stormkitty | f1595c959a687081f60a099ac1f703b9790ccbb5148338dd3edfd45afe0f2f70

Resubmissions

03-02-2025 21:25

250203-z94evawjdj 10

03-02-2025 21:24

250203-z89kgatnht 10

03-02-2025 21:18

250203-z5ntlavram 10

Analysis

max time kernel
91s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
03-02-2025 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

builder.rar
Size

199KB
MD5

aaa701065273bd703907ac0ac4350b9f
SHA1

74922e596033bda4b4dbf3da34bdf3a6f23853f7
SHA256

f1595c959a687081f60a099ac1f703b9790ccbb5148338dd3edfd45afe0f2f70
SHA512

536eaebf05ef9ebca90cfbf4b340316971de9b4feac3a16ddb7c4fd21a23b8306493ec7166c940d96ebdf220d03df345c94f1ca82f2b2bf50803c8c60cb0bf03
SSDEEP

6144:OyYluRi3kas7Dqw1kE/gUR5+JvolcDJWCvMJZl/zdYpY02:heuRZa0Dbgw5+JvkcDIv5epY02

Score

10^/10

stormkitty stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001900000002ab0a-10.dat	family_stormkitty
behavioral1/memory/2828-13-0x000002036FB30000-0x000002036FB38000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Executes dropped EXE 2 IoCs

pid	Process
2828	StormKittyBuilder.exe
1976	StormKittyBuilder.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3152	7zFM.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	3152	7zFM.exe
Token: 35	3152	7zFM.exe
Token: SeSecurityPrivilege	3152	7zFM.exe
Token: SeDebugPrivilege	2828	StormKittyBuilder.exe
Token: SeDebugPrivilege	1976	StormKittyBuilder.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3152	7zFM.exe
3152	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\builder.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3152

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4520

C:\Users\Admin\Desktop\1\StormKittyBuilder.exe
"C:\Users\Admin\Desktop\1\StormKittyBuilder.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2828

C:\Users\Admin\Desktop\1\StormKittyBuilder.exe
"C:\Users\Admin\Desktop\1\StormKittyBuilder.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\StormKittyBuilder.exe.log

Filesize
847B

MD5
2c04560db693aebddcc027d8a7553e63

SHA1
d804b198d631c9386706a651f5bf8202b10d0a3b

SHA256
920855f7a9bc35f8d68707e69361cb8e8040c864403100cf0a97f9c6b34c8ba1

SHA512
1a16e737a1953ecfe64c338bc44503f02fa114828ded82f56637489d9d1a87c71c69ef280b20b80b66ab2e8e1be9792d735fb2bb293cac74d47351f30ab29b07

Download Submit
C:\Users\Admin\Desktop\1\StormKittyBuilder.exe

Filesize
17KB

MD5
e936b50ab766fb1fdfee7b01b3e4450a

SHA1
6b45ee8349b61604c4007e775e34c8ca45cae16b

SHA256
241b415fdfc53d5c0df654fa70cdf4ddb9df6d5cac6d42e465f521f4321ffdfb

SHA512
d3091a39156bad832f2d9faee22ddc0f3055dc2562f93a0a5ead04938b528c202a9658d02ef3f5b3f2c36f4508b970d815033cb32e18f7098629b105a1fe93b8

Download Submit
memory/2828-13-0x000002036FB30000-0x000002036FB38000-memory.dmp

Filesize
32KB

Download
memory/2828-12-0x00007FFF16B93000-0x00007FFF16B95000-memory.dmp

Filesize
8KB

Download
memory/2828-14-0x00007FFF16B90000-0x00007FFF17652000-memory.dmp

Filesize
10.8MB

Download
memory/2828-16-0x00007FFF16B90000-0x00007FFF17652000-memory.dmp

Filesize
10.8MB

Download