Analysis
-
max time kernel
131s -
max time network
170s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:44
Static task
static1
Behavioral task
behavioral1
Sample
89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe
Resource
win10v2004-20220901-en
General
-
Target
89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe
-
Size
3.0MB
-
MD5
91406e61fa3aa437c7efa66a4ea9ba0f
-
SHA1
27c6f6a493dd74b0d5c52437b07f1ab31e5a2e57
-
SHA256
89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85
-
SHA512
5b141804e5806b87c298447c853ddcd37ac729200c91b1640eb00906224c5f0df10fd826c37bfa3cb886c82387bf4fb14e2e93762c24805a1a6bc3aaa2be97b1
-
SSDEEP
49152:iaUrAj9PxbJ2zuAiBCUwH7SlFJ5DumdOsCeT4n61dvdeR7hx9xek6uxzmy:ia4Aj6iBCUwHujDbC1n61S7nJ6Az
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\InprocServer32\ = "C:\\Program Files (x86)\\cosstminn\\KEI5_sFbPM.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\InprocServer32 regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exeregsvr32.exeregsvr32.exepid process 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe 1636 regsvr32.exe 1736 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\clomakcdghgdplgofnhnkoihekkmcnpk\2.0\manifest.json 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\clomakcdghgdplgofnhnkoihekkmcnpk\2.0\manifest.json 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\clomakcdghgdplgofnhnkoihekkmcnpk\2.0\manifest.json 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exe89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\ = "cosstminn" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880} 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\ = "cosstminn" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\NoExplorer = "1" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880} 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880} regsvr32.exe -
Drops file in System32 directory 4 IoCs
Processes:
89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe -
Drops file in Program Files directory 8 IoCs
Processes:
89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exedescription ioc process File opened for modification C:\Program Files (x86)\cosstminn\KEI5_sFbPM.dll 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe File created C:\Program Files (x86)\cosstminn\KEI5_sFbPM.tlb 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe File opened for modification C:\Program Files (x86)\cosstminn\KEI5_sFbPM.tlb 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe File created C:\Program Files (x86)\cosstminn\KEI5_sFbPM.dat 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe File opened for modification C:\Program Files (x86)\cosstminn\KEI5_sFbPM.dat 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe File created C:\Program Files (x86)\cosstminn\KEI5_sFbPM.x64.dll 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe File opened for modification C:\Program Files (x86)\cosstminn\KEI5_sFbPM.x64.dll 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe File created C:\Program Files (x86)\cosstminn\KEI5_sFbPM.dll 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe -
Processes:
89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880} 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key deleted \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key deleted \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880} 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe -
Modifies registry class 64 IoCs
Processes:
89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\Programmable 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\Implemented Categories 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cosstminn.cosstminn.2.0\ = "cosstminn" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\ = "cosstminn" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\ProgID 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cosstminn.cosstminn\ = "cosstminn" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cosstminn.cosstminn.2.0\CLSID\ = "{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cosstminn.cosstminn\CLSID 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cosstminn.cosstminn\CurVer\ = "cosstminn.2.0" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cosstminn.cosstminn\CurVer\ = "cosstminn.2.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cosstminn.cosstminn\ = "cosstminn" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cosstminn.cosstminn\CLSID\ = "{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\InprocServer32\ = "C:\\Program Files (x86)\\cosstminn\\KEI5_sFbPM.dll" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cosstminn.cosstminn.2.0\CLSID\ = "{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\ = "cosstminn" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\InprocServer32\ThreadingModel = "Apartment" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cosstminn.cosstminn.2.0\ = "cosstminn" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\ProgID\ = "cosstminn.2.0" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\Programmable 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880}\ProgID regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exepid process 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exedescription pid process Token: SeDebugPrivilege 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Token: SeDebugPrivilege 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Token: SeDebugPrivilege 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Token: SeDebugPrivilege 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Token: SeDebugPrivilege 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Token: SeDebugPrivilege 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exeregsvr32.exedescription pid process target process PID 560 wrote to memory of 1636 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe regsvr32.exe PID 560 wrote to memory of 1636 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe regsvr32.exe PID 560 wrote to memory of 1636 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe regsvr32.exe PID 560 wrote to memory of 1636 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe regsvr32.exe PID 560 wrote to memory of 1636 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe regsvr32.exe PID 560 wrote to memory of 1636 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe regsvr32.exe PID 560 wrote to memory of 1636 560 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe regsvr32.exe PID 1636 wrote to memory of 1736 1636 regsvr32.exe regsvr32.exe PID 1636 wrote to memory of 1736 1636 regsvr32.exe regsvr32.exe PID 1636 wrote to memory of 1736 1636 regsvr32.exe regsvr32.exe PID 1636 wrote to memory of 1736 1636 regsvr32.exe regsvr32.exe PID 1636 wrote to memory of 1736 1636 regsvr32.exe regsvr32.exe PID 1636 wrote to memory of 1736 1636 regsvr32.exe regsvr32.exe PID 1636 wrote to memory of 1736 1636 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{D3303E0F-8E5B-C4F8-D7D7-0A403DD41880} = "1" 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID 89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe"C:\Users\Admin\AppData\Local\Temp\89accdfe65e18999d57cf5a1eae7e2fe280f8d817ea6bf7b4d30c0ca20d71e85.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\cosstminn\KEI5_sFbPM.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\cosstminn\KEI5_sFbPM.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\cosstminn\KEI5_sFbPM.datFilesize
4KB
MD5ce454201ca755e1e6438310a3c7b54e9
SHA1c26213bd7debcc04546235934b044ee3fff03065
SHA2567b9be20f9216d359c78666e7300e2c6078f201abc302eaa7ccbd6c667f0db8c7
SHA5121b00d8dc510ea95c899c3c59969f455549db526a3a56c318bbfdfb437984397abc958066cb21aa6eee98b0741c2bc9427a0ff52133ab8b5e9ae153a72c7e0163
-
C:\Program Files (x86)\cosstminn\KEI5_sFbPM.tlbFilesize
3KB
MD53fdfaa71c68f31e83daf46b214ff8c89
SHA1fe4a9d2172e9a94570f46fc151b94f90db08da77
SHA2562d4e42ee22cf2171777f6f2aa232df7a2ad3445b6988ee2f2666ec2a863aca93
SHA512392faf168a97d35fc4fa414844cae3662d231f18d5db55891e6cf281f34cef590cb94f6a650565b5b2bdf2c0899dc872c432106449604079f3283da241f2a100
-
C:\Program Files (x86)\cosstminn\KEI5_sFbPM.x64.dllFilesize
687KB
MD5cd1a0489adc1f05fc31a65eb26e08c92
SHA195af9d7095d36dee3e4d2e2952ca1a199c2bb596
SHA256b63804fa2e99e3bd6b8dac3e203cba731ae2317e1fdae32014a88ff40a7a4755
SHA51252bc43818912822eb746196aea22b11287a914f156c2838e8c2bc01469758ac18f0575df3d05f7b37042e8c3fd88d5c905d69f359963d5d57c42d0bd7b073c19
-
\Program Files (x86)\cosstminn\KEI5_sFbPM.dllFilesize
610KB
MD58c17652e3d7951221e9afeb07a4c71e6
SHA168aeb97e567f4e705d4126a60bd94ef567760b61
SHA2564085d30c67ed3d336266d7dd5c2a1bfac8e6ba45f9240b31283e43ac9555ea24
SHA5126f21a4058579e7babe1ee44199fc41bf282d6e0c92352c636f39160c7c9e61191f9eb4186dcba8f0a25cf51f97c181e3027f2bbcee9f723a85de159121655065
-
\Program Files (x86)\cosstminn\KEI5_sFbPM.x64.dllFilesize
687KB
MD5cd1a0489adc1f05fc31a65eb26e08c92
SHA195af9d7095d36dee3e4d2e2952ca1a199c2bb596
SHA256b63804fa2e99e3bd6b8dac3e203cba731ae2317e1fdae32014a88ff40a7a4755
SHA51252bc43818912822eb746196aea22b11287a914f156c2838e8c2bc01469758ac18f0575df3d05f7b37042e8c3fd88d5c905d69f359963d5d57c42d0bd7b073c19
-
\Program Files (x86)\cosstminn\KEI5_sFbPM.x64.dllFilesize
687KB
MD5cd1a0489adc1f05fc31a65eb26e08c92
SHA195af9d7095d36dee3e4d2e2952ca1a199c2bb596
SHA256b63804fa2e99e3bd6b8dac3e203cba731ae2317e1fdae32014a88ff40a7a4755
SHA51252bc43818912822eb746196aea22b11287a914f156c2838e8c2bc01469758ac18f0575df3d05f7b37042e8c3fd88d5c905d69f359963d5d57c42d0bd7b073c19
-
memory/560-54-0x0000000075531000-0x0000000075533000-memory.dmpFilesize
8KB
-
memory/560-55-0x0000000002600000-0x00000000026A0000-memory.dmpFilesize
640KB
-
memory/1636-82-0x0000000000000000-mapping.dmp
-
memory/1736-86-0x0000000000000000-mapping.dmp
-
memory/1736-87-0x000007FEFBCE1000-0x000007FEFBCE3000-memory.dmpFilesize
8KB