d6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee

General

Target
kolodial.exe
Size 2.0MB
Sample260420-pm2bvsas8l
SHA256 d6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee
MD5 e8b080c276519547e95930ab15028adb
SHA1 4557478c9b47f5d0729b6f6bf21d673068b57126
SHA512 4f5320218c0100379ddf8bcce4280231cda0b17e0deb0794abd0103ef4cd74120ca842f180ed3f7cf1a982ada8f9739d8db7163fa0dbd9c1943f2530b6abd6d2
SSDEEP 24576:MAbGrci1CVsb+JPrf+xp8esqhNyjAibJULb1hstRqGG7srGX8vCWI7JgZlHavtdP:VN7Jjfa87S1LktRqVzfHXxQk
TLSH
T1E3958E46B3A501FCD467C178CD466217F672B4041774ABEF45A08A6A2F73BE23A7E318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	kolodial.exe
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	kolodial.exe
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	kolodial.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3880	cmd.exe
4616	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	kolodial.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	kolodial.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4712	kolodial.exe
4712	kolodial.exe
4712	kolodial.exe
4712	kolodial.exe
4712	kolodial.exe
4712	kolodial.exe
4712	kolodial.exe
4712	kolodial.exe
4712	kolodial.exe
4712	kolodial.exe
4712	kolodial.exe
4712	kolodial.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4712	kolodial.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4712	kolodial.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4712	kolodial.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 3880	4712	kolodial.exe	86
PID 3880 wrote to memory of 3080	3880	cmd.exe	88
PID 3880 wrote to memory of 4616	3880	cmd.exe	89

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	kolodial.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	kolodial.exe

C:\Users\Admin\AppData\Local\Temp\kolodial.exe
"C:\Users\Admin\AppData\Local\Temp\kolodial.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c chcp 65001 >nul && netsh wlan show profiles > "C:\Users\Admin\AppData\Local\Temp\wifi_profiles.tmp"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3080
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

1

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Wi-Fi Discovery

1

T1016.002

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rsql_4712_240654687.tmp

Path C:\Users\Admin\AppData\Local\Temp\rsql_4712_240654687.tmp
Size 138KB
SHA256 a3b25b6c6fb863c933842d223fb6337c1f1e9bfdcc6d46de209a1f9a700644aa
MD5 732e898226012779dd14bf2d71bd0ab1
SHA1 f157271d74c2369975264b161ac8eac99e80af4e
SHA512 ac83eff8a0082e368e6b3800d548ce972a26eef5784af435a368e1c3dfdd3c8f1f944858adef0d63c184d822dbec1669f841321253868197cdf3d272785ffd6c
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OFpX6iq2Vump2wkn:zeuvBnhJsueMEGvIW1DcP2OjNVump2nn
TLSH
T1C8D3974B3A743102EDE59A721CE051BB5E3CB16D8F5595D428B620688EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rsql_4712_240654703.tmp

Path C:\Users\Admin\AppData\Local\Temp\rsql_4712_240654703.tmp
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wifi_profiles.tmp

Path C:\Users\Admin\AppData\Local\Temp\wifi_profiles.tmp
Size 59B
SHA256 6b6dd8b11f84fb78e3e8cfaa7c5fca569d79402b9fc5861b00960b25607c911e
MD5 409930721dbce1ee58227d109cca4570
SHA1 767f86ffec769d8415f07b4372a108cba1bf7221
SHA512 4875187fce9545a92df636e384f92dcb403dfe80f3cad4a68e79329a1f42e12e9d04948f2a52b939638481da6d3e3b5f5096fe6dfd674ee53cca7c655ec03f17
TLSH
T148A0028672E285B501922A03C6D590731F9411FD4065DF2915DC204256C942DAF15C15
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4712-26-0x000002070F110000-0x000002070F465000-memory.dmp

Download

memory/4712-32-0x000002070F110000-0x000002070F465000-memory.dmp

Download

memory/4712-38-0x000002070F110000-0x000002070F465000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads