a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29

General

Target

a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe
Size

84KB
MD5

a2c9e147b573ccf836849e940dae51b1
SHA1

698dbdd397dc0e899f697092068bcb936444c202
SHA256

a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29
SHA512

074cca0f93abf3174c6736cf48e1b3668ef63a918a4b73b2d12141c5baf64180338d8084f6d187c52ef3ce6bda7a1d3b897c45b1191c73e629d06993b8038d25
SSDEEP

1536:7OwZfhFVqFqArpiABStX3KYL6LIrebnvaQCN5caDhrn0H0+9fbFyyUv:7NhhFVvQHgtZLsITQQGa90Lu

Score

8^/10

spyware stealer vmprotect

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ogwegk.exe

pid process

1936 ogwegk.exe

pid	process
1936	ogwegk.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/1488-132-0x0000000000400000-0x0000000000436000-memory.dmp	vmprotect
C:\Windows\SysWOW64\ogwegk.exe	vmprotect
C:\Windows\SysWOW64\ogwegk.exe	vmprotect
behavioral2/memory/1488-137-0x0000000000400000-0x0000000000436000-memory.dmp	vmprotect
behavioral2/memory/1936-138-0x0000000000400000-0x0000000000436000-memory.dmp	vmprotect
behavioral2/memory/1936-140-0x0000000000400000-0x0000000000436000-memory.dmp	vmprotect

Loads dropped DLL 3 IoCs

Processes:

ogwegk.exe

pid process

1936 ogwegk.exe
1936 ogwegk.exe
1936 ogwegk.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1936	ogwegk.exe
1936	ogwegk.exe
1936	ogwegk.exe

Drops file in System32 directory 7 IoCs

Processes:

a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exeogwegk.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ogwegk.exe	a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe
File created	C:\Windows\SysWOW64\ogwegk.dll	ogwegk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	ogwegk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	ogwegk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	ogwegk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	ogwegk.exe
File created	C:\Windows\SysWOW64\ogwegk.exe	a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

ogwegk.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ogwegk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ogwegk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ogwegk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ogwegk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ogwegk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ogwegk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ogwegk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ogwegk.exe

Suspicious behavior: LoadsDriver 6 IoCs

Processes:

ogwegk.exe

pid process

1936 ogwegk.exe
648
1936 ogwegk.exe
648
1936 ogwegk.exe
648

pid	process
1936	ogwegk.exe
648
1936	ogwegk.exe
648
1936	ogwegk.exe
648

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exeogwegk.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1488	a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe
Token: SeLoadDriverPrivilege	1936	ogwegk.exe
Token: SeLoadDriverPrivilege	1936	ogwegk.exe
Token: SeLoadDriverPrivilege	1936	ogwegk.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe

description	pid	process	target process
PID 1488 wrote to memory of 2584	1488	a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe	cmd.exe
PID 1488 wrote to memory of 2584	1488	a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe	cmd.exe
PID 1488 wrote to memory of 2584	1488	a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe
"C:\Users\Admin\AppData\Local\Temp\a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\A9F790~1.EXE > nul
2⤵
PID:2584

C:\Windows\SysWOW64\ogwegk.exe
C:\Windows\SysWOW64\ogwegk.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ogwegk.dll
Filesize
68KB

MD5
a881c409b825212b917f8a15557b963d

SHA1
92a6afc176182d85aa023382b0a29244cbb5bed9

SHA256
33e763fc49af7616eed1bdec5f271e023104f409b748511dba80fd1fb5a8f2d5

SHA512
d63d97910cae4707b88dacceb12667249bb2df203e675b3abd3bc4d02a9fdeb9b7d4330656cdf0c924a66a31d41562a7d60c0f9022f038ca0465426e44752de6

Download Submit
C:\Windows\SysWOW64\ogwegk.dll
Filesize
68KB

MD5
a881c409b825212b917f8a15557b963d

SHA1
92a6afc176182d85aa023382b0a29244cbb5bed9

SHA256
33e763fc49af7616eed1bdec5f271e023104f409b748511dba80fd1fb5a8f2d5

SHA512
d63d97910cae4707b88dacceb12667249bb2df203e675b3abd3bc4d02a9fdeb9b7d4330656cdf0c924a66a31d41562a7d60c0f9022f038ca0465426e44752de6

Download Submit
C:\Windows\SysWOW64\ogwegk.dll
Filesize
68KB

MD5
a881c409b825212b917f8a15557b963d

SHA1
92a6afc176182d85aa023382b0a29244cbb5bed9

SHA256
33e763fc49af7616eed1bdec5f271e023104f409b748511dba80fd1fb5a8f2d5

SHA512
d63d97910cae4707b88dacceb12667249bb2df203e675b3abd3bc4d02a9fdeb9b7d4330656cdf0c924a66a31d41562a7d60c0f9022f038ca0465426e44752de6

Download Submit
C:\Windows\SysWOW64\ogwegk.exe
Filesize
84KB

MD5
a2c9e147b573ccf836849e940dae51b1

SHA1
698dbdd397dc0e899f697092068bcb936444c202

SHA256
a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29

SHA512
074cca0f93abf3174c6736cf48e1b3668ef63a918a4b73b2d12141c5baf64180338d8084f6d187c52ef3ce6bda7a1d3b897c45b1191c73e629d06993b8038d25

Download Submit
C:\Windows\SysWOW64\ogwegk.exe
Filesize
84KB

MD5
a2c9e147b573ccf836849e940dae51b1

SHA1
698dbdd397dc0e899f697092068bcb936444c202

SHA256
a9f79071437a878080914bdfb1f107ac92e3537773298aeddef2a7fc17279d29

SHA512
074cca0f93abf3174c6736cf48e1b3668ef63a918a4b73b2d12141c5baf64180338d8084f6d187c52ef3ce6bda7a1d3b897c45b1191c73e629d06993b8038d25

Download Submit
memory/1488-132-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1488-137-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1936-138-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1936-140-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2584-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads