a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29

General

Target

a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe
Size

84KB
MD5

a2c9e147b573ccf836849e940dae51b1
SHA1

698dbdd397dc0e899f697092068bcb936444c202
SHA256

a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29
SHA512

074cca0f93abf3174c6736cf48e1b3668ef63a918a4b73b2d12141c5baf64180338d8084f6d187c52ef3ce6bda7a1d3b897c45b1191c73e629d06993b8038d25
SSDEEP

1536:7OwZfhFVqFqArpiABStX3KYL6LIrebnvaQCN5caDhrn0H0+9fbFyyUv:7NhhFVvQHgtZLsITQQGa90Lu

Score

8^/10

spyware stealer vmprotect

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

gemuas.exe

pid process

304 gemuas.exe

pid	process
304	gemuas.exe

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/900-54-0x0000000000400000-0x0000000000436000-memory.dmp	vmprotect
C:\Windows\SysWOW64\gemuas.exe	vmprotect
behavioral1/memory/900-58-0x0000000000400000-0x0000000000436000-memory.dmp	vmprotect
behavioral1/memory/304-59-0x0000000000400000-0x0000000000436000-memory.dmp	vmprotect
behavioral1/memory/304-62-0x0000000000400000-0x0000000000436000-memory.dmp	vmprotect

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2004 cmd.exe
Loads dropped DLL 3 IoCs

Processes:

gemuas.exe

pid process

304 gemuas.exe
304 gemuas.exe
304 gemuas.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2004	cmd.exe

pid	process
304	gemuas.exe
304	gemuas.exe
304	gemuas.exe

Drops file in System32 directory 4 IoCs

Processes:

a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exegemuas.exe

description	ioc	process
File created	C:\Windows\SysWOW64\gemuas.exe	a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe
File opened for modification	C:\Windows\SysWOW64\gemuas.exe	a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe
File created	C:\Windows\SysWOW64\gemuas.dll	gemuas.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	gemuas.exe

Modifies data under HKEY_USERS 28 IoCs

Processes:

gemuas.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	gemuas.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadDecisionReason = "1"	gemuas.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDecisionTime = c041d69ec902d901	gemuas.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	gemuas.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDecisionTime = 007dc8e5c902d901	gemuas.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	gemuas.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	gemuas.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDetectedUrl	gemuas.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	gemuas.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	gemuas.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}	gemuas.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadDecisionTime = c041d69ec902d901	gemuas.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDecision = "0"	gemuas.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	gemuas.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	gemuas.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0084000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	gemuas.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadDecisionTime = 007dc8e5c902d901	gemuas.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	gemuas.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	gemuas.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\d6-a6-83-9c-54-3e	gemuas.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDecisionReason = "1"	gemuas.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	gemuas.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	gemuas.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0084000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	gemuas.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e	gemuas.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadDecision = "0"	gemuas.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadNetworkName = "Network 3"	gemuas.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	gemuas.exe

Suspicious behavior: LoadsDriver 6 IoCs

Processes:

gemuas.exe

pid process

304 gemuas.exe
460
304 gemuas.exe
460
304 gemuas.exe
460

pid	process
304	gemuas.exe
460
304	gemuas.exe
460
304	gemuas.exe
460

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exegemuas.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	900	a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe
Token: SeLoadDriverPrivilege	304	gemuas.exe
Token: SeLoadDriverPrivilege	304	gemuas.exe
Token: SeLoadDriverPrivilege	304	gemuas.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe

description	pid	process	target process
PID 900 wrote to memory of 2004	900	a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe	cmd.exe
PID 900 wrote to memory of 2004	900	a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe	cmd.exe
PID 900 wrote to memory of 2004	900	a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe	cmd.exe
PID 900 wrote to memory of 2004	900	a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe
"C:\Users\Admin\AppData\Local\Temp\a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\A9F790~1.EXE > nul
2⤵
- Deletes itself
PID:2004

C:\Windows\SysWOW64\gemuas.exe
C:\Windows\SysWOW64\gemuas.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:304

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\gemuas.exe
Filesize
84KB

MD5
a2c9e147b573ccf836849e940dae51b1

SHA1
698dbdd397dc0e899f697092068bcb936444c202

SHA256
a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29

SHA512
074cca0f93abf3174c6736cf48e1b3668ef63a918a4b73b2d12141c5baf64180338d8084f6d187c52ef3ce6bda7a1d3b897c45b1191c73e629d06993b8038d25

Download Submit
\Windows\SysWOW64\gemuas.dll
Filesize
68KB

MD5
a881c409b825212b917f8a15557b963d

SHA1
92a6afc176182d85aa023382b0a29244cbb5bed9

SHA256
33e763fc49af7616eed1bdec5f271e023104f409b748511dba80fd1fb5a8f2d5

SHA512
d63d97910cae4707b88dacceb12667249bb2df203e675b3abd3bc4d02a9fdeb9b7d4330656cdf0c924a66a31d41562a7d60c0f9022f038ca0465426e44752de6

Download Submit
\Windows\SysWOW64\gemuas.dll
Filesize
68KB

MD5
a881c409b825212b917f8a15557b963d

SHA1
92a6afc176182d85aa023382b0a29244cbb5bed9

SHA256
33e763fc49af7616eed1bdec5f271e023104f409b748511dba80fd1fb5a8f2d5

SHA512
d63d97910cae4707b88dacceb12667249bb2df203e675b3abd3bc4d02a9fdeb9b7d4330656cdf0c924a66a31d41562a7d60c0f9022f038ca0465426e44752de6

Download Submit
\Windows\SysWOW64\gemuas.dll
Filesize
68KB

MD5
a881c409b825212b917f8a15557b963d

SHA1
92a6afc176182d85aa023382b0a29244cbb5bed9

SHA256
33e763fc49af7616eed1bdec5f271e023104f409b748511dba80fd1fb5a8f2d5

SHA512
d63d97910cae4707b88dacceb12667249bb2df203e675b3abd3bc4d02a9fdeb9b7d4330656cdf0c924a66a31d41562a7d60c0f9022f038ca0465426e44752de6

Download Submit
memory/304-59-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/304-61-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/304-62-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/900-54-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/900-58-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2004-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads