328449250e95af61e5e92254665d4c1a43d835482cd2d159c1e8a08a1ad8c725

Analysis

max time kernel
145s
max time network
140s
platform
windows10_x64
resource
win10v20201028
submitted
24-11-2020 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe
Size

1.1MB
MD5

25ca92613089d713e77e03140bfc2e46
SHA1

3918be6a75063293154ab39e8a8735bd79283213
SHA256

6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4
SHA512

106e96f3f312efe0c01a5784c35e766cfb6a8c1b50da876accbe92120ec84a579aab81651233b1c68492ba17f0860b2c18ef93203f50298aa56ec6c8862f4ba5

Score

8^/10

discovery spyware

Malware Config

Signatures

Blacklisted process makes network request 1 IoCs

flow	pid	Process
29	868	RUNDLL32.EXE

Executes dropped EXE 4 IoCs

pid	Process
2588	SgrmBroker.com
3480	SgrmBroker.com
1424	ftp.exe
2540	dhaqkpwfb.exe

Loads dropped DLL 3 IoCs

pid	Process
2880	rundll32.exe
868	RUNDLL32.EXE
868	RUNDLL32.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3480 set thread context of 1424	3480	SgrmBroker.com	88

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ftp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ftp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RUNDLL32.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3700	PING.EXE
184	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3220	powershell.exe
3220	powershell.exe
3220	powershell.exe
868	RUNDLL32.EXE
868	RUNDLL32.EXE
1812	powershell.exe
1812	powershell.exe
1812	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3480	SgrmBroker.com

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2880	rundll32.exe
Token: SeDebugPrivilege	868	RUNDLL32.EXE
Token: SeDebugPrivilege	3220	powershell.exe
Token: SeDebugPrivilege	1812	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
868	RUNDLL32.EXE

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 2460	988	6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe	74
PID 988 wrote to memory of 2460	988	6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe	74
PID 988 wrote to memory of 2460	988	6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe	74
PID 988 wrote to memory of 2500	988	6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe	76
PID 988 wrote to memory of 2500	988	6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe	76
PID 988 wrote to memory of 2500	988	6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe	76
PID 2500 wrote to memory of 2992	2500	cmd.exe	78
PID 2500 wrote to memory of 2992	2500	cmd.exe	78
PID 2500 wrote to memory of 2992	2500	cmd.exe	78
PID 2992 wrote to memory of 3700	2992	cmd.exe	80
PID 2992 wrote to memory of 3700	2992	cmd.exe	80
PID 2992 wrote to memory of 3700	2992	cmd.exe	80
PID 2992 wrote to memory of 824	2992	cmd.exe	81
PID 2992 wrote to memory of 824	2992	cmd.exe	81
PID 2992 wrote to memory of 824	2992	cmd.exe	81
PID 2992 wrote to memory of 2588	2992	cmd.exe	82
PID 2992 wrote to memory of 2588	2992	cmd.exe	82
PID 2992 wrote to memory of 2588	2992	cmd.exe	82
PID 2992 wrote to memory of 184	2992	cmd.exe	83
PID 2992 wrote to memory of 184	2992	cmd.exe	83
PID 2992 wrote to memory of 184	2992	cmd.exe	83
PID 2588 wrote to memory of 3480	2588	SgrmBroker.com	84
PID 2588 wrote to memory of 3480	2588	SgrmBroker.com	84
PID 2588 wrote to memory of 3480	2588	SgrmBroker.com	84
PID 3480 wrote to memory of 1424	3480	SgrmBroker.com	88
PID 3480 wrote to memory of 1424	3480	SgrmBroker.com	88
PID 3480 wrote to memory of 1424	3480	SgrmBroker.com	88
PID 3480 wrote to memory of 1424	3480	SgrmBroker.com	88
PID 1424 wrote to memory of 796	1424	ftp.exe	89
PID 1424 wrote to memory of 796	1424	ftp.exe	89
PID 1424 wrote to memory of 796	1424	ftp.exe	89
PID 796 wrote to memory of 2540	796	cmd.exe	91
PID 796 wrote to memory of 2540	796	cmd.exe	91
PID 796 wrote to memory of 2540	796	cmd.exe	91
PID 2540 wrote to memory of 2880	2540	dhaqkpwfb.exe	92
PID 2540 wrote to memory of 2880	2540	dhaqkpwfb.exe	92
PID 2540 wrote to memory of 2880	2540	dhaqkpwfb.exe	92
PID 2880 wrote to memory of 868	2880	rundll32.exe	93
PID 2880 wrote to memory of 868	2880	rundll32.exe	93
PID 2880 wrote to memory of 868	2880	rundll32.exe	93
PID 868 wrote to memory of 3220	868	RUNDLL32.EXE	94
PID 868 wrote to memory of 3220	868	RUNDLL32.EXE	94
PID 868 wrote to memory of 3220	868	RUNDLL32.EXE	94
PID 1424 wrote to memory of 1232	1424	ftp.exe	96
PID 1424 wrote to memory of 1232	1424	ftp.exe	96
PID 1424 wrote to memory of 1232	1424	ftp.exe	96
PID 868 wrote to memory of 1812	868	RUNDLL32.EXE	99
PID 868 wrote to memory of 1812	868	RUNDLL32.EXE	99
PID 868 wrote to memory of 1812	868	RUNDLL32.EXE	99
PID 1424 wrote to memory of 2476	1424	ftp.exe	101
PID 1424 wrote to memory of 2476	1424	ftp.exe	101
PID 1424 wrote to memory of 2476	1424	ftp.exe	101

C:\Users\Admin\AppData\Local\Temp\6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe
"C:\Users\Admin\AppData\Local\Temp\6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo yAvKCDDZU
  2⤵
  PID:2460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd < jDEfkEXjdkpsYDsjiTiclOLsjvLnRCqj.ehVayaShFInxDvDcZMznplnRjeOTmcNkWvWdcUwBgiFyhXJ
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 ureO.aly
      4⤵
      Runs ping.exe
      PID:3700
  - - C:\Windows\SysWOW64\certutil.exe
      certutil -decode vgVzFIdoNRePPIlFBCwgNBVOGveDdCgG.tnZoBDBTJrNmSXwMUmbvQHUzuNoFMRl RU
      4⤵
      PID:824
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\SgrmBroker.com
      SgrmBroker.com RU
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\SgrmBroker.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\SgrmBroker.com RU
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ftp.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ftp.exe
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\dhaqkpwfb.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\dhaqkpwfb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dhaqkpwfb.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\3B4770~1.DLL,A C:\Users\Admin\AppData\Local\Temp\DHAQKP~1.EXE
        9⤵
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\3B4770~1.DLL,SyckfI0=
        10⤵
        Blacklisted process makes network request
        Loads dropped DLL
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpB641.tmp.ps1"
        11⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3220
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpC5E3.tmp.ps1"
        11⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\eohhxnqu.exe"
        7⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\vtrpnwhteqks.exe"
        7⤵
        
        PID:2476
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 3
      4⤵
      Runs ping.exe
      PID:184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-35-0x0000000004DC0000-0x0000000005418000-memory.dmp

Filesize
6.3MB

Download
memory/1424-18-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1424-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1812-60-0x0000000008060000-0x0000000008061000-memory.dmp

Filesize
4KB

Download
memory/1812-51-0x00000000705D0000-0x0000000070CBE000-memory.dmp

Filesize
6.9MB

Download
memory/1812-57-0x0000000007AD0000-0x0000000007AD1000-memory.dmp

Filesize
4KB

Download
memory/2540-26-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

Filesize
4KB

Download
memory/2880-30-0x0000000004E90000-0x00000000054E8000-memory.dmp

Filesize
6.3MB

Download
memory/3220-42-0x0000000008280000-0x0000000008281000-memory.dmp

Filesize
4KB

Download
memory/3220-45-0x0000000008A20000-0x0000000008A21000-memory.dmp

Filesize
4KB

Download
memory/3220-46-0x0000000008A70000-0x0000000008A71000-memory.dmp

Filesize
4KB

Download
memory/3220-37-0x0000000070A50000-0x000000007113E000-memory.dmp

Filesize
6.9MB

Download
memory/3220-44-0x00000000086E0000-0x00000000086E1000-memory.dmp

Filesize
4KB

Download
memory/3220-43-0x00000000082F0000-0x00000000082F1000-memory.dmp

Filesize
4KB

Download
memory/3220-38-0x0000000007230000-0x0000000007231000-memory.dmp

Filesize
4KB

Download
memory/3220-41-0x0000000008210000-0x0000000008211000-memory.dmp

Filesize
4KB

Download
memory/3220-40-0x0000000007910000-0x0000000007911000-memory.dmp

Filesize
4KB

Download
memory/3220-39-0x0000000007990000-0x0000000007991000-memory.dmp

Filesize
4KB

Download