4bbbd985c466704a96ff939f0b3f42efd162adaefa1ae9025e43fbc2ce254101

General

Target

iceix_1.1.0.0.vir.exe
Size

204KB
MD5

c0ead8298af19f5c2fc1508ba0172395
SHA1

ffe1920e7ab7d3e0ceb229a660b234d8e4eaea35
SHA256

4bbbd985c466704a96ff939f0b3f42efd162adaefa1ae9025e43fbc2ce254101
SHA512

5e279ad1df6b7fd8c9fa9c464583e28198f3ad8e34ece48d78f6d6589944e44563ba5ebda9b92eab4052cca63d47ca750e045106dff9d5864051d0ae73f1d2ab

Score

8^/10

persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 69 IoCs

Processes:

iceix_1.1.0.0.vir.exeiceix_1.1.0.0.vir.exeguhozi.exeguhozi.exe

description	pid	process	target process
PID 2044 wrote to memory of 1096	2044	iceix_1.1.0.0.vir.exe	iceix_1.1.0.0.vir.exe
PID 2044 wrote to memory of 1096	2044	iceix_1.1.0.0.vir.exe	iceix_1.1.0.0.vir.exe
PID 2044 wrote to memory of 1096	2044	iceix_1.1.0.0.vir.exe	iceix_1.1.0.0.vir.exe
PID 2044 wrote to memory of 1096	2044	iceix_1.1.0.0.vir.exe	iceix_1.1.0.0.vir.exe
PID 2044 wrote to memory of 1096	2044	iceix_1.1.0.0.vir.exe	iceix_1.1.0.0.vir.exe
PID 2044 wrote to memory of 1096	2044	iceix_1.1.0.0.vir.exe	iceix_1.1.0.0.vir.exe
PID 2044 wrote to memory of 1096	2044	iceix_1.1.0.0.vir.exe	iceix_1.1.0.0.vir.exe
PID 2044 wrote to memory of 1096	2044	iceix_1.1.0.0.vir.exe	iceix_1.1.0.0.vir.exe
PID 2044 wrote to memory of 1096	2044	iceix_1.1.0.0.vir.exe	iceix_1.1.0.0.vir.exe
PID 1096 wrote to memory of 1232	1096	iceix_1.1.0.0.vir.exe	guhozi.exe
PID 1096 wrote to memory of 1232	1096	iceix_1.1.0.0.vir.exe	guhozi.exe
PID 1096 wrote to memory of 1232	1096	iceix_1.1.0.0.vir.exe	guhozi.exe
PID 1096 wrote to memory of 1232	1096	iceix_1.1.0.0.vir.exe	guhozi.exe
PID 1232 wrote to memory of 1296	1232	guhozi.exe	guhozi.exe
PID 1232 wrote to memory of 1296	1232	guhozi.exe	guhozi.exe
PID 1232 wrote to memory of 1296	1232	guhozi.exe	guhozi.exe
PID 1232 wrote to memory of 1296	1232	guhozi.exe	guhozi.exe
PID 1232 wrote to memory of 1296	1232	guhozi.exe	guhozi.exe
PID 1232 wrote to memory of 1296	1232	guhozi.exe	guhozi.exe
PID 1232 wrote to memory of 1296	1232	guhozi.exe	guhozi.exe
PID 1232 wrote to memory of 1296	1232	guhozi.exe	guhozi.exe
PID 1232 wrote to memory of 1296	1232	guhozi.exe	guhozi.exe
PID 1296 wrote to memory of 1136	1296	guhozi.exe	taskhost.exe
PID 1296 wrote to memory of 1136	1296	guhozi.exe	taskhost.exe
PID 1296 wrote to memory of 1136	1296	guhozi.exe	taskhost.exe
PID 1296 wrote to memory of 1136	1296	guhozi.exe	taskhost.exe
PID 1296 wrote to memory of 1136	1296	guhozi.exe	taskhost.exe
PID 1296 wrote to memory of 1216	1296	guhozi.exe	Dwm.exe
PID 1296 wrote to memory of 1216	1296	guhozi.exe	Dwm.exe
PID 1296 wrote to memory of 1216	1296	guhozi.exe	Dwm.exe
PID 1296 wrote to memory of 1216	1296	guhozi.exe	Dwm.exe
PID 1296 wrote to memory of 1216	1296	guhozi.exe	Dwm.exe
PID 1296 wrote to memory of 1256	1296	guhozi.exe	Explorer.EXE
PID 1296 wrote to memory of 1256	1296	guhozi.exe	Explorer.EXE
PID 1296 wrote to memory of 1256	1296	guhozi.exe	Explorer.EXE
PID 1296 wrote to memory of 1256	1296	guhozi.exe	Explorer.EXE
PID 1296 wrote to memory of 1256	1296	guhozi.exe	Explorer.EXE
PID 1296 wrote to memory of 1096	1296	guhozi.exe	iceix_1.1.0.0.vir.exe
PID 1296 wrote to memory of 1096	1296	guhozi.exe	iceix_1.1.0.0.vir.exe
PID 1296 wrote to memory of 1096	1296	guhozi.exe	iceix_1.1.0.0.vir.exe
PID 1296 wrote to memory of 1096	1296	guhozi.exe	iceix_1.1.0.0.vir.exe
PID 1296 wrote to memory of 1096	1296	guhozi.exe	iceix_1.1.0.0.vir.exe
PID 1096 wrote to memory of 1428	1096	iceix_1.1.0.0.vir.exe	cmd.exe
PID 1096 wrote to memory of 1428	1096	iceix_1.1.0.0.vir.exe	cmd.exe
PID 1096 wrote to memory of 1428	1096	iceix_1.1.0.0.vir.exe	cmd.exe
PID 1096 wrote to memory of 1428	1096	iceix_1.1.0.0.vir.exe	cmd.exe
PID 1296 wrote to memory of 1428	1296	guhozi.exe	cmd.exe
PID 1296 wrote to memory of 1428	1296	guhozi.exe	cmd.exe
PID 1296 wrote to memory of 1428	1296	guhozi.exe	cmd.exe
PID 1296 wrote to memory of 1428	1296	guhozi.exe	cmd.exe
PID 1296 wrote to memory of 1428	1296	guhozi.exe	cmd.exe
PID 1296 wrote to memory of 112	1296	guhozi.exe	conhost.exe
PID 1296 wrote to memory of 112	1296	guhozi.exe	conhost.exe
PID 1296 wrote to memory of 112	1296	guhozi.exe	conhost.exe
PID 1296 wrote to memory of 1064	1296	guhozi.exe	DllHost.exe
PID 1296 wrote to memory of 1064	1296	guhozi.exe	DllHost.exe
PID 1296 wrote to memory of 1064	1296	guhozi.exe	DllHost.exe
PID 1296 wrote to memory of 1064	1296	guhozi.exe	DllHost.exe
PID 1296 wrote to memory of 1064	1296	guhozi.exe	DllHost.exe
PID 1296 wrote to memory of 1676	1296	guhozi.exe	DllHost.exe
PID 1296 wrote to memory of 1676	1296	guhozi.exe	DllHost.exe
PID 1296 wrote to memory of 1676	1296	guhozi.exe	DllHost.exe
PID 1296 wrote to memory of 1676	1296	guhozi.exe	DllHost.exe
PID 1296 wrote to memory of 1676	1296	guhozi.exe	DllHost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

iceix_1.1.0.0.vir.exeguhozi.exe

description	pid	process	target process
PID 2044 set thread context of 1096	2044	iceix_1.1.0.0.vir.exe	iceix_1.1.0.0.vir.exe
PID 1232 set thread context of 1296	1232	guhozi.exe	guhozi.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

iceix_1.1.0.0.vir.execmd.exe

description pid process

Token: SeSecurityPrivilege 1096 iceix_1.1.0.0.vir.exe
Token: SeSecurityPrivilege 1428 cmd.exe
Token: SeSecurityPrivilege 1428 cmd.exe
Loads dropped DLL 2 IoCs

Processes:

iceix_1.1.0.0.vir.exe

pid process

1096 iceix_1.1.0.0.vir.exe
1096 iceix_1.1.0.0.vir.exe
Executes dropped EXE 2 IoCs

Processes:

guhozi.exeguhozi.exe

pid process

1232 guhozi.exe
1296 guhozi.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1428 cmd.exe

description	pid	process
Token: SeSecurityPrivilege	1096	iceix_1.1.0.0.vir.exe
Token: SeSecurityPrivilege	1428	cmd.exe
Token: SeSecurityPrivilege	1428	cmd.exe

pid	process
1096	iceix_1.1.0.0.vir.exe
1096	iceix_1.1.0.0.vir.exe

pid	process
1232	guhozi.exe
1296	guhozi.exe

pid	process
1428	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

iceix_1.1.0.0.vir.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy	iceix_1.1.0.0.vir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	iceix_1.1.0.0.vir.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

guhozi.exe

pid	process
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe
1296	guhozi.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

guhozi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{CED011A0-D6DD-5EA3-E4E0-C4E424E5FE3E} = "C:\\Users\\Admin\\AppData\\Roaming\\Umxeedi\\guhozi.exe"	guhozi.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run	guhozi.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1136

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1216

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256

C:\Users\Admin\AppData\Local\Temp\iceix_1.1.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\iceix_1.1.0.0.vir.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:2044

C:\Users\Admin\AppData\Local\Temp\iceix_1.1.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\iceix_1.1.0.0.vir.exe"
3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Modifies Internet Explorer settings
PID:1096

C:\Users\Admin\AppData\Roaming\Umxeedi\guhozi.exe
"C:\Users\Admin\AppData\Roaming\Umxeedi\guhozi.exe"
4⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:1232

C:\Users\Admin\AppData\Roaming\Umxeedi\guhozi.exe
"C:\Users\Admin\AppData\Roaming\Umxeedi\guhozi.exe"
5⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
PID:1296

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp84e131f6.bat"
4⤵
- Suspicious use of AdjustPrivilegeToken
- Deletes itself
PID:1428

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-155223901-259937598-886644994-788019408-1217817596-1354004447-694162565216973296"
1⤵
PID:112

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1064

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1676

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp84e131f6.bat

Download Submit
C:\Users\Admin\AppData\Roaming\Umxeedi\guhozi.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Umxeedi\guhozi.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Umxeedi\guhozi.exe

Download Submit
\Users\Admin\AppData\Roaming\Umxeedi\guhozi.exe

Download Submit
\Users\Admin\AppData\Roaming\Umxeedi\guhozi.exe

Download Submit
memory/1096-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1096-2-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1096-12-0x000000000040FD1F-mapping.dmp

Download
memory/1096-1-0x000000000040FD1F-mapping.dmp

Download
memory/1232-5-0x0000000000000000-mapping.dmp

Download
memory/1296-9-0x000000000040FD1F-mapping.dmp

Download
memory/1428-13-0x0000000000000000-mapping.dmp

Download
memory/1428-14-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads