f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00

General

Target

f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe
Size

1.6MB
MD5

b23654e25f1f444a22fb6190904b559a
SHA1

bbaeefd628c75f79c0548b248803e36943b41f14
SHA256

f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00
SHA512

30ba5195b1f2c8ecc29524353fffc49aecc34cfe8cedd095b35bf3a46e9fdb318ea015c6b4e38790ed2df54c3d5df9f2e75ca7f28c1aeb378f1ea2a64bb9edfe
SSDEEP

49152:ZkK5IVKw/au2e4FE2UgJlLQ7adasXT4jnbIr:SzauKZU1adasUjbi

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
764	cookieman.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
772	f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe
772	f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe
468	f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe
468	f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	468	f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 468	772	f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe	27
PID 772 wrote to memory of 468	772	f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe	27
PID 772 wrote to memory of 468	772	f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe	27
PID 772 wrote to memory of 468	772	f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe	27
PID 772 wrote to memory of 468	772	f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe	27
PID 772 wrote to memory of 468	772	f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe	27
PID 772 wrote to memory of 468	772	f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe	27

C:\Users\Admin\AppData\Local\Temp\f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe
"C:\Users\Admin\AppData\Local\Temp\f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\Temp\f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe
  "C:\Users\Admin\AppData\Local\Temp\f22e7e5497cb94f535143ec6aa387630a861311d20caa107c1818c57e05fed00.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_1326201380"
  2⤵
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:468
- - C:\Users\Admin\AppData\LocalLow\cookieman.exe
    "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
    3⤵
    - Executes dropped EXE
    PID:764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\cookie.ini

Filesize
34B

MD5
3f4519b56cb1e006dfe4341e72112913

SHA1
0ff5675d359c898b6a6bdc1dff10f71097bc9927

SHA256
125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

SHA512
78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

Download Submit
C:\Users\Admin\AppData\LocalLow\cookieman.exe

Filesize
45KB

MD5
3f2fd35078f696539945889c26a92fe1

SHA1
60bfd55939008371d40479dffa07100fe5d80c9c

SHA256
8904e670b2a4ad89bab6e6bda2e1c3898fb602b1bf480631801df6eb16810e57

SHA512
ab2b6ad20108f0786d772fb412f3def468a71612b5c6d2b1893c75f856f129603651c6cf58505c6e0c563604f88af929abb5f299cd3300c0d9df81a34f59869f

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_1326201380\autorun.txt

Filesize
98B

MD5
a45b0065e3dd922b91467e0984a59212

SHA1
234497318a2522d6b788eb4948835064b9a92ef2

SHA256
be335687f957a013cfbd7a7704e8ca5b2fc66db6abdac3e9ef53ae441f3f58a3

SHA512
c4865e6da01f9d0fda722957ec30e4f22882f2b4de8a5a44961c615139868261709b97efdbad2bdc6d90f7440468bb3ebe06a74449efce0d3ab74b0e82e371d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_1326201380\wrapper.xml

Filesize
692B

MD5
44601e00ff712607d2a0b64de786d843

SHA1
5696d1604b564a38669035faf395f78c933d8717

SHA256
424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9

SHA512
7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1

Download Submit
memory/468-55-0x0000000000000000-mapping.dmp

Download
memory/772-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing