coldstealer | 9e21e39cd313c6974c5ca9133f9c29acd59f09a90d2c78cf6302516fd4d93897

General

Target

9e21e39cd313c6974c5ca9133f9c29acd59f09a90d2c78cf6302516fd4d93897.exe
Size

653KB
MD5

9ec150a4c04da6a1087a3cd36086fde3
SHA1

d67ef87f7f756ea776ae3f63a2b2a86e2a3fe061
SHA256

9e21e39cd313c6974c5ca9133f9c29acd59f09a90d2c78cf6302516fd4d93897
SHA512

778955d57edc4395ad64c802a323a6f958aa27a0e32bd496f7b3da805fadc8e7fc19b6703bad9931a74bd8c35297fbfd4591a383efe4fc315a9827b34ca843fd

Score

10^/10

coldstealer discovery spyware stealer

Malware Config

Signatures

Cold Stealer
An info stealer written in C#, first seen in Feb 2022.
stealer coldstealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9e21e39cd313c6974c5ca9133f9c29acd59f09a90d2c78cf6302516fd4d93897.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	9e21e39cd313c6974c5ca9133f9c29acd59f09a90d2c78cf6302516fd4d93897.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	9e21e39cd313c6974c5ca9133f9c29acd59f09a90d2c78cf6302516fd4d93897.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

9e21e39cd313c6974c5ca9133f9c29acd59f09a90d2c78cf6302516fd4d93897.exe

pid process

2324 9e21e39cd313c6974c5ca9133f9c29acd59f09a90d2c78cf6302516fd4d93897.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9e21e39cd313c6974c5ca9133f9c29acd59f09a90d2c78cf6302516fd4d93897.exe

description pid process

Token: SeDebugPrivilege 2324 9e21e39cd313c6974c5ca9133f9c29acd59f09a90d2c78cf6302516fd4d93897.exe

pid	process
2324	9e21e39cd313c6974c5ca9133f9c29acd59f09a90d2c78cf6302516fd4d93897.exe

description	pid	process
Token: SeDebugPrivilege	2324	9e21e39cd313c6974c5ca9133f9c29acd59f09a90d2c78cf6302516fd4d93897.exe

C:\Users\Admin\AppData\Local\Temp\9e21e39cd313c6974c5ca9133f9c29acd59f09a90d2c78cf6302516fd4d93897.exe
"C:\Users\Admin\AppData\Local\Temp\9e21e39cd313c6974c5ca9133f9c29acd59f09a90d2c78cf6302516fd4d93897.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-130-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/2324-131-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/2324-133-0x00000000007E0000-0x0000000000819000-memory.dmp

Filesize
228KB

Download
memory/2324-132-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/2324-134-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/2324-135-0x00000000007B0000-0x00000000007DA000-memory.dmp

Filesize
168KB

Download
memory/2324-141-0x0000000002B00000-0x0000000002B50000-memory.dmp

Filesize
320KB

Download
memory/2324-142-0x0000000002B50000-0x0000000002BEC000-memory.dmp

Filesize
624KB

Download
memory/2324-143-0x0000000005240000-0x00000000057E4000-memory.dmp

Filesize
5.6MB

Download
memory/2324-144-0x0000000005830000-0x00000000058C2000-memory.dmp

Filesize
584KB

Download
memory/2324-145-0x00000000058D0000-0x0000000005936000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing