stormkitty | f1595c959a687081f60a099ac1f703b9790ccbb5148338dd3edfd45afe0f2f70

Resubmissions

03-02-2025 21:25

250203-z94evawjdj 10

03-02-2025 21:24

250203-z89kgatnht 10

03-02-2025 21:18

250203-z5ntlavram 10

Analysis

max time kernel
706s
max time network
716s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
03-02-2025 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

builder.rar
Size

199KB
MD5

aaa701065273bd703907ac0ac4350b9f
SHA1

74922e596033bda4b4dbf3da34bdf3a6f23853f7
SHA256

f1595c959a687081f60a099ac1f703b9790ccbb5148338dd3edfd45afe0f2f70
SHA512

536eaebf05ef9ebca90cfbf4b340316971de9b4feac3a16ddb7c4fd21a23b8306493ec7166c940d96ebdf220d03df345c94f1ca82f2b2bf50803c8c60cb0bf03
SSDEEP

6144:OyYluRi3kas7Dqw1kE/gUR5+JvolcDJWCvMJZl/zdYpY02:heuRZa0Dbgw5+JvkcDIv5epY02

Score

10^/10

stormkitty stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001e00000002aadf-4.dat	family_stormkitty
behavioral1/memory/1304-13-0x00000211F52B0000-0x00000211F52B8000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Executes dropped EXE 1 IoCs

pid	Process
1304	StormKittyBuilder.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3480	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3480	7zFM.exe
Token: 35	3480	7zFM.exe
Token: SeSecurityPrivilege	3480	7zFM.exe
Token: SeDebugPrivilege	1304	StormKittyBuilder.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3480	7zFM.exe
3480	7zFM.exe
3480	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 1304	3480	7zFM.exe	77
PID 3480 wrote to memory of 1304	3480	7zFM.exe	77

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\builder.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\7zO89DC47D7\StormKittyBuilder.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO89DC47D7\StormKittyBuilder.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zO89DC47D7\StormKittyBuilder.exe

Filesize
17KB

MD5
e936b50ab766fb1fdfee7b01b3e4450a

SHA1
6b45ee8349b61604c4007e775e34c8ca45cae16b

SHA256
241b415fdfc53d5c0df654fa70cdf4ddb9df6d5cac6d42e465f521f4321ffdfb

SHA512
d3091a39156bad832f2d9faee22ddc0f3055dc2562f93a0a5ead04938b528c202a9658d02ef3f5b3f2c36f4508b970d815033cb32e18f7098629b105a1fe93b8

Download Submit
memory/1304-12-0x00007FFC49B73000-0x00007FFC49B75000-memory.dmp

Filesize
8KB

Download
memory/1304-13-0x00000211F52B0000-0x00000211F52B8000-memory.dmp

Filesize
32KB

Download
memory/1304-14-0x00007FFC49B73000-0x00007FFC49B75000-memory.dmp

Filesize
8KB

Download
memory/1304-15-0x00007FFC49B70000-0x00007FFC4A632000-memory.dmp

Filesize
10.8MB

Download
memory/1304-16-0x00007FFC49B70000-0x00007FFC4A632000-memory.dmp

Filesize
10.8MB

Download