Analysis
-
max time kernel
56s -
max time network
68s -
platform
windows7_x64 -
resource
win7 -
submitted
08/07/2020, 20:19
Static task
static1
Behavioral task
behavioral1
Sample
eTPiv.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
eTPiv.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
eTPiv.exe
-
Size
941KB
-
MD5
c126b47388c127334162f17ab4e0cb2c
-
SHA1
d74b2309be4af77691bd424ea8ab5055af89e587
-
SHA256
77867995d1e8388230c9f71fee5e835b346bfcfef3fde418c6a773eea11b4afd
-
SHA512
7abdf106235dfe7311bcc1a1d847a2b4c9223aa3e59c59c486c4cb310e535de71b3680c937695210be0013c7158aaca97e2e664bb89a8dd5c7306a6cf1c9537a
Score
8/10
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1068 SgrmBroker.com 1068 SgrmBroker.com 1068 SgrmBroker.com 1056 SgrmBroker.com 1056 SgrmBroker.com 1056 SgrmBroker.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1056 set thread context of 1836 1056 SgrmBroker.com 30 -
Executes dropped EXE 2 IoCs
pid Process 1068 SgrmBroker.com 1056 SgrmBroker.com -
Loads dropped DLL 2 IoCs
pid Process 1616 cmd.exe 1068 SgrmBroker.com -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 1068 SgrmBroker.com 1068 SgrmBroker.com 1068 SgrmBroker.com 1056 SgrmBroker.com 1056 SgrmBroker.com 1056 SgrmBroker.com -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1056 SgrmBroker.com -
Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce eTPiv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" eTPiv.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 1696 PING.EXE 1972 PING.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for installed software on the system 1 TTPs 29 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName ipconfig.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName ipconfig.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName ipconfig.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 112 wrote to memory of 1616 112 eTPiv.exe 24 PID 112 wrote to memory of 1616 112 eTPiv.exe 24 PID 112 wrote to memory of 1616 112 eTPiv.exe 24 PID 112 wrote to memory of 1616 112 eTPiv.exe 24 PID 1616 wrote to memory of 740 1616 cmd.exe 26 PID 1616 wrote to memory of 740 1616 cmd.exe 26 PID 1616 wrote to memory of 740 1616 cmd.exe 26 PID 1616 wrote to memory of 740 1616 cmd.exe 26 PID 1616 wrote to memory of 1068 1616 cmd.exe 27 PID 1616 wrote to memory of 1068 1616 cmd.exe 27 PID 1616 wrote to memory of 1068 1616 cmd.exe 27 PID 1616 wrote to memory of 1068 1616 cmd.exe 27 PID 1068 wrote to memory of 1056 1068 SgrmBroker.com 28 PID 1068 wrote to memory of 1056 1068 SgrmBroker.com 28 PID 1068 wrote to memory of 1056 1068 SgrmBroker.com 28 PID 1068 wrote to memory of 1056 1068 SgrmBroker.com 28 PID 1616 wrote to memory of 1696 1616 cmd.exe 29 PID 1616 wrote to memory of 1696 1616 cmd.exe 29 PID 1616 wrote to memory of 1696 1616 cmd.exe 29 PID 1616 wrote to memory of 1696 1616 cmd.exe 29 PID 1056 wrote to memory of 1836 1056 SgrmBroker.com 30 PID 1056 wrote to memory of 1836 1056 SgrmBroker.com 30 PID 1056 wrote to memory of 1836 1056 SgrmBroker.com 30 PID 1056 wrote to memory of 1836 1056 SgrmBroker.com 30 PID 1056 wrote to memory of 1836 1056 SgrmBroker.com 30 PID 1836 wrote to memory of 2024 1836 ipconfig.exe 36 PID 1836 wrote to memory of 2024 1836 ipconfig.exe 36 PID 1836 wrote to memory of 2024 1836 ipconfig.exe 36 PID 1836 wrote to memory of 2024 1836 ipconfig.exe 36 PID 2024 wrote to memory of 1972 2024 cmd.exe 38 PID 2024 wrote to memory of 1972 2024 cmd.exe 38 PID 2024 wrote to memory of 1972 2024 cmd.exe 38 PID 2024 wrote to memory of 1972 2024 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\eTPiv.exe"C:\Users\Admin\AppData\Local\Temp\eTPiv.exe"1⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\SysWOW64\cmd.execmd /c <nul set /p ="M" > SgrmBroker.com & type JDhB.com >> SgrmBroker.com & del JDhB.com & certutil -decode GiEs.com A & SgrmBroker.com A & ping 127.0.0.1 -n 32⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\certutil.execertutil -decode GiEs.com A3⤵PID:740
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SgrmBroker.comSgrmBroker.com A3⤵
- Suspicious use of FindShellTrayWindow
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SgrmBroker.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SgrmBroker.com A4⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of SendNotifyMessage
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"5⤵
- Checks for installed software on the system
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping google.com && erase C:\Windows\SysWOW64\ipconfig.exe6⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\PING.EXEping google.com7⤵
- Runs ping.exe
PID:1972
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 33⤵
- Runs ping.exe
PID:1696
-
-