c9cc5c0b7d439c7881227618879dc53ea07ddb4b649cef39fc0a1b1da6c4d476

General

Target

751f2d5097fc2ba1bebf9170bda56a14.exe
Size

1.5MB
MD5

751f2d5097fc2ba1bebf9170bda56a14
SHA1

ffa99d54d6443ca20e7306597acc7340b8a88eb0
SHA256

c9cc5c0b7d439c7881227618879dc53ea07ddb4b649cef39fc0a1b1da6c4d476
SHA512

f32d30f830775b5cf896d9fee826eea114d59ef42fe4bd6db2037a098904e1325869094785a791ce88a4f7536dbfce2d15a611a43b3f3e187afc0a431726b1b3
SSDEEP

24576:D2RtsxfT5Ecc6hwjZhWlkPzYiPnoIs9WoyZpGeWJkRUndufH5NTQ9FjnOAJIHZ:WkfTNEfWlQzBPnoIs9WoynWaaAfXTYFo

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2612	cookieman.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	751f2d5097fc2ba1bebf9170bda56a14.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	751f2d5097fc2ba1bebf9170bda56a14.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	751f2d5097fc2ba1bebf9170bda56a14.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1216	751f2d5097fc2ba1bebf9170bda56a14.exe
1216	751f2d5097fc2ba1bebf9170bda56a14.exe
2992	751f2d5097fc2ba1bebf9170bda56a14.exe
2992	751f2d5097fc2ba1bebf9170bda56a14.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2992	751f2d5097fc2ba1bebf9170bda56a14.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2992	751f2d5097fc2ba1bebf9170bda56a14.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2992	751f2d5097fc2ba1bebf9170bda56a14.exe
2992	751f2d5097fc2ba1bebf9170bda56a14.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2992	1216	751f2d5097fc2ba1bebf9170bda56a14.exe	28
PID 1216 wrote to memory of 2992	1216	751f2d5097fc2ba1bebf9170bda56a14.exe	28
PID 1216 wrote to memory of 2992	1216	751f2d5097fc2ba1bebf9170bda56a14.exe	28
PID 1216 wrote to memory of 2992	1216	751f2d5097fc2ba1bebf9170bda56a14.exe	28
PID 1216 wrote to memory of 2992	1216	751f2d5097fc2ba1bebf9170bda56a14.exe	28
PID 1216 wrote to memory of 2992	1216	751f2d5097fc2ba1bebf9170bda56a14.exe	28
PID 1216 wrote to memory of 2992	1216	751f2d5097fc2ba1bebf9170bda56a14.exe	28

C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe
"C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe
  "C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_112a1f890"
  2⤵
  - Checks whether UAC is enabled
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2992
- - C:\Users\Admin\AppData\LocalLow\cookieman.exe
    "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
    3⤵
    - Executes dropped EXE
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\cookie.ini

Filesize
34B

MD5
3f4519b56cb1e006dfe4341e72112913

SHA1
0ff5675d359c898b6a6bdc1dff10f71097bc9927

SHA256
125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

SHA512
78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

Download Submit
C:\Users\Admin\AppData\LocalLow\cookieman.exe

Filesize
45KB

MD5
3e382f6385bf86f976aecc9c2c3c6552

SHA1
d8c658bc164cb8bce72e5cca0597406841105685

SHA256
f2327ccb290c23f00af6555afc7f1c2855ef599ae387022a7f785d6cb47fceae

SHA512
656ee17c403d6aef18faad8eff0e4c305cb0f18ac22fe55b5b6b3400a560f45445f5fe0f21140ee36fb0de6cbe9abb3185a3c2caf0cbafd4d0bcdbf9ae20396b

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_112a1f890\autorun.txt

Filesize
75B

MD5
dedd637ddbf046e30073a331661f9c07

SHA1
ab5f8164ea28c3b43ef05d20a45fe05d56b55362

SHA256
ea421d768126b1dcd0892be805e7cd22c1ccc662cd744bc4bac801264be8e722

SHA512
c8d63d624c71ed717dfedf3940c5a3983f9b5626c16a2ff4357ad3c02f20040742d8ad33247cc0b60c1ce82ca4b57fd402ddb7e27fe04138f37f152725a1fd65

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_112a1f890\wrapper.xml

Filesize
798B

MD5
1d45a29e3511b982a1f91b33c70e964f

SHA1
176a47b489be3f27dc354a2b9dd0b580bb2f3904

SHA256
0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc

SHA512
c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69

Download Submit

Analysis

Sharing