Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/03/2025, 06:16
General
-
Target
c16c4b10a70fb5dd4c12a0d9ccc26a2330d75c5cb94684d4fc5e0ce499a1925e.exe
-
Size
106KB
-
MD5
12629c3cf0eaec0c28145377847d6931
-
SHA1
57d72fa3db1d6a67dc6fea8c8b87922b73e334f0
-
SHA256
c16c4b10a70fb5dd4c12a0d9ccc26a2330d75c5cb94684d4fc5e0ce499a1925e
-
SHA512
9fe5e7ac07f64176c84b11f8bf4f0d5b574740844f32e476b4d0988b908032f16fb857e5102f6ef2dfced3fcfc23f2efcb483839009a6e83e850ff5df6cde0c7
-
SSDEEP
1536:U7YfZJRZk79wZn8nESiIkD2V37AUIuvQ7sG69bAdI4pxReUbpJp6bDQx:U+RZk7WZnc4YOWQ7sR9bGpxReUbpJD
Score
10/10
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c16c4b10a70fb5dd4c12a0d9ccc26a2330d75c5cb94684d4fc5e0ce499a1925e.exe"C:\Users\Admin\AppData\Local\Temp\c16c4b10a70fb5dd4c12a0d9ccc26a2330d75c5cb94684d4fc5e0ce499a1925e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB