Analysis
-
max time kernel
151s -
max time network
116s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 16:48
Static task
static1
Behavioral task
behavioral1
Sample
iceix_1.1.9.0.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
iceix_1.1.9.0.vir.exe
Resource
win10
General
-
Target
iceix_1.1.9.0.vir.exe
-
Size
133KB
-
MD5
d95ee3bc107f56a0eba7ac26b5d64d19
-
SHA1
e44872d85ae1d6e165d72252f4055e47d59c4c59
-
SHA256
476a2cba7810fec1e2036c840308d603fce4b69c3b4fbb7d6938f89346a6adfd
-
SHA512
d457897cee15821c7acc658f849842150546c50d87cd3c46acd377f19b1c380817f1aec5e864563638214d3df35c895edb95e9068b71d8be71deeb430e0ca352
Malware Config
Signatures
-
Processes:
iceix_1.1.9.0.vir.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy iceix_1.1.9.0.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" iceix_1.1.9.0.vir.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
hyidep.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run hyidep.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{067AC641-9817-D025-B732-44D72D9AB090} = "C:\\Users\\Admin\\AppData\\Roaming\\Vuz\\hyidep.exe" hyidep.exe -
Loads dropped DLL 2 IoCs
Processes:
iceix_1.1.9.0.vir.exepid process 896 iceix_1.1.9.0.vir.exe 896 iceix_1.1.9.0.vir.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
iceix_1.1.9.0.vir.exehyidep.exedescription pid process target process PID 896 wrote to memory of 1580 896 iceix_1.1.9.0.vir.exe hyidep.exe PID 896 wrote to memory of 1580 896 iceix_1.1.9.0.vir.exe hyidep.exe PID 896 wrote to memory of 1580 896 iceix_1.1.9.0.vir.exe hyidep.exe PID 896 wrote to memory of 1580 896 iceix_1.1.9.0.vir.exe hyidep.exe PID 1580 wrote to memory of 1144 1580 hyidep.exe taskhost.exe PID 1580 wrote to memory of 1144 1580 hyidep.exe taskhost.exe PID 1580 wrote to memory of 1144 1580 hyidep.exe taskhost.exe PID 1580 wrote to memory of 1144 1580 hyidep.exe taskhost.exe PID 1580 wrote to memory of 1144 1580 hyidep.exe taskhost.exe PID 1580 wrote to memory of 1208 1580 hyidep.exe Dwm.exe PID 1580 wrote to memory of 1208 1580 hyidep.exe Dwm.exe PID 1580 wrote to memory of 1208 1580 hyidep.exe Dwm.exe PID 1580 wrote to memory of 1208 1580 hyidep.exe Dwm.exe PID 1580 wrote to memory of 1208 1580 hyidep.exe Dwm.exe PID 1580 wrote to memory of 1276 1580 hyidep.exe Explorer.EXE PID 1580 wrote to memory of 1276 1580 hyidep.exe Explorer.EXE PID 1580 wrote to memory of 1276 1580 hyidep.exe Explorer.EXE PID 1580 wrote to memory of 1276 1580 hyidep.exe Explorer.EXE PID 1580 wrote to memory of 1276 1580 hyidep.exe Explorer.EXE PID 1580 wrote to memory of 896 1580 hyidep.exe iceix_1.1.9.0.vir.exe PID 1580 wrote to memory of 896 1580 hyidep.exe iceix_1.1.9.0.vir.exe PID 1580 wrote to memory of 896 1580 hyidep.exe iceix_1.1.9.0.vir.exe PID 1580 wrote to memory of 896 1580 hyidep.exe iceix_1.1.9.0.vir.exe PID 1580 wrote to memory of 896 1580 hyidep.exe iceix_1.1.9.0.vir.exe PID 1580 wrote to memory of 1040 1580 hyidep.exe WinMail.exe PID 1580 wrote to memory of 1040 1580 hyidep.exe WinMail.exe PID 1580 wrote to memory of 1040 1580 hyidep.exe WinMail.exe PID 1580 wrote to memory of 1040 1580 hyidep.exe WinMail.exe PID 1580 wrote to memory of 1040 1580 hyidep.exe WinMail.exe PID 896 wrote to memory of 1928 896 iceix_1.1.9.0.vir.exe cmd.exe PID 896 wrote to memory of 1928 896 iceix_1.1.9.0.vir.exe cmd.exe PID 896 wrote to memory of 1928 896 iceix_1.1.9.0.vir.exe cmd.exe PID 896 wrote to memory of 1928 896 iceix_1.1.9.0.vir.exe cmd.exe PID 896 wrote to memory of 1928 896 iceix_1.1.9.0.vir.exe cmd.exe PID 896 wrote to memory of 1928 896 iceix_1.1.9.0.vir.exe cmd.exe PID 896 wrote to memory of 1928 896 iceix_1.1.9.0.vir.exe cmd.exe PID 896 wrote to memory of 1928 896 iceix_1.1.9.0.vir.exe cmd.exe PID 896 wrote to memory of 1928 896 iceix_1.1.9.0.vir.exe cmd.exe PID 1580 wrote to memory of 1984 1580 hyidep.exe DllHost.exe PID 1580 wrote to memory of 1984 1580 hyidep.exe DllHost.exe PID 1580 wrote to memory of 1984 1580 hyidep.exe DllHost.exe PID 1580 wrote to memory of 1984 1580 hyidep.exe DllHost.exe PID 1580 wrote to memory of 1984 1580 hyidep.exe DllHost.exe PID 1580 wrote to memory of 1856 1580 hyidep.exe DllHost.exe PID 1580 wrote to memory of 1856 1580 hyidep.exe DllHost.exe PID 1580 wrote to memory of 1856 1580 hyidep.exe DllHost.exe PID 1580 wrote to memory of 1856 1580 hyidep.exe DllHost.exe PID 1580 wrote to memory of 1856 1580 hyidep.exe DllHost.exe -
Executes dropped EXE 1 IoCs
Processes:
hyidep.exepid process 1580 hyidep.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
hyidep.exepid process 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe 1580 hyidep.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WinMail.exeWinMail.exepid process 1040 WinMail.exe 656 WinMail.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\23340A68-00000001.eml:OECustomProperty WinMail.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
iceix_1.1.9.0.vir.exeWinMail.execmd.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 896 iceix_1.1.9.0.vir.exe Token: SeSecurityPrivilege 896 iceix_1.1.9.0.vir.exe Token: SeSecurityPrivilege 896 iceix_1.1.9.0.vir.exe Token: SeManageVolumePrivilege 1040 WinMail.exe Token: SeSecurityPrivilege 1928 cmd.exe Token: SeManageVolumePrivilege 656 WinMail.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
WinMail.exeWinMail.exepid process 1040 WinMail.exe 656 WinMail.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
WinMail.exeWinMail.exepid process 1040 WinMail.exe 656 WinMail.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
iceix_1.1.9.0.vir.exedescription pid process target process PID 896 set thread context of 1928 896 iceix_1.1.9.0.vir.exe cmd.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1928 cmd.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\iceix_1.1.9.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\iceix_1.1.9.0.vir.exe"2⤵
- Modifies Internet Explorer settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Vuz\hyidep.exe"C:\Users\Admin\AppData\Roaming\Vuz\hyidep.exe"3⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp338f93e3.bat"3⤵
- Suspicious use of AdjustPrivilegeToken
- Deletes itself
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.chk
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log
-
C:\Users\Admin\AppData\Local\Temp\tmp338f93e3.bat
-
C:\Users\Admin\AppData\Roaming\Gaup\niahuz.zyy
-
C:\Users\Admin\AppData\Roaming\Vuz\hyidep.exe
-
C:\Users\Admin\AppData\Roaming\Vuz\hyidep.exe
-
\Users\Admin\AppData\Roaming\Vuz\hyidep.exe
-
\Users\Admin\AppData\Roaming\Vuz\hyidep.exe
-
memory/656-75-0x00000000039F0000-0x0000000003AF0000-memory.dmpFilesize
1024KB
-
memory/656-74-0x00000000038F0000-0x0000000003AF0000-memory.dmpFilesize
2.0MB
-
memory/656-73-0x00000000038F0000-0x00000000039F0000-memory.dmpFilesize
1024KB
-
memory/656-82-0x0000000003EC0000-0x0000000003EC2000-memory.dmpFilesize
8KB
-
memory/656-86-0x0000000002660000-0x0000000002662000-memory.dmpFilesize
8KB
-
memory/656-87-0x00000000038F0000-0x00000000039F0000-memory.dmpFilesize
1024KB
-
memory/1040-38-0x0000000004190000-0x0000000004192000-memory.dmpFilesize
8KB
-
memory/1040-47-0x00000000042D0000-0x00000000042D2000-memory.dmpFilesize
8KB
-
memory/1040-27-0x0000000004040000-0x0000000004042000-memory.dmpFilesize
8KB
-
memory/1040-28-0x0000000002550000-0x0000000002552000-memory.dmpFilesize
8KB
-
memory/1040-29-0x0000000003FD0000-0x0000000003FD2000-memory.dmpFilesize
8KB
-
memory/1040-30-0x0000000003C40000-0x0000000003C42000-memory.dmpFilesize
8KB
-
memory/1040-31-0x00000000040D0000-0x00000000040D2000-memory.dmpFilesize
8KB
-
memory/1040-33-0x00000000040E0000-0x00000000040E2000-memory.dmpFilesize
8KB
-
memory/1040-5-0x0000000003910000-0x0000000003A10000-memory.dmpFilesize
1024KB
-
memory/1040-7-0x0000000003910000-0x0000000003B10000-memory.dmpFilesize
2.0MB
-
memory/1040-34-0x00000000040F0000-0x00000000040F2000-memory.dmpFilesize
8KB
-
memory/1040-35-0x0000000004110000-0x0000000004112000-memory.dmpFilesize
8KB
-
memory/1040-36-0x0000000004170000-0x0000000004172000-memory.dmpFilesize
8KB
-
memory/1040-37-0x0000000004180000-0x0000000004182000-memory.dmpFilesize
8KB
-
memory/1040-23-0x0000000003C80000-0x0000000003C82000-memory.dmpFilesize
8KB
-
memory/1040-39-0x00000000041A0000-0x00000000041A2000-memory.dmpFilesize
8KB
-
memory/1040-40-0x00000000042B0000-0x00000000042B2000-memory.dmpFilesize
8KB
-
memory/1040-41-0x0000000004530000-0x0000000004532000-memory.dmpFilesize
8KB
-
memory/1040-42-0x0000000004540000-0x0000000004542000-memory.dmpFilesize
8KB
-
memory/1040-43-0x0000000004550000-0x0000000004552000-memory.dmpFilesize
8KB
-
memory/1040-44-0x0000000004560000-0x0000000004562000-memory.dmpFilesize
8KB
-
memory/1040-45-0x0000000003B60000-0x0000000003B62000-memory.dmpFilesize
8KB
-
memory/1040-46-0x0000000003C30000-0x0000000003C32000-memory.dmpFilesize
8KB
-
memory/1040-24-0x0000000003C50000-0x0000000003C52000-memory.dmpFilesize
8KB
-
memory/1040-48-0x00000000042E0000-0x00000000042E2000-memory.dmpFilesize
8KB
-
memory/1040-49-0x00000000042F0000-0x00000000042F2000-memory.dmpFilesize
8KB
-
memory/1040-50-0x0000000004610000-0x0000000004612000-memory.dmpFilesize
8KB
-
memory/1040-51-0x0000000004620000-0x0000000004622000-memory.dmpFilesize
8KB
-
memory/1040-52-0x0000000003910000-0x0000000003B10000-memory.dmpFilesize
2.0MB
-
memory/1040-53-0x0000000003A10000-0x0000000003B10000-memory.dmpFilesize
1024KB
-
memory/1040-54-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/1040-60-0x0000000002340000-0x0000000002350000-memory.dmpFilesize
64KB
-
memory/1040-22-0x0000000003C90000-0x0000000003C92000-memory.dmpFilesize
8KB
-
memory/1040-21-0x0000000003EA0000-0x0000000003EA2000-memory.dmpFilesize
8KB
-
memory/1040-20-0x0000000002550000-0x0000000002552000-memory.dmpFilesize
8KB
-
memory/1040-19-0x0000000003FC0000-0x0000000003FC2000-memory.dmpFilesize
8KB
-
memory/1040-18-0x0000000003C50000-0x0000000003C52000-memory.dmpFilesize
8KB
-
memory/1040-17-0x0000000002560000-0x0000000002562000-memory.dmpFilesize
8KB
-
memory/1040-16-0x0000000002570000-0x0000000002572000-memory.dmpFilesize
8KB
-
memory/1040-15-0x0000000002550000-0x0000000002552000-memory.dmpFilesize
8KB
-
memory/1040-11-0x0000000003A10000-0x0000000003B10000-memory.dmpFilesize
1024KB
-
memory/1040-10-0x0000000003910000-0x0000000003B10000-memory.dmpFilesize
2.0MB
-
memory/1040-9-0x0000000003910000-0x0000000003A10000-memory.dmpFilesize
1024KB
-
memory/1580-2-0x0000000000000000-mapping.dmp
-
memory/1928-25-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/1928-32-0x00000000000688F6-mapping.dmp