Analysis
-
max time kernel
40s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 12:43
General
-
Target
ba76b48941747901ed1349301b6c3c9536589f6b8327bd9f7086d8080be944db.exe
-
Size
207KB
-
MD5
940d63f67b70b37e7ee662b851ae389b
-
SHA1
dd0a39ca5e2570dc8909e2732c48e89f2bcd98e7
-
SHA256
ba76b48941747901ed1349301b6c3c9536589f6b8327bd9f7086d8080be944db
-
SHA512
f4bc82005f7ce3f7f1bff1cac7e24134a24f5d67cc0882a9677896a0f68e8b459b5956541e8e7305764ffc400b475a9c04191048163c2c142328a8f037f6347b
Score
10/10
Malware Config
Extracted
Family
coldstealer
Botnet
18
C2
http://realmoneycreate.xyz/
Signatures
-
Cold Stealer
An info stealer written in C#, first seen in Feb 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba76b48941747901ed1349301b6c3c9536589f6b8327bd9f7086d8080be944db.exe"C:\Users\Admin\AppData\Local\Temp\ba76b48941747901ed1349301b6c3c9536589f6b8327bd9f7086d8080be944db.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
-
Filesize
24KB
-
Filesize
232KB
-
Filesize
24KB