Analysis
-
max time kernel
129s -
max time network
137s -
platform
windows7_x64 -
resource
win7 -
submitted
08-07-2020 20:19
Static task
static1
Behavioral task
behavioral1
Sample
eTPiv.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
eTPiv.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
eTPiv.exe
-
Size
941KB
-
MD5
c126b47388c127334162f17ab4e0cb2c
-
SHA1
d74b2309be4af77691bd424ea8ab5055af89e587
-
SHA256
77867995d1e8388230c9f71fee5e835b346bfcfef3fde418c6a773eea11b4afd
-
SHA512
7abdf106235dfe7311bcc1a1d847a2b4c9223aa3e59c59c486c4cb310e535de71b3680c937695210be0013c7158aaca97e2e664bb89a8dd5c7306a6cf1c9537a
Score
8/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
SgrmBroker.comdescription pid process target process PID 1064 set thread context of 1368 1064 SgrmBroker.com ipconfig.exe -
Checks for installed software on the system 1 TTPs 29 IoCs
Processes:
ipconfig.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName ipconfig.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall ipconfig.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName ipconfig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName ipconfig.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exeSgrmBroker.compid process 1512 cmd.exe 284 SgrmBroker.com -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
SgrmBroker.comSgrmBroker.compid process 284 SgrmBroker.com 284 SgrmBroker.com 284 SgrmBroker.com 1064 SgrmBroker.com 1064 SgrmBroker.com 1064 SgrmBroker.com -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
SgrmBroker.compid process 1064 SgrmBroker.com -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
eTPiv.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" eTPiv.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce eTPiv.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
eTPiv.execmd.exeSgrmBroker.comSgrmBroker.comipconfig.execmd.exedescription pid process target process PID 1448 wrote to memory of 1512 1448 eTPiv.exe cmd.exe PID 1448 wrote to memory of 1512 1448 eTPiv.exe cmd.exe PID 1448 wrote to memory of 1512 1448 eTPiv.exe cmd.exe PID 1448 wrote to memory of 1512 1448 eTPiv.exe cmd.exe PID 1512 wrote to memory of 1616 1512 cmd.exe certutil.exe PID 1512 wrote to memory of 1616 1512 cmd.exe certutil.exe PID 1512 wrote to memory of 1616 1512 cmd.exe certutil.exe PID 1512 wrote to memory of 1616 1512 cmd.exe certutil.exe PID 1512 wrote to memory of 284 1512 cmd.exe SgrmBroker.com PID 1512 wrote to memory of 284 1512 cmd.exe SgrmBroker.com PID 1512 wrote to memory of 284 1512 cmd.exe SgrmBroker.com PID 1512 wrote to memory of 284 1512 cmd.exe SgrmBroker.com PID 284 wrote to memory of 1064 284 SgrmBroker.com SgrmBroker.com PID 284 wrote to memory of 1064 284 SgrmBroker.com SgrmBroker.com PID 284 wrote to memory of 1064 284 SgrmBroker.com SgrmBroker.com PID 284 wrote to memory of 1064 284 SgrmBroker.com SgrmBroker.com PID 1512 wrote to memory of 1532 1512 cmd.exe PING.EXE PID 1512 wrote to memory of 1532 1512 cmd.exe PING.EXE PID 1512 wrote to memory of 1532 1512 cmd.exe PING.EXE PID 1512 wrote to memory of 1532 1512 cmd.exe PING.EXE PID 1064 wrote to memory of 1368 1064 SgrmBroker.com ipconfig.exe PID 1064 wrote to memory of 1368 1064 SgrmBroker.com ipconfig.exe PID 1064 wrote to memory of 1368 1064 SgrmBroker.com ipconfig.exe PID 1064 wrote to memory of 1368 1064 SgrmBroker.com ipconfig.exe PID 1064 wrote to memory of 1368 1064 SgrmBroker.com ipconfig.exe PID 1368 wrote to memory of 1960 1368 ipconfig.exe cmd.exe PID 1368 wrote to memory of 1960 1368 ipconfig.exe cmd.exe PID 1368 wrote to memory of 1960 1368 ipconfig.exe cmd.exe PID 1368 wrote to memory of 1960 1368 ipconfig.exe cmd.exe PID 1960 wrote to memory of 1040 1960 cmd.exe PING.EXE PID 1960 wrote to memory of 1040 1960 cmd.exe PING.EXE PID 1960 wrote to memory of 1040 1960 cmd.exe PING.EXE PID 1960 wrote to memory of 1040 1960 cmd.exe PING.EXE -
Executes dropped EXE 2 IoCs
Processes:
SgrmBroker.comSgrmBroker.compid process 284 SgrmBroker.com 1064 SgrmBroker.com -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
SgrmBroker.comSgrmBroker.compid process 284 SgrmBroker.com 284 SgrmBroker.com 284 SgrmBroker.com 1064 SgrmBroker.com 1064 SgrmBroker.com 1064 SgrmBroker.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\eTPiv.exe"C:\Users\Admin\AppData\Local\Temp\eTPiv.exe"1⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c <nul set /p ="M" > SgrmBroker.com & type JDhB.com >> SgrmBroker.com & del JDhB.com & certutil -decode GiEs.com A & SgrmBroker.com A & ping 127.0.0.1 -n 32⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\certutil.execertutil -decode GiEs.com A3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SgrmBroker.comSgrmBroker.com A3⤵
- Loads dropped DLL
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SgrmBroker.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SgrmBroker.com A4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SendNotifyMessage
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"5⤵
- Checks for installed software on the system
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping google.com && erase C:\Windows\SysWOW64\ipconfig.exe6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping google.com7⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 33⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\A
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GiEs.com
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JDhB.com
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QJPvK.com
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SgrmBroker.com
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SgrmBroker.com
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SgrmBroker.com
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\SgrmBroker.com
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\SgrmBroker.com
-
memory/284-5-0x0000000000000000-mapping.dmp
-
memory/1040-18-0x0000000000000000-mapping.dmp
-
memory/1064-10-0x0000000000000000-mapping.dmp
-
memory/1368-14-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1368-15-0x00000000004258D4-mapping.dmp
-
memory/1368-16-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1512-0-0x0000000000000000-mapping.dmp
-
memory/1532-13-0x0000000000000000-mapping.dmp
-
memory/1616-2-0x0000000000000000-mapping.dmp
-
memory/1960-17-0x0000000000000000-mapping.dmp