Analysis
-
max time kernel
93s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-01-2025 02:55
General
-
Target
80f34efce3765a4e57c2f333981112bff3788633bd515fa48b6eb16b88113660.exe
-
Size
320KB
-
MD5
1b8dac31eb30bd909fadcd9738c832ca
-
SHA1
3d5021b656dcb39863d39430a4eddb5d6eb0e177
-
SHA256
80f34efce3765a4e57c2f333981112bff3788633bd515fa48b6eb16b88113660
-
SHA512
25b02e6ae62add0a550b6c6cf3b1506177012ff94d885f0773fe5a7554d1fee1c96c3f286d6728eae31249eacbfc26d4869633145ba48ff3e6cef54ae8a9e54a
-
SSDEEP
6144:3m/Q1Q5Ng68j/svmHC40+XIzFUygWK0tWrcBOvv:3m/Q6P8j/svm1TXI5tZB
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 4 IoCs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\80f34efce3765a4e57c2f333981112bff3788633bd515fa48b6eb16b88113660.exe"C:\Users\Admin\AppData\Local\Temp\80f34efce3765a4e57c2f333981112bff3788633bd515fa48b6eb16b88113660.exe"1⤵
- Accesses Microsoft Outlook profiles
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
1.0MB
MD5ce4d3ee1547060355ddac8ebf1cab692
SHA1577a1df852228dac2e7a423117417a038185d478
SHA256b9d00e6de4f004e0f7911358f5b63c5e61b76dc32b4cb516dea17ba95a435c9d
SHA512950ebb795cc2f8116d5467734561a444fd88fb6ee5037c4ef84a6e623fa9e7e8e72d07afdb2985f0af8ea127dba67fd3793792062e30c09d4a91901d2c64cb48
-
Filesize
480KB
MD57dee088030a392c36dbd415cd21a5beb
SHA1f7a6120265b7c430983d9c4ec3b86d049e5f93bf
SHA256b7d07fb87f5dcbe7cf7d4e21047eb8718971227c9addb3c26e21597e7c2ee456
SHA51248e73c6bd9456af3e5c2d7932e042b7cda0c694a2fea9096dcca6e63321259308c7508abef8ed3c495285577f920baa5754bb9519bec0dc7a1d38810a72ca002
-
Filesize
715KB
MD5515e99839f179b491afcf012256211aa
SHA1998d5a6b09b3c837ab4e7ce746a1230b94bc76eb
SHA256bcb5b7779ad90305250c0a1f713e6d10d9404937950c74a555379d90051a86e4
SHA512ab9e9a99bde670a1e73d60a1d16a16495dd4fc4772ab574f23e8495c1148c680ce187f4b63d933be79b87c2b574c4b0df3e27816a9fbd5b17498b30ea046ec58
-
Filesize
605KB
MD5d093b070c850bd3cfc3ddb45da91397f
SHA1c022b0ca64ac75e9feb598b6cc5b7cf2a299b5b0
SHA2565a768b783154a8d314c906e72cfc09e7ad26f8862ec17860515c484774f500da
SHA51276a93e57e111d71eaeba38b5c2cfbb6eaf060d06b340433701df7a4c2887ea76a2af21e0c04e0cd26e8620045e60d36821f22bb6ee457284f34b4a9247b739e1
-
Filesize
637KB
MD53991e5ba9bb16454702158c6f7db716f
SHA1ae019a398a9e7d7b072dfce1a7376ea7644ec0f4
SHA2564b99fdec8a66a823011344792f4bbfc12fdd53090086956ea6ad33d92f164f5d
SHA5125af378408d6a3e413f73e0c8754f0b37c8673d70182049359b1c09acaaf4d927ddf577b58a8966ba62b9fca1f9cc93a67007ce0eafc9347a8c41b44964ee238b
-
Filesize
872KB
MD5e1db786840203515f971830f2964655a
SHA1fad4c3cc90367d5ae0fb28a53525ed75a793b558
SHA25660cc5f9f8397111163ba46ab51b1718c04576531aa0475fa16ebb429872490dd
SHA5123ef50514ed13d102e80b551f80382ed97ab76ce04b903bfa606a785c06ce70186264d0fea326028217dd8389b731922303d2cfec82232a03514acad28d824e74
-
Filesize
562KB
MD525495285806ad4b681b834ea9fc49cb1
SHA1dbe096c6f2f5d44210e22ee5bd20f7e822d519a4
SHA256b05bce41239cd8e80e0768272f60a425c0c880891092777c484bb83504875c91
SHA512b5656fbc1e35a996987618209996675da064de7e0c53bd206799d4c4974f21d58d2b9fb1631d750fe9fdd43ec160c1a587bbef33f8cb4c0c38129c5b7efe522a
-
Filesize
4KB
MD5ab1e2d4a7ea22e80b55cc29254182153
SHA1f4a209ec595f3d9d59549140762c057f18579df9
SHA256a5feb6851518c84920ca7111e9f6330a1a74ab3f84dbf7fc514f31a1f88848b4
SHA51263889e9ecd253b020f240cbe24a5aa834c327147efebd5d40283a3c75745344b3a255211b9c01e8ebb56ff9f19194314ea03d97cc8f48d6d2cb3eb22dee5e1d3
-
Filesize
408KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
344KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
