coldstealer | 8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b

General

Target

8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.exe
Size

505KB
MD5

a48f8e50e74b3792eeaffc6d25ca0080
SHA1

37b5e5a237164f304e960a82a3e8ce561d71c02d
SHA256

8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b
SHA512

e43010c9a0c35e7bdecd2bcdb40ad115697e09bf6922dc2c4a2421e30313fa5aded5babc72a6cbac874c304f629d511adcfa4053b2b88142272678f6d03d4030

Score

10^/10

coldstealer discovery spyware stealer

Malware Config

Signatures

Cold Stealer
An info stealer written in C#, first seen in Feb 2022.
stealer coldstealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.exe

pid process

1180 8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.exe

description pid process

Token: SeDebugPrivilege 1180 8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.exe

pid	process
1180	8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.exe

description	pid	process
Token: SeDebugPrivilege	1180	8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.exe

C:\Users\Admin\AppData\Local\Temp\8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.exe
"C:\Users\Admin\AppData\Local\Temp\8a4a1fe09544dacd804d0c2bb183850d628274a7e0dc9ea2bb6860d7a75bf61b.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-130-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1180-131-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1180-132-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1180-134-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1180-133-0x00000000007E0000-0x000000000081B000-memory.dmp

Filesize
236KB

Download
memory/1180-135-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1180-136-0x0000000000830000-0x000000000085A000-memory.dmp

Filesize
168KB

Download
memory/1180-142-0x0000000002AB0000-0x0000000002B00000-memory.dmp

Filesize
320KB

Download
memory/1180-143-0x0000000002B00000-0x0000000002B9C000-memory.dmp

Filesize
624KB

Download
memory/1180-144-0x0000000005010000-0x00000000055B4000-memory.dmp

Filesize
5.6MB

Download
memory/1180-145-0x0000000005600000-0x0000000005692000-memory.dmp

Filesize
584KB

Download
memory/1180-146-0x00000000056A0000-0x0000000005706000-memory.dmp

Filesize
408KB

Download
memory/1180-147-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1180-148-0x00000000007E0000-0x000000000081B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing