Overview
overview
10Static
static
8197f0e170f...2a.exe
windows7_x64
9197f0e170f...2a.exe
windows10_x64
9302d77c6ec...56.exe
windows7_x64
8302d77c6ec...56.exe
windows10_x64
8466d872ddb...0d.exe
windows7_x64
8466d872ddb...0d.exe
windows10_x64
106d13a07022...f4.exe
windows7_x64
86d13a07022...f4.exe
windows10_x64
88c1d1de824...ef.exe
windows7_x64
18c1d1de824...ef.exe
windows10_x64
1a31f1894f1...b8.exe
windows7_x64
8a31f1894f1...b8.exe
windows10_x64
9a3802c3a05...6d.exe
windows7_x64
10a3802c3a05...6d.exe
windows10_x64
10Android APK
android_x86_64
10c6c0d4969a...36.exe
windows7_x64
1c6c0d4969a...36.exe
windows10_x64
1d92ef7281e...1a.exe
windows7_x64
1d92ef7281e...1a.exe
windows10_x64
1dffb2eaccb...3a.exe
windows7_x64
8dffb2eaccb...3a.exe
windows10_x64
8e247b061c8...b1.exe
windows7_x64
8e247b061c8...b1.exe
windows10_x64
8Analysis
-
max time kernel
122s -
max time network
112s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
24-11-2020 02:32
Static task
static1
Behavioral task
behavioral1
Sample
197f0e170fac2b8c5f1b79d1865ce25f95f4b1a45408b091b5741710a3d9e32a.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral2
Sample
197f0e170fac2b8c5f1b79d1865ce25f95f4b1a45408b091b5741710a3d9e32a.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
302d77c6ec68c07741be2ae0d0c26bc88c85f525c8e3766ebf23dba34802f956.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral4
Sample
302d77c6ec68c07741be2ae0d0c26bc88c85f525c8e3766ebf23dba34802f956.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
466d872ddb9f8ce7db8d16d171b9ba398f99c98c79e63396760cda7426d9460d.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral6
Sample
466d872ddb9f8ce7db8d16d171b9ba398f99c98c79e63396760cda7426d9460d.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral8
Sample
6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral10
Sample
8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
a31f1894f161f1005c00ad43235500691a4fd0cb7bd83945d47f16dbd7f62ab8.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral12
Sample
a31f1894f161f1005c00ad43235500691a4fd0cb7bd83945d47f16dbd7f62ab8.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
a3802c3a0538d8b24b8a43144c51e742b0041e3b983b654ee19639359c42b06d.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral14
Sample
a3802c3a0538d8b24b8a43144c51e742b0041e3b983b654ee19639359c42b06d.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
af82bed2c58c403908faf323310cf6a65a7e3bfe098cc930eb5ac4bfe9315ef4.apk
Resource
android-x86_64
android_x86_64
Behavioral task
behavioral16
Sample
c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral17
Sample
c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral18
Sample
d92ef7281e3b5145835ffa17ff869c5569011ffb9ad327eeecfddebe31cdc31a.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral19
Sample
d92ef7281e3b5145835ffa17ff869c5569011ffb9ad327eeecfddebe31cdc31a.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral20
Sample
dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral21
Sample
dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral22
Sample
e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral23
Sample
e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
Resource
win10v20201028
windows10_x64
General
-
Target
6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe
-
Size
1.1MB
-
MD5
25ca92613089d713e77e03140bfc2e46
-
SHA1
3918be6a75063293154ab39e8a8735bd79283213
-
SHA256
6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4
-
SHA512
106e96f3f312efe0c01a5784c35e766cfb6a8c1b50da876accbe92120ec84a579aab81651233b1c68492ba17f0860b2c18ef93203f50298aa56ec6c8862f4ba5
Malware Config
Signatures
-
Blacklisted process makes network request 1 IoCs
flow pid Process 16 300 RUNDLL32.EXE -
Executes dropped EXE 4 IoCs
pid Process 1060 SgrmBroker.com 1108 SgrmBroker.com 336 ftp.exe 1688 wcsauqrdy.exe -
Loads dropped DLL 13 IoCs
pid Process 1676 cmd.exe 1060 SgrmBroker.com 1108 SgrmBroker.com 1420 cmd.exe 1420 cmd.exe 388 rundll32.exe 388 rundll32.exe 388 rundll32.exe 388 rundll32.exe 300 RUNDLL32.EXE 300 RUNDLL32.EXE 300 RUNDLL32.EXE 300 RUNDLL32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 19 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1108 set thread context of 336 1108 SgrmBroker.com 39 -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ftp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ftp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RUNDLL32.EXE -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 ftp.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 ftp.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 924 PING.EXE 1608 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 668 powershell.exe 668 powershell.exe 300 RUNDLL32.EXE 300 RUNDLL32.EXE 1516 powershell.exe 1516 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1108 SgrmBroker.com -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 388 rundll32.exe Token: SeDebugPrivilege 300 RUNDLL32.EXE Token: SeDebugPrivilege 668 powershell.exe Token: SeDebugPrivilege 1516 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 300 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 75 IoCs
description pid Process procid_target PID 1808 wrote to memory of 1352 1808 6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe 26 PID 1808 wrote to memory of 1352 1808 6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe 26 PID 1808 wrote to memory of 1352 1808 6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe 26 PID 1808 wrote to memory of 1352 1808 6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe 26 PID 1808 wrote to memory of 1784 1808 6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe 29 PID 1808 wrote to memory of 1784 1808 6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe 29 PID 1808 wrote to memory of 1784 1808 6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe 29 PID 1808 wrote to memory of 1784 1808 6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe 29 PID 1784 wrote to memory of 1676 1784 cmd.exe 32 PID 1784 wrote to memory of 1676 1784 cmd.exe 32 PID 1784 wrote to memory of 1676 1784 cmd.exe 32 PID 1784 wrote to memory of 1676 1784 cmd.exe 32 PID 1676 wrote to memory of 1608 1676 cmd.exe 34 PID 1676 wrote to memory of 1608 1676 cmd.exe 34 PID 1676 wrote to memory of 1608 1676 cmd.exe 34 PID 1676 wrote to memory of 1608 1676 cmd.exe 34 PID 1676 wrote to memory of 388 1676 cmd.exe 35 PID 1676 wrote to memory of 388 1676 cmd.exe 35 PID 1676 wrote to memory of 388 1676 cmd.exe 35 PID 1676 wrote to memory of 388 1676 cmd.exe 35 PID 1676 wrote to memory of 1060 1676 cmd.exe 36 PID 1676 wrote to memory of 1060 1676 cmd.exe 36 PID 1676 wrote to memory of 1060 1676 cmd.exe 36 PID 1676 wrote to memory of 1060 1676 cmd.exe 36 PID 1676 wrote to memory of 924 1676 cmd.exe 37 PID 1676 wrote to memory of 924 1676 cmd.exe 37 PID 1676 wrote to memory of 924 1676 cmd.exe 37 PID 1676 wrote to memory of 924 1676 cmd.exe 37 PID 1060 wrote to memory of 1108 1060 SgrmBroker.com 38 PID 1060 wrote to memory of 1108 1060 SgrmBroker.com 38 PID 1060 wrote to memory of 1108 1060 SgrmBroker.com 38 PID 1060 wrote to memory of 1108 1060 SgrmBroker.com 38 PID 1108 wrote to memory of 336 1108 SgrmBroker.com 39 PID 1108 wrote to memory of 336 1108 SgrmBroker.com 39 PID 1108 wrote to memory of 336 1108 SgrmBroker.com 39 PID 1108 wrote to memory of 336 1108 SgrmBroker.com 39 PID 1108 wrote to memory of 336 1108 SgrmBroker.com 39 PID 336 wrote to memory of 1420 336 ftp.exe 42 PID 336 wrote to memory of 1420 336 ftp.exe 42 PID 336 wrote to memory of 1420 336 ftp.exe 42 PID 336 wrote to memory of 1420 336 ftp.exe 42 PID 1420 wrote to memory of 1688 1420 cmd.exe 44 PID 1420 wrote to memory of 1688 1420 cmd.exe 44 PID 1420 wrote to memory of 1688 1420 cmd.exe 44 PID 1420 wrote to memory of 1688 1420 cmd.exe 44 PID 1688 wrote to memory of 388 1688 wcsauqrdy.exe 45 PID 1688 wrote to memory of 388 1688 wcsauqrdy.exe 45 PID 1688 wrote to memory of 388 1688 wcsauqrdy.exe 45 PID 1688 wrote to memory of 388 1688 wcsauqrdy.exe 45 PID 1688 wrote to memory of 388 1688 wcsauqrdy.exe 45 PID 1688 wrote to memory of 388 1688 wcsauqrdy.exe 45 PID 1688 wrote to memory of 388 1688 wcsauqrdy.exe 45 PID 388 wrote to memory of 300 388 rundll32.exe 46 PID 388 wrote to memory of 300 388 rundll32.exe 46 PID 388 wrote to memory of 300 388 rundll32.exe 46 PID 388 wrote to memory of 300 388 rundll32.exe 46 PID 388 wrote to memory of 300 388 rundll32.exe 46 PID 388 wrote to memory of 300 388 rundll32.exe 46 PID 388 wrote to memory of 300 388 rundll32.exe 46 PID 336 wrote to memory of 948 336 ftp.exe 47 PID 336 wrote to memory of 948 336 ftp.exe 47 PID 336 wrote to memory of 948 336 ftp.exe 47 PID 336 wrote to memory of 948 336 ftp.exe 47 PID 300 wrote to memory of 668 300 RUNDLL32.EXE 49 PID 300 wrote to memory of 668 300 RUNDLL32.EXE 49 PID 300 wrote to memory of 668 300 RUNDLL32.EXE 49 PID 300 wrote to memory of 668 300 RUNDLL32.EXE 49 PID 336 wrote to memory of 1964 336 ftp.exe 52 PID 336 wrote to memory of 1964 336 ftp.exe 52 PID 336 wrote to memory of 1964 336 ftp.exe 52 PID 336 wrote to memory of 1964 336 ftp.exe 52 PID 300 wrote to memory of 1516 300 RUNDLL32.EXE 54 PID 300 wrote to memory of 1516 300 RUNDLL32.EXE 54 PID 300 wrote to memory of 1516 300 RUNDLL32.EXE 54 PID 300 wrote to memory of 1516 300 RUNDLL32.EXE 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe"C:\Users\Admin\AppData\Local\Temp\6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo yAvKCDDZU2⤵PID:1352
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < jDEfkEXjdkpsYDsjiTiclOLsjvLnRCqj.ehVayaShFInxDvDcZMznplnRjeOTmcNkWvWdcUwBgiFyhXJ2⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\cmd.execmd3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\PING.EXEping -n 1 ureO.aly4⤵
- Runs ping.exe
PID:1608
-
-
C:\Windows\SysWOW64\certutil.execertutil -decode vgVzFIdoNRePPIlFBCwgNBVOGveDdCgG.tnZoBDBTJrNmSXwMUmbvQHUzuNoFMRl RU4⤵PID:388
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\SgrmBroker.comSgrmBroker.com RU4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\SgrmBroker.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\SgrmBroker.com RU5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ftp.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ftp.exe6⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\wcsauqrdy.exe"7⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\wcsauqrdy.exe"C:\Users\Admin\AppData\Local\Temp\wcsauqrdy.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\A3D902~1.DLL,A C:\Users\Admin\AppData\Local\Temp\WCSAUQ~1.EXE9⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\A3D902~1.DLL,lDZeNA==10⤵
- Blacklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp9FC8.tmp.ps1"11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpB6E3.tmp.ps1"11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\pmodxaluwnr.exe"7⤵PID:948
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\fkhacblbiwkl.exe"7⤵PID:1964
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 34⤵
- Runs ping.exe
PID:924
-
-
-