Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 14:01
General
-
Target
3d5021b656dcb39863d39430a4eddb5d6eb0e177.exe
-
Size
320KB
-
MD5
1b8dac31eb30bd909fadcd9738c832ca
-
SHA1
3d5021b656dcb39863d39430a4eddb5d6eb0e177
-
SHA256
80f34efce3765a4e57c2f333981112bff3788633bd515fa48b6eb16b88113660
-
SHA512
25b02e6ae62add0a550b6c6cf3b1506177012ff94d885f0773fe5a7554d1fee1c96c3f286d6728eae31249eacbfc26d4869633145ba48ff3e6cef54ae8a9e54a
-
SSDEEP
6144:3m/Q1Q5Ng68j/svmHC40+XIzFUygWK0tWrcBOvv:3m/Q6P8j/svm1TXI5tZB
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 3 IoCs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d5021b656dcb39863d39430a4eddb5d6eb0e177.exe"C:\Users\Admin\AppData\Local\Temp\3d5021b656dcb39863d39430a4eddb5d6eb0e177.exe"1⤵
- Accesses Microsoft Outlook profiles
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
266KB
MD599c63f34188b219e4d21cd0dd6768b10
SHA160d2e34b14817f385abf34c3421fd7a3e4811440
SHA2561596227a61be1838c5b4ccc1cff382385ff44c17b7499a4d8d8adfa5c8d611c4
SHA51277544cb93e0f3e64ecc56d432afe42457cc767699641ca367ab1ffd1c4993c256db693c51c7a23b68feb1e1b813b3b88149dcf91f8bb1f0a7e45655c614be824
-
Filesize
821KB
MD54b8b73047d541673e491a1f139c7659f
SHA1290fcebb99601a24c55528770377322861c7f483
SHA2565278837b7ffb410a3c6b170c03f69c4e98e8a72b03f8e2effa320fec0ce067f5
SHA512451763e43f0549d55c335c556ed2fb0b06c8363c372dce576296e25d73c71df9268a0e8787db468fd1b09f4500ef8de578cdbbb542803c14638918236862c881
-
Filesize
844KB
MD550823f0776c7291b25d82f69fd53cbc6
SHA171d833fc9221df869695f99b5e4db166f2192648
SHA256b2163fc4de41dfa07ddde464f275c2f9787d41bcbfe760f70cdfabccd5ae7d42
SHA5125240b57165a483fc8ad6542f1dca3e3f1c5b87c7d574a9bc2e03bfe0157130831eb5f038271d5e2e1628b4859d8dd45951fd18ac91248ee62a7ec046766f69bc
-
Filesize
579KB
MD5923be8de1e5262d4603f8ca587af6977
SHA1eaa0ad1f2d861191250a1bd6ef140d1ac5c49c8b
SHA2569e67df3fd74b650861701c52608e1039e918e58b9c31800b847f89eeb3affd58
SHA512537dc6789a6e2302dc9507c334b62e736f1e8dd8b59751f3dde1aa8f2cc2317541f6494279d0a19edddd3f833f8be4f1c25f31062867be92d4421a3d6ea09fa3
-
Filesize
325KB
MD5060f8e49bcadc78475aebe351e6cee6b
SHA1bad77ec4416209d25ddfd4716d498e87077d1629
SHA2564f3559bb6e1fe308352520b2e39d8c91f5a06c1ea9431463dbfac3eedecf3dbd
SHA5121176e65c2c76a7c022c0d39d70ad7279b5a536578d1e929b78281691a6c14d99597cf88d5d1018a385cc86c7a005030a89b00bdd889d4234373b85c68136c7bf
-
Filesize
468KB
MD5e607f0778d69450f125ddc35d97a72f2
SHA1b53cf5df913ff51c5f86d1972674557a4aaa7a9f
SHA256168f5924e6b4cced29f436b47adba675fbfaa9d954d1978e3be202c6a268a425
SHA512f2b22b7491929ba095d1ed998fccc8ea3239883457683e9cc4cd498e7708cf5ec37b32204d038a287d23b746330e48d7d7a2158baac96f344b55718c6439fbd8
-
Filesize
269KB
MD544a9807c8ee49233a4a262ac3fe9eaab
SHA16bbdf28a2d1c8d386ab2e316779632d48661e188
SHA256cd8bf116b9686803f691f4adf0aa39584ef9e4858966b1f36ef74b696560307d
SHA512f2a08546f8b477d4dcb8f129ba93e166b3cfbbce40d0e534eb133fb8e020fe0b478a151560da7dc4109938878d9f6021e73ba1ebc70097e8d7377ad6288a2395
-
Filesize
553KB
MD5a4513e109dd885cc5018a352bf8016f3
SHA1cf3a4b3f5d500314f856931e4e35647081ab7f2f
SHA25625725356b246c0e32ecdc6c1de19d6dcb3139d40d54214be8c2b525e7b608791
SHA512f11449bf59a0bf898d925c6b9f429dc49aa1be9fc9e16d91b6f1886292b196418f220efb3b037b0213ec15c4e4d314d914773c6b32762a0bca77d776dd6d6983
-
Filesize
1.0MB
MD55859e010b15d6739b5aba061c6a50475
SHA1d450f1d2001d28aba8fc31236a7d1b89f2d1ea17
SHA2563344669ccd4f999678d9925637f5f7f081cc71c1b8dfdab1cbccc39c493b7453
SHA512eedd32d98321cd0e1bf3abc887446a311ff4aab385ac9073919949c7e0d505757c7b77475a0b0624d31555d3042232047e34027dc74fbf890975c58e3a13caff
-
Filesize
4KB
MD5129c9e4553b68a6a7b620343f3a30995
SHA170ac472a4d80c9d314af9e2c892ff431305efcb9
SHA256bfd039928d6dfef91fb76b3e1ccbc8aa596839f9ce3cbbebfe66501f30208d55
SHA51257bd26fecca7d429d915db44a8a76228d5a69860c001982efe90f6d6a0ff3cfe2d12630fa8266b112cedf5c65228816d1e9983bd731d58bba9eec766da413b11
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
344KB
-
Filesize
7.7MB
-
Filesize
7.7MB
