Analysis

  • max time kernel
    43s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    05-07-2022 12:42

General

  • Target

    8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.exe

  • Size

    505KB

  • MD5

    a48f8e50e74b3792eeaffc6d25ca0080

  • SHA1

    37b5e5a237164f304e960a82a3e8ce561d71c02d

  • SHA256

    8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b

  • SHA512

    e43010c9a0c35e7bdecd2bcdb40ad115697e09bf6922dc2c4a2421e30313fa5aded5babc72a6cbac874c304f629d511adcfa4053b2b88142272678f6d03d4030

Malware Config

Extracted

Family

coldstealer

Botnet

l2

C2

http://realacademicmediausa.com/

Signatures

  • Cold Stealer

    An info stealer written in C#, first seen in Feb 2022.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.exe
    "C:\Users\Admin\AppData\Local\Temp\8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:784

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/784-54-0x0000000075701000-0x0000000075703000-memory.dmp
    Filesize

    8KB

  • memory/784-55-0x0000000000400000-0x00000000004CC000-memory.dmp
    Filesize

    816KB

  • memory/784-56-0x0000000000400000-0x00000000004CC000-memory.dmp
    Filesize

    816KB

  • memory/784-57-0x0000000001D70000-0x0000000001D9A000-memory.dmp
    Filesize

    168KB

  • memory/784-63-0x0000000000220000-0x000000000023A000-memory.dmp
    Filesize

    104KB

  • memory/784-64-0x0000000000400000-0x00000000004CC000-memory.dmp
    Filesize

    816KB

  • memory/784-65-0x0000000001D10000-0x0000000001D4B000-memory.dmp
    Filesize

    236KB

  • memory/784-66-0x0000000001D70000-0x0000000001D9A000-memory.dmp
    Filesize

    168KB

  • memory/784-67-0x0000000001D70000-0x0000000001D9A000-memory.dmp
    Filesize

    168KB