23a32b9db00c74b0440132fd6dfd0a2b5f9f522b13f59b491c4bbf98070cddf2 | Triage

Sharing

General

Target

Cold_Turkey_Installer.exe
Size

7.5MB
Sample

240812-gfxq4ascla
MD5

eaa0f3ddd71db24c3a64ecf58e40da52
SHA1

eacdae7c9af8ff3be6be93e83a8dbf1a101b823a
SHA256

23a32b9db00c74b0440132fd6dfd0a2b5f9f522b13f59b491c4bbf98070cddf2
SHA512

8a401d476cfb55798d18677023b067cd6a6c642476bd7c496a3b8641794e0e71436f48944f79381b4eaed29c4bfc12d8a1aa706c58826bcbdcf2048011b2b166
SSDEEP

196608:4o+vdaNLCT/KooJh54K+SSz2G/yQ6Owc0DTmpciZ:4plaNLc/KtJhCK1qKQTw7m9

Score

8^/10

discovery evasion persistence privilege_escalation spyware stealer

Malware Config

Targets

- Target
  
  Cold_Turkey_Installer.exe
- Size
  
  7.5MB
- MD5
  
  eaa0f3ddd71db24c3a64ecf58e40da52
- SHA1
  
  eacdae7c9af8ff3be6be93e83a8dbf1a101b823a
- SHA256
  
  23a32b9db00c74b0440132fd6dfd0a2b5f9f522b13f59b491c4bbf98070cddf2
- SHA512
  
  8a401d476cfb55798d18677023b067cd6a6c642476bd7c496a3b8641794e0e71436f48944f79381b4eaed29c4bfc12d8a1aa706c58826bcbdcf2048011b2b166
- SSDEEP
  
  196608:4o+vdaNLCT/KooJh54K+SSz2G/yQ6Owc0DTmpciZ:4plaNLc/KtJhCK1qKQTw7m9
Score

8^/10

discovery evasion persistence privilege_escalation spyware stealer
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalationspywarestealer