Analysis

  • max time kernel
    99s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    08-07-2022 05:31

General

  • Target

    41819b043f6e0fe8d0f3045ed54d5e7263346fcd733baa39579a83f3a8b0f327.exe

  • Size

    156KB

  • MD5

    6a04c873d4728bfaf6646f770581dc9d

  • SHA1

    ddb011b8fb513dea74b062a095b12af612873038

  • SHA256

    41819b043f6e0fe8d0f3045ed54d5e7263346fcd733baa39579a83f3a8b0f327

  • SHA512

    8eb6cf9141f68027c13ed4c7a78a6a0abb4d262df63fa431a04385975a994d8d553e2af6ef11adf26b09c6af59d9d86ef179a993a379648fef7daf65145f0ea7

Malware Config

Extracted

Family

coldstealer

Botnet

l12

C2

http://topexpertshop.com/

Signatures

  • Cold Stealer

    An info stealer written in C#, first seen in Feb 2022.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41819b043f6e0fe8d0f3045ed54d5e7263346fcd733baa39579a83f3a8b0f327.exe
    "C:\Users\Admin\AppData\Local\Temp\41819b043f6e0fe8d0f3045ed54d5e7263346fcd733baa39579a83f3a8b0f327.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:868

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/868-54-0x0000000001250000-0x0000000001280000-memory.dmp
    Filesize

    192KB

  • memory/868-55-0x00000000003D0000-0x00000000003D6000-memory.dmp
    Filesize

    24KB

  • memory/868-56-0x0000000000600000-0x0000000000630000-memory.dmp
    Filesize

    192KB

  • memory/868-57-0x00000000003E0000-0x00000000003E6000-memory.dmp
    Filesize

    24KB