4f0c0dfddc583a0a80d4a8c399b3577321b583fd24c96debe92a0e97d8414d67

General

Target

49fa2ce3ce39db4258cf5edb5afa0965.exe
Size

1.6MB
MD5

49fa2ce3ce39db4258cf5edb5afa0965
SHA1

8af732c6d817958308e842723a4048146d039345
SHA256

4f0c0dfddc583a0a80d4a8c399b3577321b583fd24c96debe92a0e97d8414d67
SHA512

fc198368d4c46713e01712f0fbc7c48aeed77a30a958561773a5b4cdfa2abf2aa01727f0c57e89c0cfb5119d5886332f981154fc86b42f3fc059511c7588f5eb
SSDEEP

49152:S/fwUdLfGiPTStHxNtKgEAhK1kfqtOZ2TwhrN:SwUdCi7KHs19tc3

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2948	cookieman.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	49fa2ce3ce39db4258cf5edb5afa0965.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	49fa2ce3ce39db4258cf5edb5afa0965.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	49fa2ce3ce39db4258cf5edb5afa0965.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2512	49fa2ce3ce39db4258cf5edb5afa0965.exe
2512	49fa2ce3ce39db4258cf5edb5afa0965.exe
2204	49fa2ce3ce39db4258cf5edb5afa0965.exe
2204	49fa2ce3ce39db4258cf5edb5afa0965.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2204	49fa2ce3ce39db4258cf5edb5afa0965.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2204	49fa2ce3ce39db4258cf5edb5afa0965.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2204	49fa2ce3ce39db4258cf5edb5afa0965.exe
2204	49fa2ce3ce39db4258cf5edb5afa0965.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2204	2512	49fa2ce3ce39db4258cf5edb5afa0965.exe	28
PID 2512 wrote to memory of 2204	2512	49fa2ce3ce39db4258cf5edb5afa0965.exe	28
PID 2512 wrote to memory of 2204	2512	49fa2ce3ce39db4258cf5edb5afa0965.exe	28
PID 2512 wrote to memory of 2204	2512	49fa2ce3ce39db4258cf5edb5afa0965.exe	28
PID 2512 wrote to memory of 2204	2512	49fa2ce3ce39db4258cf5edb5afa0965.exe	28
PID 2512 wrote to memory of 2204	2512	49fa2ce3ce39db4258cf5edb5afa0965.exe	28
PID 2512 wrote to memory of 2204	2512	49fa2ce3ce39db4258cf5edb5afa0965.exe	28

C:\Users\Admin\AppData\Local\Temp\49fa2ce3ce39db4258cf5edb5afa0965.exe
"C:\Users\Admin\AppData\Local\Temp\49fa2ce3ce39db4258cf5edb5afa0965.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\49fa2ce3ce39db4258cf5edb5afa0965.exe
  "C:\Users\Admin\AppData\Local\Temp\49fa2ce3ce39db4258cf5edb5afa0965.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_1631c2520"
  2⤵
  - Checks whether UAC is enabled
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2204
- - C:\Users\Admin\AppData\LocalLow\cookieman.exe
    "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
    3⤵
    - Executes dropped EXE
    PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\cookie.ini

Filesize
34B

MD5
3f4519b56cb1e006dfe4341e72112913

SHA1
0ff5675d359c898b6a6bdc1dff10f71097bc9927

SHA256
125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

SHA512
78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

Download Submit
C:\Users\Admin\AppData\LocalLow\cookieman.exe

Filesize
45KB

MD5
1955f02140bc0b5b3d2cc3e8a75c79d9

SHA1
63acbf7cfa395f19f2f4d15053886f2107f83d20

SHA256
314fdbdd91df43b2c9c6e94eaecad160e400c730c57e879d93dc0cc905cb2d90

SHA512
c2c32b0d2a3a4e46a26396c9cf3b4a2ba6de753a1bb5d1535a2b00f6eeba751dc4b8ec9568e23b28b8ac01b91ae3922844f7c44f875f90a9263962e1c988a3b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_1631c2520\autorun.txt

Filesize
139B

MD5
b104f1260e55e449a65906c0e85776ea

SHA1
1d0fcc3bddaf4531553f1d27d93ef020be505cca

SHA256
74478e583defb3e5b8ceffd7dae3b2db1dc7e5afbaf0da4ecf39aa6b0d6d521d

SHA512
c7cf31d03fc1316885732e5a065a7722a72db2bb7fde8be7db0df73d00a70dace0c9727055a05e3070377a2f423016f05a16bb7603381c27b308f7139a756263

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_1631c2520\wrapper.xml

Filesize
798B

MD5
1d45a29e3511b982a1f91b33c70e964f

SHA1
176a47b489be3f27dc354a2b9dd0b580bb2f3904

SHA256
0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc

SHA512
c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69

Download Submit

Analysis

Sharing