stormkitty | 319d78b1aa7153267c5d2a6ecee8d7d02f489c9e8678742b410dd38931c8fea5

Analysis

max time kernel
0s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2025, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe
Size

6.0MB
MD5

e2e81ef1300b970259e1339287d3125c
SHA1

c8e9f2366df39a7c07621be96a477a3c4debab74
SHA256

319d78b1aa7153267c5d2a6ecee8d7d02f489c9e8678742b410dd38931c8fea5
SHA512

85f68096cb8048c26557733c663f8667478b2d7b8b79f30f9f4bb007b0995fdd09f0c426981526b1dfe05b487c526cef58e310e45e4fde79ac99723e4e99f0fd
SSDEEP

98304:H0zim6BOOUPsZPF27j37dl+adKRF7xzl+qAmXEUydxjGyrrdkXu/SvFJu:UziJO3k5F27j37dsacR/zl+qIU21v1k6

Score

10^/10

stormkitty credential_access discovery stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000700000002412b-27.dat	family_stormkitty
behavioral1/memory/628-37-0x0000000000810000-0x0000000000854000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Uses browser remote debugging 2 TTPs 5 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5284	chrome.exe
5924	chrome.exe
4952	chrome.exe
1076	chrome.exe
1152	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
5152	oldu busefer.exe
628	tmpxsfaqb0u.exe

Loads dropped DLL 4 IoCs

pid	Process
5152	oldu busefer.exe
5152	oldu busefer.exe
5152	oldu busefer.exe
5152	oldu busefer.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ipinfo.io
5	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpxsfaqb0u.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2824	netsh.exe
5556	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 5152	2264	2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe	88
PID 2264 wrote to memory of 5152	2264	2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe	88
PID 5152 wrote to memory of 1080	5152	oldu busefer.exe	90
PID 5152 wrote to memory of 1080	5152	oldu busefer.exe	90
PID 1080 wrote to memory of 628	1080	cmd.exe	91
PID 1080 wrote to memory of 628	1080	cmd.exe	91
PID 1080 wrote to memory of 628	1080	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\onefile_2264_133894177973716950\oldu busefer.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmpxsfaqb0u.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\tmpxsfaqb0u.exe
      C:\Users\Admin\AppData\Local\Temp\tmpxsfaqb0u.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:628
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5556
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3764
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2824
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        6⤵
        
        PID:3880
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        5⤵
        
        PID:4260
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2488
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        6⤵
        
        PID:3608
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        
        PID:1152
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff78ffdcf8,0x7fff78ffdd04,0x7fff78ffdd10
        6⤵
        
        PID:1056
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2056,i,4359385754201680105,2439707326724626427,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2052 /prefetch:2
        6⤵
        
        PID:1828
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2100,i,4359385754201680105,2439707326724626427,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2220 /prefetch:3
        6⤵
        
        PID:4272
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2412,i,4359385754201680105,2439707326724626427,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2488 /prefetch:8
        6⤵
        
        PID:6132
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3256,i,4359385754201680105,2439707326724626427,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3304 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4952
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3308,i,4359385754201680105,2439707326724626427,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3348 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5284
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4412,i,4359385754201680105,2439707326724626427,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4440 /prefetch:2
        6⤵
        Uses browser remote debugging
        
        PID:5924
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4568,i,4359385754201680105,2439707326724626427,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4844 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:1076

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
db04e452f92d0127ca377943ceb0cdb7

SHA1
838d7d74ef5850533da22eb0865b00a9e9dc4aa0

SHA256
8dfeeaebf51b1411c3262c09b62b147d9894cb534bc41987c39094e6cd205577

SHA512
2acd5e96def8680884d5ee986a6b14911d1ff0dd53ff48964ea356c42301d72aed05cc8dbd34eb9b3371b37899fba60e46bb4a8a5d356213fe8590ad025005f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\181.215.176.43\Browsers\Firefox\FirefoxBookmarks.txt

Filesize
81B

MD5
ea511fc534efd031f852fcf490b76104

SHA1
573e5fa397bc953df5422abbeb1a52bf94f7cf00

SHA256
e5fe7f327ae62df007bd1117aa7f522dbbcd371ec67953f66d786424cb1d7995

SHA512
f7d8e575a2332b0fbd491b5e092b7ed6b0942a5165557fcc5d215d873b05103aa6ba01843133871c1c7ac81b10182a15895be49885c98d1a379dd55f88004fae

Download Submit
C:\Users\Admin\AppData\Local\Temp\181.215.176.43\System\Process.txt

Filesize
4KB

MD5
c509e2fb1fd8b7a5b2197cc8be5d2ba6

SHA1
1a171b57deff1b45a2ce4cf4c0d0edffd7032ebb

SHA256
3bbdbdd935420867460192781666025ef9e76d6ce46d58925fd32d32e518dee6

SHA512
43280bb91f64431c1cdf1a1278c05b73dbfcc76725741f5bb3c4aacb66cf6fc130fddba9ecce76931dad16158c09351b781084f8ee79614b9da64f77dbd3d4cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2264_133894177973716950\_bz2.pyd

Filesize
83KB

MD5
223fd6748cae86e8c2d5618085c768ac

SHA1
dcb589f2265728fe97156814cbe6ff3303cd05d3

SHA256
f81dc49eac5ecc528e628175add2ff6bda695a93ea76671d7187155aa6326abb

SHA512
9c22c178417b82e68f71e5b7fe7c0c0a77184ee12bd0dc049373eace7fa66c89458164d124a9167ae760ff9d384b78ca91001e5c151a51ad80c824066b8ecce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2264_133894177973716950\_lzma.pyd

Filesize
156KB

MD5
05e8b2c429aff98b3ae6adc842fb56a3

SHA1
834ddbced68db4fe17c283ab63b2faa2e4163824

SHA256
a6e2a5bb7a33ad9054f178786a031a46ea560faeef1fb96259331500aae9154c

SHA512
badeb99795b89bc7c1f0c36becc7a0b2ce99ecfd6f6bb493bda24b8e57e6712e23f4c509c96a28bc05200910beddc9f1536416bbc922331cae698e813cbb50b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2264_133894177973716950\oldu busefer.exe

Filesize
6.1MB

MD5
a254c77d5f97c4c35b91dcdd01a70904

SHA1
3a5a89db5020acf2533b1181dd078d90b36e2645

SHA256
92b50eb6ba29e19ce8854d2be8cc8d3283a112d6327abbd771438071538c06b9

SHA512
5f1c17d8e634bd4ebd1c1dead6c3d5af70996b76da06846478ad5961173cff65a14389ddd74e59aadbc9221f9f89d440cbd4eb8b25ad7526253e74ffa638efb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2264_133894177973716950\python312.dll

Filesize
6.5MB

MD5
85032a65301eed96bbdf434203c88d2a

SHA1
3c65f70566671fc393d682f4cde87995d7d61cbb

SHA256
4c46005ec4d771698920eede4828f23b55dd16d03d88c8a1f0600ace3485deed

SHA512
05e95e8530642ad8a88efab8d5be060c61092ed41329bd48731e419d6dccca96add3bb9482a5d4fd9cc4921d57e3c6d627d8fc50ef364c6ad9cd7ffe03441a3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2264_133894177973716950\python312.dll

Filesize
5.9MB

MD5
016b51ece001072463b4824ee23c9912

SHA1
bf48928d5174925c50a8bc7873f19a5abe4b73fb

SHA256
824e2da8b393baeadc2cbf3c691444c837b5efff98efd06ac6ce800990abcea9

SHA512
03269fcfce708e61d2db163e5197c65bed38265866785e05312f5e6577e2c34f5f642b2d486f20fd978a1d48f52f763c16407c471ae9057a9f8b688923d5d55f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2264_133894177973716950\vcruntime140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpxsfaqb0u.exe

Filesize
245KB

MD5
e6b880d080ab45ef1067a4dbef6c4464

SHA1
375054ec68252e90c57754d26ff40c4662eb01df

SHA256
c1168aaa187fa545c492d1e85f059db8b5ded7c2b1e88f8a2959987e4134843d

SHA512
1d48d9f8faa1af31d278b382ec5cec4e44d1061f22fbe277ae17eafd74aa9986d39410c76354ad5a4fa19931143d38337f8056eea477bb12cd32b49c8356f323

Download Submit
memory/628-38-0x0000000005340000-0x0000000005502000-memory.dmp

Filesize
1.8MB

Download
memory/628-42-0x0000000006CC0000-0x0000000006D26000-memory.dmp

Filesize
408KB

Download
memory/628-43-0x0000000006DD0000-0x0000000006E62000-memory.dmp

Filesize
584KB

Download
memory/628-139-0x0000000007820000-0x0000000007DC4000-memory.dmp

Filesize
5.6MB

Download
memory/628-41-0x0000000005E90000-0x0000000005EA2000-memory.dmp

Filesize
72KB

Download
memory/628-40-0x00000000062A0000-0x00000000067CC000-memory.dmp

Filesize
5.2MB

Download
memory/628-39-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/628-37-0x0000000000810000-0x0000000000854000-memory.dmp

Filesize
272KB

Download
memory/628-36-0x00000000746DE000-0x00000000746DF000-memory.dmp

Filesize
4KB

Download
memory/628-235-0x00000000746DE000-0x00000000746DF000-memory.dmp

Filesize
4KB

Download
memory/628-236-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/628-252-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads