Analysis
-
max time kernel
152s -
max time network
64s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
19-07-2020 19:46
Static task
static1
Behavioral task
behavioral1
Sample
iceix_1.2.2.0.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
iceix_1.2.2.0.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
iceix_1.2.2.0.vir.exe
-
Size
271KB
-
MD5
b818f1dce8587940c47217dc0fd3315a
-
SHA1
72dc63def88ee7f0e43531df0040e8d18daedce6
-
SHA256
163fbd87c9a947ce59016e42a9e768ef2e801d0a2785ec48fb9b301d884cf759
-
SHA512
a3193d3fcd4f439d435c821043fb67a8e156f96e971d20e42a18ace4634ab1c48f2caf24b33951b18344d4424e5737260a9e813741b80467d9a4a86c54cc009a
Score
8/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
egryca.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\Currentversion\Run egryca.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\{83BB1998-794D-80A2-C933-DBCF2259A49A} = "C:\\Users\\Admin\\AppData\\Roaming\\Owqi\\egryca.exe" egryca.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\3BBF4B87-00000001.eml:OECustomProperty WinMail.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
iceix_1.2.2.0.vir.execmd.exeegryca.exedescription pid process target process PID 1296 wrote to memory of 600 1296 iceix_1.2.2.0.vir.exe cmd.exe PID 1296 wrote to memory of 600 1296 iceix_1.2.2.0.vir.exe cmd.exe PID 1296 wrote to memory of 600 1296 iceix_1.2.2.0.vir.exe cmd.exe PID 1296 wrote to memory of 600 1296 iceix_1.2.2.0.vir.exe cmd.exe PID 1296 wrote to memory of 1392 1296 iceix_1.2.2.0.vir.exe egryca.exe PID 1296 wrote to memory of 1392 1296 iceix_1.2.2.0.vir.exe egryca.exe PID 1296 wrote to memory of 1392 1296 iceix_1.2.2.0.vir.exe egryca.exe PID 1296 wrote to memory of 1392 1296 iceix_1.2.2.0.vir.exe egryca.exe PID 600 wrote to memory of 1568 600 cmd.exe netsh.exe PID 600 wrote to memory of 1568 600 cmd.exe netsh.exe PID 600 wrote to memory of 1568 600 cmd.exe netsh.exe PID 600 wrote to memory of 1568 600 cmd.exe netsh.exe PID 1392 wrote to memory of 1116 1392 egryca.exe taskhost.exe PID 1392 wrote to memory of 1116 1392 egryca.exe taskhost.exe PID 1392 wrote to memory of 1116 1392 egryca.exe taskhost.exe PID 1392 wrote to memory of 1116 1392 egryca.exe taskhost.exe PID 1392 wrote to memory of 1116 1392 egryca.exe taskhost.exe PID 1392 wrote to memory of 1248 1392 egryca.exe Dwm.exe PID 1392 wrote to memory of 1248 1392 egryca.exe Dwm.exe PID 1392 wrote to memory of 1248 1392 egryca.exe Dwm.exe PID 1392 wrote to memory of 1248 1392 egryca.exe Dwm.exe PID 1392 wrote to memory of 1248 1392 egryca.exe Dwm.exe PID 1392 wrote to memory of 1304 1392 egryca.exe Explorer.EXE PID 1392 wrote to memory of 1304 1392 egryca.exe Explorer.EXE PID 1392 wrote to memory of 1304 1392 egryca.exe Explorer.EXE PID 1392 wrote to memory of 1304 1392 egryca.exe Explorer.EXE PID 1392 wrote to memory of 1304 1392 egryca.exe Explorer.EXE PID 1392 wrote to memory of 1296 1392 egryca.exe iceix_1.2.2.0.vir.exe PID 1392 wrote to memory of 1296 1392 egryca.exe iceix_1.2.2.0.vir.exe PID 1392 wrote to memory of 1296 1392 egryca.exe iceix_1.2.2.0.vir.exe PID 1392 wrote to memory of 1296 1392 egryca.exe iceix_1.2.2.0.vir.exe PID 1392 wrote to memory of 1296 1392 egryca.exe iceix_1.2.2.0.vir.exe PID 1392 wrote to memory of 1068 1392 egryca.exe WinMail.exe PID 1392 wrote to memory of 1068 1392 egryca.exe WinMail.exe PID 1392 wrote to memory of 1068 1392 egryca.exe WinMail.exe PID 1392 wrote to memory of 1068 1392 egryca.exe WinMail.exe PID 1392 wrote to memory of 1068 1392 egryca.exe WinMail.exe PID 1296 wrote to memory of 1780 1296 iceix_1.2.2.0.vir.exe cmd.exe PID 1296 wrote to memory of 1780 1296 iceix_1.2.2.0.vir.exe cmd.exe PID 1296 wrote to memory of 1780 1296 iceix_1.2.2.0.vir.exe cmd.exe PID 1296 wrote to memory of 1780 1296 iceix_1.2.2.0.vir.exe cmd.exe PID 1296 wrote to memory of 1780 1296 iceix_1.2.2.0.vir.exe cmd.exe PID 1296 wrote to memory of 1780 1296 iceix_1.2.2.0.vir.exe cmd.exe PID 1296 wrote to memory of 1780 1296 iceix_1.2.2.0.vir.exe cmd.exe PID 1296 wrote to memory of 1780 1296 iceix_1.2.2.0.vir.exe cmd.exe PID 1296 wrote to memory of 1780 1296 iceix_1.2.2.0.vir.exe cmd.exe PID 1392 wrote to memory of 1528 1392 egryca.exe DllHost.exe PID 1392 wrote to memory of 1528 1392 egryca.exe DllHost.exe PID 1392 wrote to memory of 1528 1392 egryca.exe DllHost.exe PID 1392 wrote to memory of 1528 1392 egryca.exe DllHost.exe PID 1392 wrote to memory of 1528 1392 egryca.exe DllHost.exe PID 1392 wrote to memory of 1948 1392 egryca.exe DllHost.exe PID 1392 wrote to memory of 1948 1392 egryca.exe DllHost.exe PID 1392 wrote to memory of 1948 1392 egryca.exe DllHost.exe PID 1392 wrote to memory of 1948 1392 egryca.exe DllHost.exe PID 1392 wrote to memory of 1948 1392 egryca.exe DllHost.exe PID 1392 wrote to memory of 1396 1392 egryca.exe DllHost.exe PID 1392 wrote to memory of 1396 1392 egryca.exe DllHost.exe PID 1392 wrote to memory of 1396 1392 egryca.exe DllHost.exe PID 1392 wrote to memory of 1396 1392 egryca.exe DllHost.exe PID 1392 wrote to memory of 1396 1392 egryca.exe DllHost.exe -
Loads dropped DLL 2 IoCs
Processes:
iceix_1.2.2.0.vir.exepid process 1296 iceix_1.2.2.0.vir.exe 1296 iceix_1.2.2.0.vir.exe -
Executes dropped EXE 1 IoCs
Processes:
egryca.exepid process 1392 egryca.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 1068 WinMail.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1780 cmd.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
netsh.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
iceix_1.2.2.0.vir.exeWinMail.execmd.exedescription pid process Token: SeSecurityPrivilege 1296 iceix_1.2.2.0.vir.exe Token: SeSecurityPrivilege 1296 iceix_1.2.2.0.vir.exe Token: SeSecurityPrivilege 1296 iceix_1.2.2.0.vir.exe Token: SeManageVolumePrivilege 1068 WinMail.exe Token: SeSecurityPrivilege 1780 cmd.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
egryca.exepid process 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe 1392 egryca.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
iceix_1.2.2.0.vir.exedescription pid process target process PID 1296 set thread context of 1780 1296 iceix_1.2.2.0.vir.exe cmd.exe -
Modifies Windows Firewall 1 TTPs
-
Processes:
iceix_1.2.2.0.vir.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Privacy iceix_1.2.2.0.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" iceix_1.2.2.0.vir.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\iceix_1.2.2.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\iceix_1.2.2.0.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp7ae6758d.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="explore" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Owqi\egryca.exe"4⤵
- Modifies service
-
C:\Users\Admin\AppData\Roaming\Owqi\egryca.exe"C:\Users\Admin\AppData\Roaming\Owqi\egryca.exe"3⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp23de9f72.bat"3⤵
- Deletes itself
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp23de9f72.bat
-
C:\Users\Admin\AppData\Local\Temp\tmp7ae6758d.bat
-
C:\Users\Admin\AppData\Roaming\Owqi\egryca.exe
-
C:\Users\Admin\AppData\Roaming\Owqi\egryca.exe
-
C:\Users\Admin\AppData\Roaming\Zanuky\qyhoegy.kah
-
\Users\Admin\AppData\Roaming\Owqi\egryca.exe
-
\Users\Admin\AppData\Roaming\Owqi\egryca.exe
-
memory/600-0-0x0000000000000000-mapping.dmp
-
memory/1068-24-0x0000000003D50000-0x0000000003D52000-memory.dmpFilesize
8KB
-
memory/1068-22-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/1068-12-0x00000000038C0000-0x00000000039C0000-memory.dmpFilesize
1024KB
-
memory/1068-13-0x00000000038C0000-0x0000000003AC0000-memory.dmpFilesize
2.0MB
-
memory/1068-14-0x00000000039C0000-0x0000000003AC0000-memory.dmpFilesize
1024KB
-
memory/1068-18-0x0000000003AE0000-0x0000000003AE2000-memory.dmpFilesize
8KB
-
memory/1068-19-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/1068-20-0x0000000003AD0000-0x0000000003AD2000-memory.dmpFilesize
8KB
-
memory/1068-21-0x0000000003D30000-0x0000000003D32000-memory.dmpFilesize
8KB
-
memory/1068-10-0x00000000038C0000-0x0000000003AC0000-memory.dmpFilesize
2.0MB
-
memory/1068-8-0x00000000038C0000-0x00000000039C0000-memory.dmpFilesize
1024KB
-
memory/1068-29-0x0000000004280000-0x0000000004282000-memory.dmpFilesize
8KB
-
memory/1068-28-0x0000000004280000-0x0000000004282000-memory.dmpFilesize
8KB
-
memory/1068-26-0x0000000003D70000-0x0000000003D72000-memory.dmpFilesize
8KB
-
memory/1392-3-0x0000000000000000-mapping.dmp
-
memory/1568-6-0x0000000000000000-mapping.dmp
-
memory/1780-25-0x00000000000638B4-mapping.dmp
-
memory/1780-23-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB