b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88

General

Target

b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe
Size

1.8MB
MD5

0f8b0519624921ff26811ded992b8ec0
SHA1

9009a0d0b911fea1e74054621dd1f3b3212efabd
SHA256

b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88
SHA512

bb8321598f106999600ec773bfdfd89f462d9cea076e3a8da8fa9db6fe2c53406e14b35c2c7a4d0200fee1a7480b632f015242a6a9f26afc0b6664de6547dc57
SSDEEP

24576:Zco0DI7+5N9rL46OuC4lNeQjfA86eVY9SxyU1reYJvBpR2qw4FoTnGvql/NWtrYg:ZcngkS26eVY9SxYYjpER4FoTll/s9K4

Score

7^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2596	cookieman.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2440	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe
2440	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe
2796	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe
2796	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2796	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2796	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2796	2440	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe	30
PID 2440 wrote to memory of 2796	2440	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe	30
PID 2440 wrote to memory of 2796	2440	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe	30
PID 2440 wrote to memory of 2796	2440	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe	30
PID 2440 wrote to memory of 2796	2440	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe	30
PID 2440 wrote to memory of 2796	2440	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe	30
PID 2440 wrote to memory of 2796	2440	b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe	30

C:\Users\Admin\AppData\Local\Temp\b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe
"C:\Users\Admin\AppData\Local\Temp\b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe
  "C:\Users\Admin\AppData\Local\Temp\b35d66dadd17f26d23eaae4382ef6ae11707b2174f15d926c043490e2389cf88N.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_018b17b0" /pproc="explorer.exe"
  2⤵
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- - C:\Users\Admin\AppData\LocalLow\cookieman.exe
    "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
    3⤵
    - Executes dropped EXE
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\cookie.ini

Filesize
34B

MD5
3f4519b56cb1e006dfe4341e72112913

SHA1
0ff5675d359c898b6a6bdc1dff10f71097bc9927

SHA256
125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

SHA512
78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

Download Submit
C:\Users\Admin\AppData\LocalLow\cookieman.exe

Filesize
62KB

MD5
9d8672d490ba0b1a3989c670c1a0f74e

SHA1
2d47f441b860339c49987186687678807a0d948c

SHA256
7d9abd06cc93a3e3fd151a33b716646750b594e1ef66bdd914e058d6dc1fa95e

SHA512
a5c7a7179bb6612be8cd75cfade7ff2a40a4fec56e267ff11f79c6918bfdb663c87a5f2e86dbb93fd2ef3aee7425eafc9a2f8e2206f2255c6aa7c3d324c37374

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_018b17b0\autorun.txt

Filesize
96B

MD5
26c8616fc9566014a9382e4df89bdc5e

SHA1
a3907ba6997b9cf13850f63e3a9ce923910ffa74

SHA256
8e6b95b1a8bf6d339d491e77b73a196a640569d97065410c20b61c0745e045b9

SHA512
47f42e356011ac20870094866341b21417382ed080162ebcf89356683e8fc6118b86fe6e18a39578f5d6f27cdccdce9dc4496a35daa8fcf676f805e654405186

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_018b17b0\wrapper.xml

Filesize
692B

MD5
44601e00ff712607d2a0b64de786d843

SHA1
5696d1604b564a38669035faf395f78c933d8717

SHA256
424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9

SHA512
7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1

Download Submit

Analysis

Sharing