ducktail | Storm[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Storm.exe
Size 250.4MB
Sample260517-lknffaas7p
SHA256 2b639b9ca2263cd3686f738f9bf3b449b995baa2f9e21f59c8a4b8c94f3a2c26
MD5 dcbb7d83d6a662a63e41689c4b0f46a3
SHA1 3a9aceee545c44dc5dcfdaaf00370c26979dbe3a
SHA512 97f7bfaa2a09a5f3f2e5c08020bb249572e497dc916bdca58b426bdb9ae30d408259d24ef3436fb8a155cfa8d4f5bb932c8d4ed201385713500c99aff97ae396
SSDEEP 1572864:GijRG8MvYUFJTSs24qp5VJS2FjzcAgiMIIS7VwxK5trS5pOCNiw:9fMvbJTSL5VU2N0RSx6r
TLSH
T1C8C8AE06E3E81599D27BC27883779663E671BC564320C5DF0194FA692F73BC0BA36722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer ducktail

Malware Config

Signatures

Family: Ducktail
Ducktail is a single file deployment stealer written in C#.
stealer ducktail

Detect Ducktail Third Stage Payload 1 IoCs

resource	yara_rule
sample	ducktail_3rd_stage

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Storm.exe

File Explorer

Storm.exe

.exe 250.4MB

Storm.exe

IMPHASH 25f4444e0f8d2a8ae40cbacacc252543
SHA256 2b639b9ca2263cd3686f738f9bf3b449b995baa2f9e21f59c8a4b8c94f3a2c26
MD5 dcbb7d83d6a662a63e41689c4b0f46a3
SHA1 3a9aceee545c44dc5dcfdaaf00370c26979dbe3a
SHA512 97f7bfaa2a09a5f3f2e5c08020bb249572e497dc916bdca58b426bdb9ae30d408259d24ef3436fb8a155cfa8d4f5bb932c8d4ed201385713500c99aff97ae396
SSDEEP 1572864:GijRG8MvYUFJTSs24qp5VJS2FjzcAgiMIIS7VwxK5trS5pOCNiw:9fMvbJTSL5VU2N0RSx6r
TLSH
T1C8C8AE06E3E81599D27BC27883779663E671BC564320C5DF0194FA692F73BC0BA36722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect Ducktail Third Stage Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6041616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb

kernel32

RaiseException FreeLibrary SetErrorMode RaiseFailFastException GetExitCodeProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter AddVectoredExceptionHandler MultiByteToWideChar GetTickCount FlushInstructionCache QueryPerformanceFrequency QueryPerformanceCounter RtlLookupFunctionEntry LocateXStateFeature RtlDeleteFunctionTable InterlockedPushEntrySList InterlockedFlushSList InitializeSListHead GetTickCount64 DuplicateHandle QueueUserAPC WaitForSingleObjectEx SetThreadPriority GetThreadPriority GetCurrentThreadId TlsAlloc GetCurrentThread GetCurrentProcessId CreateThread GetModuleHandleW WaitForMultipleObjectsEx SignalObjectAndWait RtlCaptureContext SetThreadStackGuarantee VirtualQuery WriteFile GetStdHandle GetConsoleOutputCP MapViewOfFileEx UnmapViewOfFile GetStringTypeExW InterlockedPopEntrySList ExitProcess Sleep CreateMemoryResourceNotification VirtualAlloc VirtualFree VirtualProtect SleepEx SwitchToThread SuspendThread ResumeThread InitializeContext SetXStateFeaturesMask RtlRestoreContext CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer ReadFile GetFileSize GetEnvironmentVariableW SetEnvironmentVariableW CreateEventW SetEvent ResetEvent GetThreadContext SetThreadContext GetEnabledXStateFeatures CopyContext WerRegisterRuntimeExceptionModule RtlInstallFunctionTableCallback GetSystemDefaultLCID GetUserDefaultLCID RtlUnwind HeapAlloc HeapFree GetProcessHeap HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW FormatMessageW CreateSemaphoreExW ReleaseSemaphore GetACP LCMapStringEx LocalFree VerSetConditionMask VerifyVersionInfoW QueryThreadCycleTime GetLogicalProcessorInformationEx SetThreadGroupAffinity GetThreadGroupAffinity GetProcessGroupAffinity GetCurrentProcessorNumberEx GetProcessAffinityMask QueryInformationJobObject CloseHandle GetSystemTimeAsFileTime GetModuleFileNameW CreateProcessW GetCPInfo LoadLibraryExW CreateFileW GetFileAttributesExW GetFullPathNameW LoadLibraryExA OutputDebugStringA OpenEventW ReleaseMutex ExitThread CreateMutexW HeapReAlloc CreateNamedPipeA WaitForMultipleObjects DisconnectNamedPipe CreateFileA CancelIoEx GetOverlappedResult ConnectNamedPipe FlushFileBuffers SetFilePointer MapViewOfFile GetActiveProcessorGroupCount GetSystemTime SetConsoleCtrlHandler GetLocaleInfoEx GetUserDefaultLocaleName RtlAddFunctionTable LoadLibraryW CreateDirectoryW RemoveDirectoryW CreateActCtxW ActivateActCtx FindResourceW GetWindowsDirectoryW GetFileSizeEx FindFirstFileExW FindNextFileW GetTempPathW FindClose LoadLibraryA GetCurrentDirectoryW IsWow64Process EncodePointer DecodePointer CreateFileMappingA TlsSetValue TlsGetValue GetSystemInfo GetCurrentProcess OutputDebugStringW IsDebuggerPresent LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection WideCharToMultiByte GetCommandLineW GetProcAddress GetModuleHandleExW SetThreadErrorMode FlushProcessWriteBuffers SetLastError DebugBreak WaitForSingleObject GetNumaHighestNodeNumber SetThreadAffinityMask SetThreadIdealProcessorEx GetThreadIdealProcessorEx VirtualAllocExNuma GetNumaProcessorNodeEx VirtualUnlock GetLargePageMinimum IsProcessInJob K32GetProcessMemoryInfo GetLogicalProcessorInformation GlobalMemoryStatusEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlVirtualUnwind IsProcessorFeaturePresent RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsFree RtlPcToFileHeader TryAcquireSRWLockExclusive GetExitCodeThread GetStringTypeW InitializeCriticalSectionEx GetLastError CreateFileMappingW

advapi32

ReportEventW AdjustTokenPrivileges RegGetValueW SetKernelObjectSecurity GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation OpenProcessToken DeregisterEventSource RegisterEventSourceW RegQueryValueExW RegOpenKeyExW RegCloseKey EventRegister SetThreadToken RevertToSelf OpenThreadToken EventWriteTransfer EventWrite LookupPrivilegeValueW

ole32

CoCreateFreeThreadedMarshaler CreateStreamOnHGlobal CoRevokeInitializeSpy CoGetContextToken CoGetObjectContext CoUnmarshalInterface CoMarshalInterface CoGetMarshalSizeMax CLSIDFromProgID CoReleaseMarshalData CoTaskMemFree CoTaskMemAlloc CoCreateGuid CoInitializeEx CoRegisterInitializeSpy CoWaitForMultipleHandles CoUninitialize CoGetClassObject

oleaut32

CreateErrorInfo SysFreeString GetErrorInfo SetErrorInfo SysStringLen SysAllocString SysAllocStringLen SafeArrayGetDim SafeArrayGetLBound SafeArrayDestroy QueryPathOfRegTypeLi LoadTypeLibEx SafeArrayGetVartype VariantChangeType VariantChangeTypeEx VariantClear VariantInit VarCyFromDec SafeArrayAllocDescriptorEx GetRecordInfoFromTypeInfo SafeArraySetRecordInfo SafeArrayAllocData SafeArrayGetElemsize SysStringByteLen SysAllocStringByteLen SafeArrayCreateVector SafeArrayPutElement LoadRegTypeLi

user32

LoadStringW MessageBoxW

shell32

ShellExecuteW

api-ms-win-crt-string-l1-1-0

strncat_s wcsncat_s _wcsicmp wcsnlen wcscat_s towupper iswascii _strdup strncpy strnlen wcstok_s isdigit isupper isalpha towlower _wcsdup iswspace isspace islower strtok_s strcmp strcspn __strncnt _wcsnicmp strlen wcscpy_s toupper wcsncpy_s strcpy_s strcat_s strncpy_s _strnicmp tolower wcsncmp iswupper strncmp _stricmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf fflush __acrt_iob_func __stdio_common_vfprintf __stdio_common_vswprintf __stdio_common_vfwprintf fputws fputwc _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc fgetpos fgets fgetc fputc _wfsopen _wfopen __p__commode _set_fmode __stdio_common_vsnprintf_s setvbuf _setmode _dup _fileno ftell fseek fputs __stdio_common_vsnwprintf_s __stdio_common_vsprintf_s fwrite _flushall fopen fclose

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _register_onexit_function _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e _exit _invoke_watson __p___argc __p___wargv _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _beginthreadex terminate _controlfp_s _wcserror_s _invalid_parameter_noinfo _errno exit abort

api-ms-win-crt-convert-l1-1-0

_atoi64 _ltow_s _wtoi strtoul _wcstoui64 atol _itow_s strtoull wcstoul

api-ms-win-crt-heap-l1-1-0

free _set_new_mode calloc malloc realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

asinhf atanhf cbrtf acoshf cosh cbrt coshf exp expf acosh atanh floor floorf fma fmaf cosf _fdopen cos ceilf _copysignf _isnanf trunc truncf ilogb ilogbf tanhf ceil fmod fmodf atanf frexp atan2f atan2 log log10 log10f atan asinf log2 log2f logf pow powf sin sinf asin sinh sinhf sqrt sqrtf tan tanf tanh acosf _copysign asinh _isnan _finite modf modff _dclass _ldclass acos __setusermatherr

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s wcsftime

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_unlock_locales setlocale __pctype_func ___lc_locale_name_func _lock_locales ___lc_codepage_func ___mb_cur_max_func _configthreadlocale localeconv

api-ms-win-crt-filesystem-l1-1-0

_wrename _unlock_file _wremove _lock_file

Name

.text

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.CLR_UEF

Size

512B

Virtual Size

221B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

216KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Section

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Storm.exe

kernel32

advapi32

ole32

oleaut32

user32

shell32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic