Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:42
Static task
static1
Behavioral task
behavioral1
Sample
iceix_1.0.5.0.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
iceix_1.0.5.0.vir.exe
Resource
win10
General
-
Target
iceix_1.0.5.0.vir.exe
-
Size
194KB
-
MD5
3f184bb7936b3c7b0f8f73ca1bc492b4
-
SHA1
20c77250d17f70068836f891e0c77aeb69a001c1
-
SHA256
4fdaee1072210091799af73f630e0eb993a1d2d42005dc096d1422d9924f1ad5
-
SHA512
d6e3ad4da3a9fb175c097937f9cfc0bb913bb4d82385c1f038ff690a1b007435884945b7841e9b4f6ee4b927f3e696c8ca6211330dd645bb2d768ab0de70f64d
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
otivelq.exepid process 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe 840 otivelq.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 1464 WinMail.exe -
Processes:
iceix_1.0.5.0.vir.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" iceix_1.0.5.0.vir.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy iceix_1.0.5.0.vir.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
iceix_1.0.5.0.vir.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 1144 iceix_1.0.5.0.vir.exe Token: SeSecurityPrivilege 1144 iceix_1.0.5.0.vir.exe Token: SeSecurityPrivilege 1144 iceix_1.0.5.0.vir.exe Token: SeManageVolumePrivilege 1464 WinMail.exe -
Loads dropped DLL 1 IoCs
Processes:
iceix_1.0.5.0.vir.exepid process 1144 iceix_1.0.5.0.vir.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
iceix_1.0.5.0.vir.exeotivelq.exedescription pid process target process PID 1144 wrote to memory of 840 1144 iceix_1.0.5.0.vir.exe otivelq.exe PID 1144 wrote to memory of 840 1144 iceix_1.0.5.0.vir.exe otivelq.exe PID 1144 wrote to memory of 840 1144 iceix_1.0.5.0.vir.exe otivelq.exe PID 1144 wrote to memory of 840 1144 iceix_1.0.5.0.vir.exe otivelq.exe PID 840 wrote to memory of 1124 840 otivelq.exe taskhost.exe PID 840 wrote to memory of 1124 840 otivelq.exe taskhost.exe PID 840 wrote to memory of 1124 840 otivelq.exe taskhost.exe PID 840 wrote to memory of 1124 840 otivelq.exe taskhost.exe PID 840 wrote to memory of 1124 840 otivelq.exe taskhost.exe PID 840 wrote to memory of 1212 840 otivelq.exe Dwm.exe PID 840 wrote to memory of 1212 840 otivelq.exe Dwm.exe PID 840 wrote to memory of 1212 840 otivelq.exe Dwm.exe PID 840 wrote to memory of 1212 840 otivelq.exe Dwm.exe PID 840 wrote to memory of 1212 840 otivelq.exe Dwm.exe PID 840 wrote to memory of 1264 840 otivelq.exe Explorer.EXE PID 840 wrote to memory of 1264 840 otivelq.exe Explorer.EXE PID 840 wrote to memory of 1264 840 otivelq.exe Explorer.EXE PID 840 wrote to memory of 1264 840 otivelq.exe Explorer.EXE PID 840 wrote to memory of 1264 840 otivelq.exe Explorer.EXE PID 840 wrote to memory of 1144 840 otivelq.exe iceix_1.0.5.0.vir.exe PID 840 wrote to memory of 1144 840 otivelq.exe iceix_1.0.5.0.vir.exe PID 840 wrote to memory of 1144 840 otivelq.exe iceix_1.0.5.0.vir.exe PID 840 wrote to memory of 1144 840 otivelq.exe iceix_1.0.5.0.vir.exe PID 840 wrote to memory of 1144 840 otivelq.exe iceix_1.0.5.0.vir.exe PID 1144 wrote to memory of 1864 1144 iceix_1.0.5.0.vir.exe cmd.exe PID 1144 wrote to memory of 1864 1144 iceix_1.0.5.0.vir.exe cmd.exe PID 1144 wrote to memory of 1864 1144 iceix_1.0.5.0.vir.exe cmd.exe PID 1144 wrote to memory of 1864 1144 iceix_1.0.5.0.vir.exe cmd.exe PID 1144 wrote to memory of 1864 1144 iceix_1.0.5.0.vir.exe cmd.exe PID 1144 wrote to memory of 1864 1144 iceix_1.0.5.0.vir.exe cmd.exe PID 1144 wrote to memory of 1864 1144 iceix_1.0.5.0.vir.exe cmd.exe PID 1144 wrote to memory of 1864 1144 iceix_1.0.5.0.vir.exe cmd.exe PID 1144 wrote to memory of 1864 1144 iceix_1.0.5.0.vir.exe cmd.exe PID 840 wrote to memory of 1928 840 otivelq.exe DllHost.exe PID 840 wrote to memory of 1928 840 otivelq.exe DllHost.exe PID 840 wrote to memory of 1928 840 otivelq.exe DllHost.exe PID 840 wrote to memory of 1928 840 otivelq.exe DllHost.exe PID 840 wrote to memory of 1928 840 otivelq.exe DllHost.exe PID 840 wrote to memory of 580 840 otivelq.exe DllHost.exe PID 840 wrote to memory of 580 840 otivelq.exe DllHost.exe PID 840 wrote to memory of 580 840 otivelq.exe DllHost.exe PID 840 wrote to memory of 580 840 otivelq.exe DllHost.exe PID 840 wrote to memory of 580 840 otivelq.exe DllHost.exe -
Executes dropped EXE 1 IoCs
Processes:
otivelq.exepid process 840 otivelq.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 1464 WinMail.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 1464 WinMail.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
iceix_1.0.5.0.vir.exedescription pid process target process PID 1144 set thread context of 1864 1144 iceix_1.0.5.0.vir.exe cmd.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1864 cmd.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\6FC61AD1-00000001.eml:OECustomProperty WinMail.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
otivelq.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run otivelq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{90B0D4EB-2FDB-868D-3DE2-DE24232586DB} = "C:\\Users\\Admin\\AppData\\Roaming\\Imci\\otivelq.exe" otivelq.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\iceix_1.0.5.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\iceix_1.0.5.0.vir.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Imci\otivelq.exe"C:\Users\Admin\AppData\Roaming\Imci\otivelq.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpc0610b10.bat"3⤵
- Deletes itself
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of SendNotifyMessage
- NTFS ADS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpc0610b10.bat
-
C:\Users\Admin\AppData\Roaming\Buupas\damuaf.gey
-
C:\Users\Admin\AppData\Roaming\Imci\otivelq.exe
-
C:\Users\Admin\AppData\Roaming\Imci\otivelq.exe
-
\Users\Admin\AppData\Roaming\Imci\otivelq.exe
-
memory/840-1-0x0000000000000000-mapping.dmp
-
memory/1464-4-0x0000000003910000-0x0000000003A10000-memory.dmpFilesize
1024KB
-
memory/1464-6-0x0000000003910000-0x0000000003B10000-memory.dmpFilesize
2.0MB
-
memory/1464-8-0x0000000003910000-0x0000000003A10000-memory.dmpFilesize
1024KB
-
memory/1464-9-0x0000000003910000-0x0000000003B10000-memory.dmpFilesize
2.0MB
-
memory/1464-10-0x0000000003A10000-0x0000000003B10000-memory.dmpFilesize
1024KB
-
memory/1464-14-0x0000000003650000-0x0000000003652000-memory.dmpFilesize
8KB
-
memory/1464-15-0x0000000003660000-0x0000000003662000-memory.dmpFilesize
8KB
-
memory/1464-16-0x0000000003670000-0x0000000003672000-memory.dmpFilesize
8KB
-
memory/1464-17-0x0000000003650000-0x0000000003652000-memory.dmpFilesize
8KB
-
memory/1464-18-0x0000000003B40000-0x0000000003B42000-memory.dmpFilesize
8KB
-
memory/1464-19-0x0000000003FE0000-0x0000000003FE2000-memory.dmpFilesize
8KB
-
memory/1464-20-0x0000000003F20000-0x0000000003F22000-memory.dmpFilesize
8KB
-
memory/1464-21-0x0000000003F20000-0x0000000003F22000-memory.dmpFilesize
8KB
-
memory/1464-22-0x0000000003B40000-0x0000000003B42000-memory.dmpFilesize
8KB
-
memory/1464-23-0x0000000004210000-0x0000000004212000-memory.dmpFilesize
8KB
-
memory/1464-24-0x0000000004220000-0x0000000004222000-memory.dmpFilesize
8KB
-
memory/1464-25-0x0000000003F20000-0x0000000003F22000-memory.dmpFilesize
8KB
-
memory/1464-26-0x0000000004210000-0x0000000004212000-memory.dmpFilesize
8KB
-
memory/1464-27-0x0000000004220000-0x0000000004222000-memory.dmpFilesize
8KB
-
memory/1464-28-0x0000000004360000-0x0000000004362000-memory.dmpFilesize
8KB
-
memory/1464-29-0x0000000004180000-0x0000000004182000-memory.dmpFilesize
8KB
-
memory/1464-30-0x0000000004370000-0x0000000004372000-memory.dmpFilesize
8KB
-
memory/1464-31-0x0000000004220000-0x0000000004222000-memory.dmpFilesize
8KB
-
memory/1464-32-0x0000000003F70000-0x0000000003F72000-memory.dmpFilesize
8KB
-
memory/1464-33-0x0000000004210000-0x0000000004212000-memory.dmpFilesize
8KB
-
memory/1464-34-0x0000000004340000-0x0000000004342000-memory.dmpFilesize
8KB
-
memory/1464-35-0x0000000003F70000-0x0000000003F72000-memory.dmpFilesize
8KB
-
memory/1464-36-0x0000000004220000-0x0000000004222000-memory.dmpFilesize
8KB
-
memory/1464-37-0x0000000003F90000-0x0000000003F92000-memory.dmpFilesize
8KB
-
memory/1464-38-0x0000000003B40000-0x0000000003B42000-memory.dmpFilesize
8KB
-
memory/1464-39-0x0000000003FC0000-0x0000000003FC2000-memory.dmpFilesize
8KB
-
memory/1464-40-0x0000000003650000-0x0000000003652000-memory.dmpFilesize
8KB
-
memory/1464-41-0x0000000004080000-0x0000000004082000-memory.dmpFilesize
8KB
-
memory/1464-42-0x0000000003F10000-0x0000000003F12000-memory.dmpFilesize
8KB
-
memory/1464-43-0x00000000040D0000-0x00000000040D2000-memory.dmpFilesize
8KB
-
memory/1464-44-0x0000000003FB0000-0x0000000003FB2000-memory.dmpFilesize
8KB
-
memory/1464-45-0x0000000003F70000-0x0000000003F72000-memory.dmpFilesize
8KB
-
memory/1464-46-0x00000000040E0000-0x00000000040E2000-memory.dmpFilesize
8KB
-
memory/1464-47-0x00000000040F0000-0x00000000040F2000-memory.dmpFilesize
8KB
-
memory/1464-48-0x0000000004100000-0x0000000004102000-memory.dmpFilesize
8KB
-
memory/1464-49-0x0000000004110000-0x0000000004112000-memory.dmpFilesize
8KB
-
memory/1464-50-0x0000000003910000-0x0000000003A10000-memory.dmpFilesize
1024KB
-
memory/1464-52-0x0000000002400000-0x0000000002410000-memory.dmpFilesize
64KB
-
memory/1464-58-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/1864-64-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/1864-66-0x000000000005C289-mapping.dmp