe	87
PID 3264 wrote to memory of 1436	3264	ThunderKitty_Built.exe	89
PID 3264 wrote to memory of 1436	3264	ThunderKitty_Built.exe	89
PID 3264 wrote to memory of 3100	3264	ThunderKitty_Built.exe	91
PID 3264 wrote to memory of 3100	3264	ThunderKitty_Built.exe	91
PID 3264 wrote to memory of 2036	3264	ThunderKitty_Built.exe	93
PID 3264 wrote to memory of 2036	3264	ThunderKitty_Built.exe	93
PID 3264 wrote to memory of 2836	3264	ThunderKitty_Built.exe	95
PID 3264 wrote to memory of 2836	3264	ThunderKitty_Built.exe	95
PID 3264 wrote to memory of 3440	3264	ThunderKitty_Built.exe	97
PID 3264 wrote to memory of 3440	3264	ThunderKitty_Built.exe	97
PID 3264 wrote to memory of 4044	3264	ThunderKitty_Built.exe	99
PID 3264 wrote to memory of 4044	3264	ThunderKitty_Built.exe	99
PID 3264 wrote to memory of 4068	3264	ThunderKitty_Built.exe	101
PID 3264 wrote to memory of 4068	3264	ThunderKitty_Built.exe	101
PID 3264 wrote to memory of 1964	3264	ThunderKitty_Built.exe	103
PID 3264 wrote to memory of 1964	3264	ThunderKitty_Built.exe	103
PID 3264 wrote to memory of 3992	3264	ThunderKitty_Built.exe	105
PID 3264 wrote to memory of 3992	3264	ThunderKitty_Built.exe	105
PID 3264 wrote to memory of 4780	3264	ThunderKitty_Built.exe	107
PID 3264 wrote to memory of 4780	3264	ThunderKitty_Built.exe	107
PID 3264 wrote to memory of 4376	3264	ThunderKitty_Built.exe	109
PID 3264 wrote to memory of 4376	3264	ThunderKitty_Built.exe	109

C:\Users\Admin\AppData\Local\Temp\ThunderKitty_Built.exe
"C:\Users\Admin\AppData\Local\Temp\ThunderKitty_Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4988
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:960
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3080
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM kometa.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:956
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM orbitum.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM centbrowser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3100
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM 7star.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2036
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM sputnik.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3440
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM epicprivacybrowser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4044
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4068
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM uran.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM yandex.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3992
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM iridium.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4780
- C:\Windows\system32\reagentc.exe
  reagentc.exe /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:4376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads