4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2

General

Target

4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Size

3.6MB
MD5

e4bff2be82b2692de3104665543fd92a
SHA1

34f3b75957b9e94aa66ff213fe6271d274fdc73a
SHA256

4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2
SHA512

78e1038e7b23ae5b4d1958ab7fb96d0c37e10ac0f38755372df89d60f24649f1f8b64ae44f21fe80db0cc7ad753b204ab0213ab69749d735e695002bcfa9167e
SSDEEP

49152:GZnE7OROC/lQNdt8mDISXMW6GTBO6kyqzUh8xlFZqa:GZnEpC/lvmDISj6yONwhWFk

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\InprocServer32\ = "C:\\Program Files (x86)\\cosstminn\\p8USGr2u3H4xoS.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exeregsvr32.exeregsvr32.exe

pid process

1220 4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
1044 regsvr32.exe
368 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

Processes:

4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkkohaiobnagjgdjkjdkoiejihlmkifg\2.0\manifest.json	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkkohaiobnagjgdjkjdkoiejihlmkifg\2.0\manifest.json	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkkohaiobnagjgdjkjdkoiejihlmkifg\2.0\manifest.json	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exe4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\ = "cosstminn"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\NoExplorer = "1"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\ = "cosstminn"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\NoExplorer = "1"	regsvr32.exe

Drops file in System32 directory 4 IoCs

Processes:

4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe

Drops file in Program Files directory 8 IoCs

Processes:

4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.x64.dll	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
File created	C:\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.dll	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
File opened for modification	C:\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.dll	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
File created	C:\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.tlb	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
File opened for modification	C:\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.tlb	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
File created	C:\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.dat	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
File opened for modification	C:\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.dat	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
File created	C:\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.x64.dll	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exe4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{348A9AC0-6122-4EB7-B85F-E2AA2B190C32}	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{348A9AC0-6122-4EB7-B85F-E2AA2B190C32}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 64 IoCs

Processes:

4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\Programmable	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\VersionIndependentProgID	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "cosstminn"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "cosstminn"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\VersionIndependentProgID	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\cosstminn\\p8USGr2u3H4xoS.tlb"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\cosstminn"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348A9AC0-6122-4EB7-B85F-E2AA2B190C32}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348A9AC0-6122-4EB7-B85F-E2AA2B190C32}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348A9AC0-6122-4EB7-B85F-E2AA2B190C32}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\ = "cosstminn"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\ProgID\ = ".9"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\InprocServer32	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\ProgID	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{348A9AC0-6122-4EB7-B85F-E2AA2B190C32}\Implemented Categories	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{348A9AC0-6122-4EB7-B85F-E2AA2B190C32}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "cosstminn"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\VersionIndependentProgID\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\InprocServer32\ = "C:\\Program Files (x86)\\cosstminn\\p8USGr2u3H4xoS.x64.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32}\InprocServer32	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe

pid	process
1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe

description	pid	process
Token: SeDebugPrivilege	1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Token: SeDebugPrivilege	1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Token: SeDebugPrivilege	1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Token: SeDebugPrivilege	1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Token: SeDebugPrivilege	1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Token: SeDebugPrivilege	1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exeregsvr32.exe

description	pid	process	target process
PID 1220 wrote to memory of 1044	1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe	regsvr32.exe
PID 1220 wrote to memory of 1044	1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe	regsvr32.exe
PID 1220 wrote to memory of 1044	1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe	regsvr32.exe
PID 1220 wrote to memory of 1044	1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe	regsvr32.exe
PID 1220 wrote to memory of 1044	1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe	regsvr32.exe
PID 1220 wrote to memory of 1044	1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe	regsvr32.exe
PID 1220 wrote to memory of 1044	1220	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe	regsvr32.exe
PID 1044 wrote to memory of 368	1044	regsvr32.exe	regsvr32.exe
PID 1044 wrote to memory of 368	1044	regsvr32.exe	regsvr32.exe
PID 1044 wrote to memory of 368	1044	regsvr32.exe	regsvr32.exe
PID 1044 wrote to memory of 368	1044	regsvr32.exe	regsvr32.exe
PID 1044 wrote to memory of 368	1044	regsvr32.exe	regsvr32.exe
PID 1044 wrote to memory of 368	1044	regsvr32.exe	regsvr32.exe
PID 1044 wrote to memory of 368	1044	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{348a9ac0-6122-4eb7-b85f-e2aa2b190c32} = "1"	4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe

C:\Users\Admin\AppData\Local\Temp\4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe
"C:\Users\Admin\AppData\Local\Temp\4f14190dd45d95156362829c7f8adc3de715ed29befff14834fda7cb2dccccd2.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1220

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.dat

Filesize
3KB

MD5
f437d4474d0658e778ad916c68d09d7a

SHA1
1e915cc1569a5a55690e541cdf2545965c2fd184

SHA256
8aa1cf88095e0804031121fb46be505922b70c76dca404ba8b6ee636a111b2fc

SHA512
5c37c92be0c4732cc4ac4ca28edcff436b91109dd5d12b86fb2455ac4448999d1e65783693136ee67f5e8fc62b6e561de0d2179316ce346a38e238b061df74ac

Download Submit
C:\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.tlb

Filesize
3KB

MD5
74dcfbb4c0210a05872897b72dad6ccc

SHA1
ae4fe72c69877b895e4fd9e27dcdb57edaf08e5b

SHA256
fd828f1d5979ed1997727e6709529f2455e308ff5d771ecf8f362dc311c116a6

SHA512
8aff1886b7a1e20bb1b4aedf9ce380c607f9e34d7cb155890b0de4f45a2fdd3a7d4c66bc43341521100ca675b64e966e90cf0a4220ec813681172baf0b2e96dc

Download Submit
C:\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.x64.dll

Filesize
703KB

MD5
02dc4deb3ed0a4ed4ab84f5ec9fd303b

SHA1
1376b56ac30294ddff639dbf3b832d534f3c3fb9

SHA256
8498051cb730a3be5d7dc8eabd939f2f7223464145061bc15afc7d3cee88c421

SHA512
1bea8bbe0ce9cc0f652437c7ebb2b1c6d2741db6976a6b3228cc5358a5985f47228e1b475d7ed4bf66a0834c09916517c3e813a6b9ebebedf608a8666493a1b7

Download Submit
\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.dll

Filesize
626KB

MD5
40bb0aaab84ce029293396ecf927c32d

SHA1
52f60ebe0af63494869e9b9e8ced6409cd9461fb

SHA256
b268dd30a47ce2568d761b67fb522d9c0f5638dc0f0b2bc229bb589b49745d78

SHA512
8f9d3f7c3e0ceac22096e125bbf31c4e7206b804cb9482ae7eebfca63dcbc09bb8e64341820a501c3d03e15b2658b29706c3e222a2d68312a8f7023ca14dd706

Download Submit
\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.x64.dll

Filesize
703KB

MD5
02dc4deb3ed0a4ed4ab84f5ec9fd303b

SHA1
1376b56ac30294ddff639dbf3b832d534f3c3fb9

SHA256
8498051cb730a3be5d7dc8eabd939f2f7223464145061bc15afc7d3cee88c421

SHA512
1bea8bbe0ce9cc0f652437c7ebb2b1c6d2741db6976a6b3228cc5358a5985f47228e1b475d7ed4bf66a0834c09916517c3e813a6b9ebebedf608a8666493a1b7

Download Submit
\Program Files (x86)\cosstminn\p8USGr2u3H4xoS.x64.dll

Filesize
703KB

MD5
02dc4deb3ed0a4ed4ab84f5ec9fd303b

SHA1
1376b56ac30294ddff639dbf3b832d534f3c3fb9

SHA256
8498051cb730a3be5d7dc8eabd939f2f7223464145061bc15afc7d3cee88c421

SHA512
1bea8bbe0ce9cc0f652437c7ebb2b1c6d2741db6976a6b3228cc5358a5985f47228e1b475d7ed4bf66a0834c09916517c3e813a6b9ebebedf608a8666493a1b7

Download Submit
memory/368-65-0x0000000000000000-mapping.dmp

Download
memory/368-66-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Filesize
8KB

Download
memory/1044-61-0x0000000000000000-mapping.dmp

Download
memory/1220-54-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1220-55-0x0000000002730000-0x00000000027D4000-memory.dmp

Filesize
656KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads