stormkitty | 319d78b1aa7153267c5d2a6ecee8d7d02f489c9e8678742b410dd38931c8fea5

Analysis

max time kernel
104s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2025, 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe
Size

6.0MB
MD5

e2e81ef1300b970259e1339287d3125c
SHA1

c8e9f2366df39a7c07621be96a477a3c4debab74
SHA256

319d78b1aa7153267c5d2a6ecee8d7d02f489c9e8678742b410dd38931c8fea5
SHA512

85f68096cb8048c26557733c663f8667478b2d7b8b79f30f9f4bb007b0995fdd09f0c426981526b1dfe05b487c526cef58e310e45e4fde79ac99723e4e99f0fd
SSDEEP

98304:H0zim6BOOUPsZPF27j37dl+adKRF7xzl+qAmXEUydxjGyrrdkXu/SvFJu:UziJO3k5F27j37dsacR/zl+qIU21v1k6

Score

10^/10

stormkitty collection credential_access discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000242d2-27.dat	family_stormkitty
behavioral1/memory/2384-37-0x00000000005A0000-0x00000000005E4000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Uses browser remote debugging 2 TTPs 5 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5980	chrome.exe
4644	chrome.exe
4076	chrome.exe
5312	chrome.exe
5260	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
3112	oldu busefer.exe
2384	tmp401pzhuf.exe

Loads dropped DLL 4 IoCs

pid	Process
3112	oldu busefer.exe
3112	oldu busefer.exe
3112	oldu busefer.exe
3112	oldu busefer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	tmp401pzhuf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	tmp401pzhuf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	tmp401pzhuf.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ipinfo.io
9	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp401pzhuf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4612	cmd.exe
4812	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	tmp401pzhuf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	tmp401pzhuf.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
2384	tmp401pzhuf.exe
5980	chrome.exe
5980	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	tmp401pzhuf.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5980	chrome.exe
5980	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 3112	1852	2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe	87
PID 1852 wrote to memory of 3112	1852	2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe	87
PID 3112 wrote to memory of 3612	3112	oldu busefer.exe	89
PID 3112 wrote to memory of 3612	3112	oldu busefer.exe	89
PID 3612 wrote to memory of 2384	3612	cmd.exe	90
PID 3612 wrote to memory of 2384	3612	cmd.exe	90
PID 3612 wrote to memory of 2384	3612	cmd.exe	90
PID 2384 wrote to memory of 4612	2384	tmp401pzhuf.exe	91
PID 2384 wrote to memory of 4612	2384	tmp401pzhuf.exe	91
PID 2384 wrote to memory of 4612	2384	tmp401pzhuf.exe	91
PID 4612 wrote to memory of 3404	4612	cmd.exe	93
PID 4612 wrote to memory of 3404	4612	cmd.exe	93
PID 4612 wrote to memory of 3404	4612	cmd.exe	93
PID 4612 wrote to memory of 4812	4612	cmd.exe	95
PID 4612 wrote to memory of 4812	4612	cmd.exe	95
PID 4612 wrote to memory of 4812	4612	cmd.exe	95
PID 4612 wrote to memory of 4624	4612	cmd.exe	96
PID 4612 wrote to memory of 4624	4612	cmd.exe	96
PID 4612 wrote to memory of 4624	4612	cmd.exe	96
PID 2384 wrote to memory of 2532	2384	tmp401pzhuf.exe	97
PID 2384 wrote to memory of 2532	2384	tmp401pzhuf.exe	97
PID 2384 wrote to memory of 2532	2384	tmp401pzhuf.exe	97
PID 2532 wrote to memory of 1252	2532	cmd.exe	99
PID 2532 wrote to memory of 1252	2532	cmd.exe	99
PID 2532 wrote to memory of 1252	2532	cmd.exe	99
PID 2532 wrote to memory of 4428	2532	cmd.exe	100
PID 2532 wrote to memory of 4428	2532	cmd.exe	100
PID 2532 wrote to memory of 4428	2532	cmd.exe	100
PID 2384 wrote to memory of 5980	2384	tmp401pzhuf.exe	104
PID 2384 wrote to memory of 5980	2384	tmp401pzhuf.exe	104
PID 5980 wrote to memory of 3724	5980	chrome.exe	105
PID 5980 wrote to memory of 3724	5980	chrome.exe	105
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 1140	5980	chrome.exe	106
PID 5980 wrote to memory of 6124	5980	chrome.exe	107
PID 5980 wrote to memory of 6124	5980	chrome.exe	107

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	tmp401pzhuf.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	tmp401pzhuf.exe

C:\Users\Admin\AppData\Local\Temp\2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Users\Admin\AppData\Local\Temp\onefile_1852_133894180374260150\oldu busefer.exe
  C:\Users\Admin\AppData\Local\Temp\2025-04-18_e2e81ef1300b970259e1339287d3125c_black-basta_cobalt-strike_coinminer_satacom.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp401pzhuf.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\tmp401pzhuf.exe
      C:\Users\Admin\AppData\Local\Temp\tmp401pzhuf.exe
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      outlook_office_path
      outlook_win_path
      PID:2384
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4612
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4812
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2532
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1252
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4428
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5980
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffcabd5dcf8,0x7ffcabd5dd04,0x7ffcabd5dd10
        6⤵
        
        PID:3724
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2052,i,2131758747842819935,11981739190844337347,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2044 /prefetch:2
        6⤵
        
        PID:1140
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2292,i,2131758747842819935,11981739190844337347,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2304 /prefetch:3
        6⤵
        
        PID:6124
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2428,i,2131758747842819935,11981739190844337347,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2648 /prefetch:8
        6⤵
        
        PID:1540
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3256,i,2131758747842819935,11981739190844337347,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3276 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4076
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3280,i,2131758747842819935,11981739190844337347,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3304 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4644
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4388,i,2131758747842819935,11981739190844337347,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4424 /prefetch:2
        6⤵
        Uses browser remote debugging
        
        PID:5312
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4036,i,2131758747842819935,11981739190844337347,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4888 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5260

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
1e3f17448157b2ca0615db09ac60f3bf

SHA1
087dd79e7f93011a217ee4a5fdbf1ea66f825329

SHA256
a7d36d01efb560ca656f0c90c4f57c2596ec86209c69d71d7d57f72c4e6bb789

SHA512
360ee79638ec80aca746d7b02fdb60803752696026638df26299b38b218414e6ca7acb43c339ba98f8eecfb86fd21cae071e1e850bdecd8ea5350fdc79c4c875

Download Submit
C:\Users\Admin\AppData\Local\Temp\181.215.176.43\Browsers\Firefox\FirefoxBookmarks.txt

Filesize
81B

MD5
ea511fc534efd031f852fcf490b76104

SHA1
573e5fa397bc953df5422abbeb1a52bf94f7cf00

SHA256
e5fe7f327ae62df007bd1117aa7f522dbbcd371ec67953f66d786424cb1d7995

SHA512
f7d8e575a2332b0fbd491b5e092b7ed6b0942a5165557fcc5d215d873b05103aa6ba01843133871c1c7ac81b10182a15895be49885c98d1a379dd55f88004fae

Download Submit
C:\Users\Admin\AppData\Local\Temp\181.215.176.43\System\Process.txt

Filesize
4KB

MD5
a1a81e87d9e56d9559cc16e5a07e16ae

SHA1
e32401cbf1b461d66c486d4e8d8c3e25450190e6

SHA256
c27170d1da14e4a19920e90b946c4e9de129cde97c7e5c53e61bb2c2c3723803

SHA512
a0dcca4ca69fca04c9ccb31d9bc6dbd373ec74da0b3c5a9fe915b4b7cda6feb790c7c255023ff8201a06e62604b96dc19ed0d81808ce02ea050cb58247dffa6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1852_133894180374260150\_bz2.pyd

Filesize
83KB

MD5
223fd6748cae86e8c2d5618085c768ac

SHA1
dcb589f2265728fe97156814cbe6ff3303cd05d3

SHA256
f81dc49eac5ecc528e628175add2ff6bda695a93ea76671d7187155aa6326abb

SHA512
9c22c178417b82e68f71e5b7fe7c0c0a77184ee12bd0dc049373eace7fa66c89458164d124a9167ae760ff9d384b78ca91001e5c151a51ad80c824066b8ecce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1852_133894180374260150\_lzma.pyd

Filesize
156KB

MD5
05e8b2c429aff98b3ae6adc842fb56a3

SHA1
834ddbced68db4fe17c283ab63b2faa2e4163824

SHA256
a6e2a5bb7a33ad9054f178786a031a46ea560faeef1fb96259331500aae9154c

SHA512
badeb99795b89bc7c1f0c36becc7a0b2ce99ecfd6f6bb493bda24b8e57e6712e23f4c509c96a28bc05200910beddc9f1536416bbc922331cae698e813cbb50b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1852_133894180374260150\oldu busefer.exe

Filesize
6.1MB

MD5
a254c77d5f97c4c35b91dcdd01a70904

SHA1
3a5a89db5020acf2533b1181dd078d90b36e2645

SHA256
92b50eb6ba29e19ce8854d2be8cc8d3283a112d6327abbd771438071538c06b9

SHA512
5f1c17d8e634bd4ebd1c1dead6c3d5af70996b76da06846478ad5961173cff65a14389ddd74e59aadbc9221f9f89d440cbd4eb8b25ad7526253e74ffa638efb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1852_133894180374260150\python312.dll

Filesize
6.6MB

MD5
3c388ce47c0d9117d2a50b3fa5ac981d

SHA1
038484ff7460d03d1d36c23f0de4874cbaea2c48

SHA256
c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

SHA512
e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1852_133894180374260150\vcruntime140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp401pzhuf.exe

Filesize
245KB

MD5
e6b880d080ab45ef1067a4dbef6c4464

SHA1
375054ec68252e90c57754d26ff40c4662eb01df

SHA256
c1168aaa187fa545c492d1e85f059db8b5ded7c2b1e88f8a2959987e4134843d

SHA512
1d48d9f8faa1af31d278b382ec5cec4e44d1061f22fbe277ae17eafd74aa9986d39410c76354ad5a4fa19931143d38337f8056eea477bb12cd32b49c8356f323

Download Submit
memory/2384-36-0x000000007517E000-0x000000007517F000-memory.dmp

Filesize
4KB

Download
memory/2384-42-0x0000000006A50000-0x0000000006AB6000-memory.dmp

Filesize
408KB

Download
memory/2384-43-0x0000000006B60000-0x0000000006BF2000-memory.dmp

Filesize
584KB

Download
memory/2384-140-0x00000000075B0000-0x0000000007B54000-memory.dmp

Filesize
5.6MB

Download
memory/2384-41-0x0000000005C20000-0x0000000005C32000-memory.dmp

Filesize
72KB

Download
memory/2384-40-0x0000000006060000-0x000000000658C000-memory.dmp

Filesize
5.2MB

Download
memory/2384-39-0x0000000075170000-0x0000000075920000-memory.dmp

Filesize
7.7MB

Download
memory/2384-38-0x00000000050A0000-0x0000000005262000-memory.dmp

Filesize
1.8MB

Download
memory/2384-37-0x00000000005A0000-0x00000000005E4000-memory.dmp

Filesize
272KB

Download
memory/2384-234-0x000000007517E000-0x000000007517F000-memory.dmp

Filesize
4KB

Download
memory/2384-235-0x0000000075170000-0x0000000075920000-memory.dmp

Filesize
7.7MB

Download
memory/2384-251-0x0000000075170000-0x0000000075920000-memory.dmp

Filesize
7.7MB

Download