d6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee

General

Target
kolodial.exe
Size 2.0MB
Sample260420-pm2bvsas8l
SHA256 d6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee
MD5 e8b080c276519547e95930ab15028adb
SHA1 4557478c9b47f5d0729b6f6bf21d673068b57126
SHA512 4f5320218c0100379ddf8bcce4280231cda0b17e0deb0794abd0103ef4cd74120ca842f180ed3f7cf1a982ada8f9739d8db7163fa0dbd9c1943f2530b6abd6d2
SSDEEP 24576:MAbGrci1CVsb+JPrf+xp8esqhNyjAibJULb1hstRqGG7srGX8vCWI7JgZlHavtdP:VN7Jjfa87S1LktRqVzfHXxQk
TLSH
T1E3958E46B3A501FCD467C178CD466217F672B4041774ABEF45A08A6A2F73BE23A7E318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	kolodial.exe
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	kolodial.exe
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	kolodial.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4560	cmd.exe
992	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	kolodial.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	kolodial.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5004	kolodial.exe
5004	kolodial.exe
5004	kolodial.exe
5004	kolodial.exe
5004	kolodial.exe
5004	kolodial.exe
5004	kolodial.exe
5004	kolodial.exe
5004	kolodial.exe
5004	kolodial.exe
5004	kolodial.exe
5004	kolodial.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5004	kolodial.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	kolodial.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5004	kolodial.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4560	5004	kolodial.exe	78
PID 4560 wrote to memory of 1856	4560	cmd.exe	80
PID 4560 wrote to memory of 992	4560	cmd.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	kolodial.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	kolodial.exe

C:\Users\Admin\AppData\Local\Temp\kolodial.exe
"C:\Users\Admin\AppData\Local\Temp\kolodial.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:5004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c chcp 65001 >nul && netsh wlan show profiles > "C:\Users\Admin\AppData\Local\Temp\wifi_profiles.tmp"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1856
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

1

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Wi-Fi Discovery

1

T1016.002

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rsql_5004_240657671.tmp

Path C:\Users\Admin\AppData\Local\Temp\rsql_5004_240657671.tmp
Size 138KB
SHA256 06a51994d99bb1fab217c1445d1c67c3c1e351493aeb9ee5c85b73f421117a5c
MD5 039254d055c29cf77592c602edfd85ea
SHA1 ef8089a6d7405a9d91188755192bca1f1e96500a
SHA512 32c24f3400f73651d9ec79da711713b7b4a72002ea85fd89d7d47ec07b54477d880fb674d8d5002fde453e3e0de25643d9b953f34062f19454f17aaa5fb031fa
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2O5xdVumfnKa:FnbZeMrv/hGt5xhnKa
TLSH
T1B4D3774B3A743002EDE59A722CF055BB5D3C716D8F11A5D428B620688EF2963B63D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rsql_5004_240657687.tmp

Path C:\Users\Admin\AppData\Local\Temp\rsql_5004_240657687.tmp
Size 224KB
SHA256 2d8571ac33b06ca1bda8b4e494359e692e472987222f5de95eec25a12c853d1f
MD5 516351263bca6c138322eedfe8562bc4
SHA1 77dfdcb950444fec98ca242c05d380a112489aff
SHA512 31c1c26ba3b3f27daa67d049ae0fda61f9707b682004b642783424521232bc9e9f602200ff70559fc33c33151988f43e4c67048f4cbfb973b6d058a2a8567f21
SSDEEP 192:Vno3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:C3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10E24540A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wifi_profiles.tmp

Path C:\Users\Admin\AppData\Local\Temp\wifi_profiles.tmp
Size 59B
SHA256 6b6dd8b11f84fb78e3e8cfaa7c5fca569d79402b9fc5861b00960b25607c911e
MD5 409930721dbce1ee58227d109cca4570
SHA1 767f86ffec769d8415f07b4372a108cba1bf7221
SHA512 4875187fce9545a92df636e384f92dcb403dfe80f3cad4a68e79329a1f42e12e9d04948f2a52b939638481da6d3e3b5f5096fe6dfd674ee53cca7c655ec03f17
TLSH
T148A0028672E285B501922A03C6D590731F9411FD4065DF2915DC204256C942DAF15C15
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads