Analysis
-
max time kernel
151s -
max time network
117s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:43
Static task
static1
Behavioral task
behavioral1
Sample
iceix_1.2.2.3.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
iceix_1.2.2.3.vir.exe
Resource
win10
General
-
Target
iceix_1.2.2.3.vir.exe
-
Size
140KB
-
MD5
c84b29b97802a87d61edbd32411eb507
-
SHA1
908e1224f6279f829b0611b387159335bb46b0e0
-
SHA256
13fc782399baf36e770245323f843a4ac8232cd8a683709ef6e992ec229caf07
-
SHA512
7acbc27992b8bb9c19f68b1ae54b0e74c07a4b6ad8954cdd2f16debe8aa69b3919cf4d22fc142c4a255425866d70f813e6c531ef84b63fb038f8f28fe6d5d484
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1756 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
koboha.exepid process 1288 koboha.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\058A317E-00000001.eml:OECustomProperty WinMail.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
koboha.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run koboha.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{514B75A0-D657-77D9-6DBF-B887ADF33CC0} = "C:\\Users\\Admin\\AppData\\Roaming\\Ezywamh\\koboha.exe" koboha.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
netsh.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe -
Loads dropped DLL 2 IoCs
Processes:
iceix_1.2.2.3.vir.exepid process 900 iceix_1.2.2.3.vir.exe 900 iceix_1.2.2.3.vir.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
koboha.exepid process 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe 1288 koboha.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 272 WinMail.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
iceix_1.2.2.3.vir.exedescription pid process target process PID 900 set thread context of 1756 900 iceix_1.2.2.3.vir.exe cmd.exe -
Processes:
iceix_1.2.2.3.vir.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy iceix_1.2.2.3.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" iceix_1.2.2.3.vir.exe -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
iceix_1.2.2.3.vir.exekoboha.execmd.exedescription pid process target process PID 900 wrote to memory of 1104 900 iceix_1.2.2.3.vir.exe cmd.exe PID 900 wrote to memory of 1104 900 iceix_1.2.2.3.vir.exe cmd.exe PID 900 wrote to memory of 1104 900 iceix_1.2.2.3.vir.exe cmd.exe PID 900 wrote to memory of 1104 900 iceix_1.2.2.3.vir.exe cmd.exe PID 900 wrote to memory of 1288 900 iceix_1.2.2.3.vir.exe koboha.exe PID 900 wrote to memory of 1288 900 iceix_1.2.2.3.vir.exe koboha.exe PID 900 wrote to memory of 1288 900 iceix_1.2.2.3.vir.exe koboha.exe PID 900 wrote to memory of 1288 900 iceix_1.2.2.3.vir.exe koboha.exe PID 1288 wrote to memory of 1144 1288 koboha.exe taskhost.exe PID 1288 wrote to memory of 1144 1288 koboha.exe taskhost.exe PID 1288 wrote to memory of 1144 1288 koboha.exe taskhost.exe PID 1288 wrote to memory of 1144 1288 koboha.exe taskhost.exe PID 1288 wrote to memory of 1144 1288 koboha.exe taskhost.exe PID 1288 wrote to memory of 1252 1288 koboha.exe Dwm.exe PID 1288 wrote to memory of 1252 1288 koboha.exe Dwm.exe PID 1288 wrote to memory of 1252 1288 koboha.exe Dwm.exe PID 1288 wrote to memory of 1252 1288 koboha.exe Dwm.exe PID 1288 wrote to memory of 1252 1288 koboha.exe Dwm.exe PID 1288 wrote to memory of 1292 1288 koboha.exe Explorer.EXE PID 1288 wrote to memory of 1292 1288 koboha.exe Explorer.EXE PID 1288 wrote to memory of 1292 1288 koboha.exe Explorer.EXE PID 1288 wrote to memory of 1292 1288 koboha.exe Explorer.EXE PID 1288 wrote to memory of 1292 1288 koboha.exe Explorer.EXE PID 1288 wrote to memory of 900 1288 koboha.exe iceix_1.2.2.3.vir.exe PID 1288 wrote to memory of 900 1288 koboha.exe iceix_1.2.2.3.vir.exe PID 1288 wrote to memory of 900 1288 koboha.exe iceix_1.2.2.3.vir.exe PID 1288 wrote to memory of 900 1288 koboha.exe iceix_1.2.2.3.vir.exe PID 1288 wrote to memory of 900 1288 koboha.exe iceix_1.2.2.3.vir.exe PID 1104 wrote to memory of 240 1104 cmd.exe netsh.exe PID 1104 wrote to memory of 240 1104 cmd.exe netsh.exe PID 1104 wrote to memory of 240 1104 cmd.exe netsh.exe PID 1104 wrote to memory of 240 1104 cmd.exe netsh.exe PID 900 wrote to memory of 1756 900 iceix_1.2.2.3.vir.exe cmd.exe PID 900 wrote to memory of 1756 900 iceix_1.2.2.3.vir.exe cmd.exe PID 900 wrote to memory of 1756 900 iceix_1.2.2.3.vir.exe cmd.exe PID 900 wrote to memory of 1756 900 iceix_1.2.2.3.vir.exe cmd.exe PID 900 wrote to memory of 1756 900 iceix_1.2.2.3.vir.exe cmd.exe PID 900 wrote to memory of 1756 900 iceix_1.2.2.3.vir.exe cmd.exe PID 900 wrote to memory of 1756 900 iceix_1.2.2.3.vir.exe cmd.exe PID 900 wrote to memory of 1756 900 iceix_1.2.2.3.vir.exe cmd.exe PID 900 wrote to memory of 1756 900 iceix_1.2.2.3.vir.exe cmd.exe PID 1288 wrote to memory of 2044 1288 koboha.exe DllHost.exe PID 1288 wrote to memory of 2044 1288 koboha.exe DllHost.exe PID 1288 wrote to memory of 2044 1288 koboha.exe DllHost.exe PID 1288 wrote to memory of 2044 1288 koboha.exe DllHost.exe PID 1288 wrote to memory of 2044 1288 koboha.exe DllHost.exe PID 1288 wrote to memory of 1472 1288 koboha.exe DllHost.exe PID 1288 wrote to memory of 1472 1288 koboha.exe DllHost.exe PID 1288 wrote to memory of 1472 1288 koboha.exe DllHost.exe PID 1288 wrote to memory of 1472 1288 koboha.exe DllHost.exe PID 1288 wrote to memory of 1472 1288 koboha.exe DllHost.exe PID 1288 wrote to memory of 744 1288 koboha.exe DllHost.exe PID 1288 wrote to memory of 744 1288 koboha.exe DllHost.exe PID 1288 wrote to memory of 744 1288 koboha.exe DllHost.exe PID 1288 wrote to memory of 744 1288 koboha.exe DllHost.exe PID 1288 wrote to memory of 744 1288 koboha.exe DllHost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 272 WinMail.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 272 WinMail.exe -
Modifies Windows Firewall 1 TTPs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
iceix_1.2.2.3.vir.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 900 iceix_1.2.2.3.vir.exe Token: SeSecurityPrivilege 900 iceix_1.2.2.3.vir.exe Token: SeSecurityPrivilege 900 iceix_1.2.2.3.vir.exe Token: SeManageVolumePrivilege 272 WinMail.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\iceix_1.2.2.3.vir.exe"C:\Users\Admin\AppData\Local\Temp\iceix_1.2.2.3.vir.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp5194d3c5.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="explore" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Ezywamh\koboha.exe"4⤵
- Modifies service
-
C:\Users\Admin\AppData\Roaming\Ezywamh\koboha.exe"C:\Users\Admin\AppData\Roaming\Ezywamh\koboha.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp921d7ccf.bat"3⤵
- Deletes itself
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5194d3c5.bat
-
C:\Users\Admin\AppData\Local\Temp\tmp921d7ccf.bat
-
C:\Users\Admin\AppData\Roaming\Ezywamh\koboha.exe
-
C:\Users\Admin\AppData\Roaming\Ezywamh\koboha.exe
-
C:\Users\Admin\AppData\Roaming\Wio\owawpie.waa
-
\Users\Admin\AppData\Roaming\Ezywamh\koboha.exe
-
\Users\Admin\AppData\Roaming\Ezywamh\koboha.exe
-
memory/240-7-0x0000000000000000-mapping.dmp
-
memory/272-32-0x0000000004410000-0x0000000004412000-memory.dmpFilesize
8KB
-
memory/272-37-0x0000000004980000-0x0000000004982000-memory.dmpFilesize
8KB
-
memory/272-13-0x00000000038D0000-0x0000000003AD0000-memory.dmpFilesize
2.0MB
-
memory/272-14-0x00000000039D0000-0x0000000003AD0000-memory.dmpFilesize
1024KB
-
memory/272-18-0x0000000003AE0000-0x0000000003AE2000-memory.dmpFilesize
8KB
-
memory/272-19-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/272-20-0x0000000003AD0000-0x0000000003AD2000-memory.dmpFilesize
8KB
-
memory/272-21-0x0000000003C20000-0x0000000003C22000-memory.dmpFilesize
8KB
-
memory/272-22-0x0000000003D80000-0x0000000003D82000-memory.dmpFilesize
8KB
-
memory/272-23-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/272-24-0x0000000003DC0000-0x0000000003DC2000-memory.dmpFilesize
8KB
-
memory/272-25-0x0000000003DD0000-0x0000000003DD2000-memory.dmpFilesize
8KB
-
memory/272-26-0x0000000003D60000-0x0000000003D62000-memory.dmpFilesize
8KB
-
memory/272-27-0x0000000003C20000-0x0000000003C22000-memory.dmpFilesize
8KB
-
memory/272-28-0x0000000003D60000-0x0000000003D62000-memory.dmpFilesize
8KB
-
memory/272-29-0x0000000003D90000-0x0000000003D92000-memory.dmpFilesize
8KB
-
memory/272-30-0x0000000003B50000-0x0000000003B52000-memory.dmpFilesize
8KB
-
memory/272-31-0x0000000003E10000-0x0000000003E12000-memory.dmpFilesize
8KB
-
memory/272-10-0x00000000038D0000-0x0000000003AD0000-memory.dmpFilesize
2.0MB
-
memory/272-33-0x0000000004420000-0x0000000004422000-memory.dmpFilesize
8KB
-
memory/272-34-0x0000000004430000-0x0000000004432000-memory.dmpFilesize
8KB
-
memory/272-35-0x0000000004950000-0x0000000004952000-memory.dmpFilesize
8KB
-
memory/272-36-0x0000000004970000-0x0000000004972000-memory.dmpFilesize
8KB
-
memory/272-12-0x00000000038D0000-0x00000000039D0000-memory.dmpFilesize
1024KB
-
memory/272-38-0x0000000004990000-0x0000000004992000-memory.dmpFilesize
8KB
-
memory/272-39-0x00000000049A0000-0x00000000049A2000-memory.dmpFilesize
8KB
-
memory/272-40-0x0000000004AB0000-0x0000000004AB2000-memory.dmpFilesize
8KB
-
memory/272-41-0x0000000004BA0000-0x0000000004BA2000-memory.dmpFilesize
8KB
-
memory/272-42-0x0000000004C30000-0x0000000004C32000-memory.dmpFilesize
8KB
-
memory/272-43-0x0000000004CC0000-0x0000000004CC2000-memory.dmpFilesize
8KB
-
memory/272-44-0x0000000004CD0000-0x0000000004CD2000-memory.dmpFilesize
8KB
-
memory/272-45-0x0000000003B60000-0x0000000003B62000-memory.dmpFilesize
8KB
-
memory/272-46-0x0000000003C30000-0x0000000003C32000-memory.dmpFilesize
8KB
-
memory/272-47-0x0000000004B20000-0x0000000004B22000-memory.dmpFilesize
8KB
-
memory/272-48-0x0000000004B10000-0x0000000004B12000-memory.dmpFilesize
8KB
-
memory/272-49-0x0000000004B00000-0x0000000004B02000-memory.dmpFilesize
8KB
-
memory/272-50-0x0000000004AF0000-0x0000000004AF2000-memory.dmpFilesize
8KB
-
memory/272-51-0x0000000004AD0000-0x0000000004AD2000-memory.dmpFilesize
8KB
-
memory/272-52-0x00000000038D0000-0x00000000039D0000-memory.dmpFilesize
1024KB
-
memory/272-54-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/272-60-0x00000000020B0000-0x00000000020C0000-memory.dmpFilesize
64KB
-
memory/272-8-0x00000000038D0000-0x00000000039D0000-memory.dmpFilesize
1024KB
-
memory/1104-0-0x0000000000000000-mapping.dmp
-
memory/1288-3-0x0000000000000000-mapping.dmp
-
memory/1756-66-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/1756-68-0x000000000005F547-mapping.dmp