stormkitty | 8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a

General

Target

8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe
Size

320KB
MD5

f71e90cbe5a122796864f70feba51a50
SHA1

b63521622fbd176baddf513e2eb191f655880bca
SHA256

8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a
SHA512

001e5b02b5f28b2e9d8cff0baedbd5c21aa6da19f41629037438d39dcfdb6b1322c50571cb7a8fade72ed284d411919a6db319120c1d127df8488de95f7fd12f
SSDEEP

6144:Wm/Q1Q5Ng68j/svmHC40+XIzFUygWK0tWrcBOvJ:Wm/Q6P8j/svm1TXI5tZB

Score

10^/10

stormkitty collection discovery spyware stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/1748-1-0x0000000000B10000-0x0000000000B66000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\XPAJOTIY\FileGrabber\Documents\desktop.ini	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ip-api.com
22	api.ipify.org
23	api.ipify.org
4	freegeoip.app
8	freegeoip.app
18	api.ipify.org
19	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1748	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe
1748	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe
1748	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe
1748	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe
1748	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe
1748	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe

C:\Users\Admin\AppData\Local\Temp\8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe
"C:\Users\Admin\AppData\Local\Temp\8bd6fcaf589fc2aa0724dbee715075119547480ed155025a10da750e8f07dc8a.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\XPAJOTIY\FileGrabber\Desktop\DenyBackup.pptx

Filesize
1.3MB

MD5
235ceebb853e2c07a444c756170b0475

SHA1
aa6da835eeaca2a13c707bcc88289db8b511faab

SHA256
1910d7bcf694cc746d9a82717ff0fa6198c91ef2eb9c028ae35c7cef6f8a02ff

SHA512
cd473b57fddd6af14be0eb9706b03b10ed4945b2db99e249d6d3d39ae855dbd9a81cc6ebcc6580179e85028b05e1553fdf815dbab56a39406bfe79f9b917f543

Download Submit
C:\Users\Admin\AppData\Local\XPAJOTIY\FileGrabber\Documents\RestoreRevoke.doc

Filesize
1.2MB

MD5
db04d700e7bc26e713b73e723f611fd7

SHA1
0a09670576a6381424ff25a591487bd0923616f0

SHA256
e55329e3def04628a16461566e3fa45e814aac2cd4a13be8916cb9862a449756

SHA512
312fc88e1e43c9bfa29ae7b357352eb8dc3f7527cfa0b523f73da5cb52ac1026ea39f7f8b9b4c3bc8317d861e1475802af46970252c38089bc976c54dfd4e73a

Download Submit
C:\Users\Admin\AppData\Local\XPAJOTIY\FileGrabber\Downloads\AssertRevoke.rtf

Filesize
600KB

MD5
48ed4cb57ec940ae829967e0dc452f74

SHA1
29483e1e2ff1a92b6d85d71c1e4e4580782543e9

SHA256
6670d0d71ebef45b8c0eb33d9a3b50e8cedc077110e9e196b81b4623970f5211

SHA512
9c905b846b4a0e88ebe08cbd79739f6b867c4b8f545a33d0921cacbab9a578c3cb08e3f11c3d6afe7f57cab04bd3ee896baa4ca50f38dac7a01da09126af669c

Download Submit
C:\Users\Admin\AppData\Local\XPAJOTIY\FileGrabber\Downloads\ConfirmSearch.xlsx

Filesize
1.0MB

MD5
db650399c5e0acebacc03cd551076a10

SHA1
dc3327f11c971426640ef892933904559ca1d02d

SHA256
4ade7ff023eaf6b7e65edd290b6d8cb90e5733ea00f641f066c36a29f10cd347

SHA512
de9636199b34fcc0e1b615eba24198f17b094277503fdaf5d423159b72d1d642485fab1a2a0a59a8099268db7d511526a2c035f2d5d5f23bbe1e6979b5e4ff25

Download Submit
C:\Users\Admin\AppData\Local\XPAJOTIY\FileGrabber\Pictures\CompareConnect.png

Filesize
1.6MB

MD5
64f93788d8de983a42d6db7b9eed297c

SHA1
7d523a1164d535b0113763b1041d879f26a53976

SHA256
318e189edce91654c30b87060890a9ddb35bde9e13cd95d5aedafdfc7223d0a8

SHA512
2b74678b5caa93307145d9015e9524687eb471e73d23ddd4fae43a54a77838420828a49f14346a4f5bc990888d9421bae6977184af693546281ee0e8ae86b78b

Download Submit
memory/1748-0-0x0000000074C4E000-0x0000000074C4F000-memory.dmp

Filesize
4KB

Download
memory/1748-1-0x0000000000B10000-0x0000000000B66000-memory.dmp

Filesize
344KB

Download
memory/1748-2-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download
memory/1748-122-0x0000000074C4E000-0x0000000074C4F000-memory.dmp

Filesize
4KB

Download
memory/1748-123-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download
memory/1748-139-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing