Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
22/03/2025, 06:25
General
-
Target
34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9.exe
-
Size
211KB
-
MD5
dfc95dfdc917270aedadb22238d7cae8
-
SHA1
91c80164d7411805c86fa014536fb7d74cab616d
-
SHA256
34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9
-
SHA512
fd97d703d4d57f5bfb38426fec2d343234258c5c8c5559662d6917a8770a7001b8011cfae812cc7aa9ccc5947d4b37db610f459ec58d7602ef55884334e79745
-
SSDEEP
3072:Zp8Lc70UkL/JHt6RpkBzEhE0faKQAc7lGZPHb/5FVuBJ+U53TXbYwEKXFR:ILTr5t6Rpk8E0CZSb1gpEKX
Score
10/10
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9.exe"C:\Users\Admin\AppData\Local\Temp\34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 10842⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.9MB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
6.9MB