Analysis
-
max time kernel
151s -
max time network
162s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
19-07-2020 19:41
Static task
static1
Behavioral task
behavioral1
Sample
iceix_1.1.6.0.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
iceix_1.1.6.0.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
iceix_1.1.6.0.vir.exe
-
Size
212KB
-
MD5
1b4a2c8c5fd4b3d3d5ac502efc6886ae
-
SHA1
dfcd9d67e66dc9cd0f59b37858caeb11e08f88aa
-
SHA256
e4f0a9d751979779844dbfa667cf901b1d297f986201870d365fadb3eea3d451
-
SHA512
2180e72c8823493a50daa50f34c342b83d3d79123bb97d46a6b62bf876a2a060d8ef49ef5e6e3c1b3b149b3a7ef06bd2d166d66fbbea14b94c75c9ff3cd1ee22
Score
8/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iceix_1.1.6.0.vir.exedescription pid process Token: SeSecurityPrivilege 1080 iceix_1.1.6.0.vir.exe -
Loads dropped DLL 2 IoCs
Processes:
iceix_1.1.6.0.vir.exepid process 1080 iceix_1.1.6.0.vir.exe 1080 iceix_1.1.6.0.vir.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
esreki.exepid process 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe 1396 esreki.exe -
Processes:
iceix_1.1.6.0.vir.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Privacy iceix_1.1.6.0.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" iceix_1.1.6.0.vir.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
esreki.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\Currentversion\Run esreki.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\{83819820-F220-5EA3-AB11-CD13659CF7C9} = "C:\\Users\\Admin\\AppData\\Roaming\\Acydq\\esreki.exe" esreki.exe -
Suspicious use of WriteProcessMemory 66 IoCs
Processes:
iceix_1.1.6.0.vir.exeiceix_1.1.6.0.vir.exeesreki.exeesreki.exedescription pid process target process PID 1064 wrote to memory of 1080 1064 iceix_1.1.6.0.vir.exe iceix_1.1.6.0.vir.exe PID 1064 wrote to memory of 1080 1064 iceix_1.1.6.0.vir.exe iceix_1.1.6.0.vir.exe PID 1064 wrote to memory of 1080 1064 iceix_1.1.6.0.vir.exe iceix_1.1.6.0.vir.exe PID 1064 wrote to memory of 1080 1064 iceix_1.1.6.0.vir.exe iceix_1.1.6.0.vir.exe PID 1064 wrote to memory of 1080 1064 iceix_1.1.6.0.vir.exe iceix_1.1.6.0.vir.exe PID 1064 wrote to memory of 1080 1064 iceix_1.1.6.0.vir.exe iceix_1.1.6.0.vir.exe PID 1064 wrote to memory of 1080 1064 iceix_1.1.6.0.vir.exe iceix_1.1.6.0.vir.exe PID 1064 wrote to memory of 1080 1064 iceix_1.1.6.0.vir.exe iceix_1.1.6.0.vir.exe PID 1064 wrote to memory of 1080 1064 iceix_1.1.6.0.vir.exe iceix_1.1.6.0.vir.exe PID 1080 wrote to memory of 1028 1080 iceix_1.1.6.0.vir.exe esreki.exe PID 1080 wrote to memory of 1028 1080 iceix_1.1.6.0.vir.exe esreki.exe PID 1080 wrote to memory of 1028 1080 iceix_1.1.6.0.vir.exe esreki.exe PID 1080 wrote to memory of 1028 1080 iceix_1.1.6.0.vir.exe esreki.exe PID 1028 wrote to memory of 1396 1028 esreki.exe esreki.exe PID 1028 wrote to memory of 1396 1028 esreki.exe esreki.exe PID 1028 wrote to memory of 1396 1028 esreki.exe esreki.exe PID 1028 wrote to memory of 1396 1028 esreki.exe esreki.exe PID 1028 wrote to memory of 1396 1028 esreki.exe esreki.exe PID 1028 wrote to memory of 1396 1028 esreki.exe esreki.exe PID 1028 wrote to memory of 1396 1028 esreki.exe esreki.exe PID 1028 wrote to memory of 1396 1028 esreki.exe esreki.exe PID 1028 wrote to memory of 1396 1028 esreki.exe esreki.exe PID 1396 wrote to memory of 1152 1396 esreki.exe taskhost.exe PID 1396 wrote to memory of 1152 1396 esreki.exe taskhost.exe PID 1396 wrote to memory of 1152 1396 esreki.exe taskhost.exe PID 1396 wrote to memory of 1152 1396 esreki.exe taskhost.exe PID 1396 wrote to memory of 1152 1396 esreki.exe taskhost.exe PID 1396 wrote to memory of 1256 1396 esreki.exe Dwm.exe PID 1396 wrote to memory of 1256 1396 esreki.exe Dwm.exe PID 1396 wrote to memory of 1256 1396 esreki.exe Dwm.exe PID 1396 wrote to memory of 1256 1396 esreki.exe Dwm.exe PID 1396 wrote to memory of 1256 1396 esreki.exe Dwm.exe PID 1396 wrote to memory of 1300 1396 esreki.exe Explorer.EXE PID 1396 wrote to memory of 1300 1396 esreki.exe Explorer.EXE PID 1396 wrote to memory of 1300 1396 esreki.exe Explorer.EXE PID 1396 wrote to memory of 1300 1396 esreki.exe Explorer.EXE PID 1396 wrote to memory of 1300 1396 esreki.exe Explorer.EXE PID 1396 wrote to memory of 1080 1396 esreki.exe iceix_1.1.6.0.vir.exe PID 1396 wrote to memory of 1080 1396 esreki.exe iceix_1.1.6.0.vir.exe PID 1396 wrote to memory of 1080 1396 esreki.exe iceix_1.1.6.0.vir.exe PID 1396 wrote to memory of 1080 1396 esreki.exe iceix_1.1.6.0.vir.exe PID 1396 wrote to memory of 1080 1396 esreki.exe iceix_1.1.6.0.vir.exe PID 1080 wrote to memory of 660 1080 iceix_1.1.6.0.vir.exe cmd.exe PID 1080 wrote to memory of 660 1080 iceix_1.1.6.0.vir.exe cmd.exe PID 1080 wrote to memory of 660 1080 iceix_1.1.6.0.vir.exe cmd.exe PID 1080 wrote to memory of 660 1080 iceix_1.1.6.0.vir.exe cmd.exe PID 1396 wrote to memory of 660 1396 esreki.exe cmd.exe PID 1396 wrote to memory of 660 1396 esreki.exe cmd.exe PID 1396 wrote to memory of 660 1396 esreki.exe cmd.exe PID 1396 wrote to memory of 660 1396 esreki.exe cmd.exe PID 1396 wrote to memory of 660 1396 esreki.exe cmd.exe PID 1396 wrote to memory of 1056 1396 esreki.exe DllHost.exe PID 1396 wrote to memory of 1056 1396 esreki.exe DllHost.exe PID 1396 wrote to memory of 1056 1396 esreki.exe DllHost.exe PID 1396 wrote to memory of 1056 1396 esreki.exe DllHost.exe PID 1396 wrote to memory of 1056 1396 esreki.exe DllHost.exe PID 1396 wrote to memory of 1220 1396 esreki.exe DllHost.exe PID 1396 wrote to memory of 1220 1396 esreki.exe DllHost.exe PID 1396 wrote to memory of 1220 1396 esreki.exe DllHost.exe PID 1396 wrote to memory of 1220 1396 esreki.exe DllHost.exe PID 1396 wrote to memory of 1220 1396 esreki.exe DllHost.exe PID 1396 wrote to memory of 1888 1396 esreki.exe DllHost.exe PID 1396 wrote to memory of 1888 1396 esreki.exe DllHost.exe PID 1396 wrote to memory of 1888 1396 esreki.exe DllHost.exe -
Executes dropped EXE 2 IoCs
Processes:
esreki.exeesreki.exepid process 1028 esreki.exe 1396 esreki.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 660 cmd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
iceix_1.1.6.0.vir.exeesreki.exedescription pid process target process PID 1064 set thread context of 1080 1064 iceix_1.1.6.0.vir.exe iceix_1.1.6.0.vir.exe PID 1028 set thread context of 1396 1028 esreki.exe esreki.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\iceix_1.1.6.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\iceix_1.1.6.0.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\iceix_1.1.6.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\iceix_1.1.6.0.vir.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Acydq\esreki.exe"C:\Users\Admin\AppData\Roaming\Acydq\esreki.exe"4⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Acydq\esreki.exe"C:\Users\Admin\AppData\Roaming\Acydq\esreki.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpf0f1a1b6.bat"4⤵
- Deletes itself
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpf0f1a1b6.bat
-
C:\Users\Admin\AppData\Roaming\Acydq\esreki.exe
-
C:\Users\Admin\AppData\Roaming\Acydq\esreki.exe
-
C:\Users\Admin\AppData\Roaming\Acydq\esreki.exe
-
\Users\Admin\AppData\Roaming\Acydq\esreki.exe
-
\Users\Admin\AppData\Roaming\Acydq\esreki.exe
-
memory/660-13-0x0000000000000000-mapping.dmp
-
memory/660-14-0x0000000000000000-mapping.dmp
-
memory/1028-5-0x0000000000000000-mapping.dmp
-
memory/1080-0-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1080-2-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1080-12-0x0000000000417CDB-mapping.dmp
-
memory/1080-1-0x0000000000417CDB-mapping.dmp
-
memory/1396-9-0x0000000000417CDB-mapping.dmp