Analysis
-
max time kernel
151s -
max time network
133s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:45
Static task
static1
Behavioral task
behavioral1
Sample
iceix_1.2.6.4.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
iceix_1.2.6.4.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
iceix_1.2.6.4.vir.exe
-
Size
383KB
-
MD5
0deaa0d1c6973665b40db76bed2897c3
-
SHA1
32fcfd4c0a1f1c5a46f5dae3b8140e8cc41c5a20
-
SHA256
6d8f99b5f17d74011562db2b88a2d6feb86bc7e697d5735f1feb1838ecaaaf96
-
SHA512
d70a85fe5645e8cd76f2426b510b90554dea3b7ba6f421ac5f00a85ef1f30df211e722fd582c619eb7bc8783407d29c4a55459924a558b5747380e94808327f8
Score
8/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
iceix_1.2.6.4.vir.exeWinMail.execmd.exedescription pid process Token: SeSecurityPrivilege 1256 iceix_1.2.6.4.vir.exe Token: SeSecurityPrivilege 1256 iceix_1.2.6.4.vir.exe Token: SeSecurityPrivilege 1256 iceix_1.2.6.4.vir.exe Token: SeManageVolumePrivilege 1520 WinMail.exe Token: SeSecurityPrivilege 1780 cmd.exe -
Modifies Windows Firewall 1 TTPs
-
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\543F409F-00000001.eml:OECustomProperty WinMail.exe -
Executes dropped EXE 2 IoCs
Processes:
leabtal.exeleabtal.exepid process 1448 leabtal.exe 308 leabtal.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
leabtal.exepid process 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe 308 leabtal.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 1520 WinMail.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1780 cmd.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
netsh.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe -
Suspicious use of WriteProcessMemory 79 IoCs
Processes:
iceix_1.2.6.4.vir.exeiceix_1.2.6.4.vir.execmd.exeleabtal.exeleabtal.exedescription pid process target process PID 1144 wrote to memory of 1256 1144 iceix_1.2.6.4.vir.exe iceix_1.2.6.4.vir.exe PID 1144 wrote to memory of 1256 1144 iceix_1.2.6.4.vir.exe iceix_1.2.6.4.vir.exe PID 1144 wrote to memory of 1256 1144 iceix_1.2.6.4.vir.exe iceix_1.2.6.4.vir.exe PID 1144 wrote to memory of 1256 1144 iceix_1.2.6.4.vir.exe iceix_1.2.6.4.vir.exe PID 1144 wrote to memory of 1256 1144 iceix_1.2.6.4.vir.exe iceix_1.2.6.4.vir.exe PID 1144 wrote to memory of 1256 1144 iceix_1.2.6.4.vir.exe iceix_1.2.6.4.vir.exe PID 1144 wrote to memory of 1256 1144 iceix_1.2.6.4.vir.exe iceix_1.2.6.4.vir.exe PID 1144 wrote to memory of 1256 1144 iceix_1.2.6.4.vir.exe iceix_1.2.6.4.vir.exe PID 1144 wrote to memory of 1256 1144 iceix_1.2.6.4.vir.exe iceix_1.2.6.4.vir.exe PID 1256 wrote to memory of 316 1256 iceix_1.2.6.4.vir.exe cmd.exe PID 1256 wrote to memory of 316 1256 iceix_1.2.6.4.vir.exe cmd.exe PID 1256 wrote to memory of 316 1256 iceix_1.2.6.4.vir.exe cmd.exe PID 1256 wrote to memory of 316 1256 iceix_1.2.6.4.vir.exe cmd.exe PID 1256 wrote to memory of 1448 1256 iceix_1.2.6.4.vir.exe leabtal.exe PID 1256 wrote to memory of 1448 1256 iceix_1.2.6.4.vir.exe leabtal.exe PID 1256 wrote to memory of 1448 1256 iceix_1.2.6.4.vir.exe leabtal.exe PID 1256 wrote to memory of 1448 1256 iceix_1.2.6.4.vir.exe leabtal.exe PID 316 wrote to memory of 836 316 cmd.exe netsh.exe PID 316 wrote to memory of 836 316 cmd.exe netsh.exe PID 316 wrote to memory of 836 316 cmd.exe netsh.exe PID 316 wrote to memory of 836 316 cmd.exe netsh.exe PID 1448 wrote to memory of 308 1448 leabtal.exe leabtal.exe PID 1448 wrote to memory of 308 1448 leabtal.exe leabtal.exe PID 1448 wrote to memory of 308 1448 leabtal.exe leabtal.exe PID 1448 wrote to memory of 308 1448 leabtal.exe leabtal.exe PID 1448 wrote to memory of 308 1448 leabtal.exe leabtal.exe PID 1448 wrote to memory of 308 1448 leabtal.exe leabtal.exe PID 1448 wrote to memory of 308 1448 leabtal.exe leabtal.exe PID 1448 wrote to memory of 308 1448 leabtal.exe leabtal.exe PID 1448 wrote to memory of 308 1448 leabtal.exe leabtal.exe PID 308 wrote to memory of 1124 308 leabtal.exe taskhost.exe PID 308 wrote to memory of 1124 308 leabtal.exe taskhost.exe PID 308 wrote to memory of 1124 308 leabtal.exe taskhost.exe PID 308 wrote to memory of 1124 308 leabtal.exe taskhost.exe PID 308 wrote to memory of 1124 308 leabtal.exe taskhost.exe PID 308 wrote to memory of 1212 308 leabtal.exe Dwm.exe PID 308 wrote to memory of 1212 308 leabtal.exe Dwm.exe PID 308 wrote to memory of 1212 308 leabtal.exe Dwm.exe PID 308 wrote to memory of 1212 308 leabtal.exe Dwm.exe PID 308 wrote to memory of 1212 308 leabtal.exe Dwm.exe PID 308 wrote to memory of 1264 308 leabtal.exe Explorer.EXE PID 308 wrote to memory of 1264 308 leabtal.exe Explorer.EXE PID 308 wrote to memory of 1264 308 leabtal.exe Explorer.EXE PID 308 wrote to memory of 1264 308 leabtal.exe Explorer.EXE PID 308 wrote to memory of 1264 308 leabtal.exe Explorer.EXE PID 308 wrote to memory of 1256 308 leabtal.exe iceix_1.2.6.4.vir.exe PID 308 wrote to memory of 1256 308 leabtal.exe iceix_1.2.6.4.vir.exe PID 308 wrote to memory of 1256 308 leabtal.exe iceix_1.2.6.4.vir.exe PID 308 wrote to memory of 1256 308 leabtal.exe iceix_1.2.6.4.vir.exe PID 308 wrote to memory of 1256 308 leabtal.exe iceix_1.2.6.4.vir.exe PID 1256 wrote to memory of 1780 1256 iceix_1.2.6.4.vir.exe cmd.exe PID 1256 wrote to memory of 1780 1256 iceix_1.2.6.4.vir.exe cmd.exe PID 1256 wrote to memory of 1780 1256 iceix_1.2.6.4.vir.exe cmd.exe PID 1256 wrote to memory of 1780 1256 iceix_1.2.6.4.vir.exe cmd.exe PID 1256 wrote to memory of 1780 1256 iceix_1.2.6.4.vir.exe cmd.exe PID 1256 wrote to memory of 1780 1256 iceix_1.2.6.4.vir.exe cmd.exe PID 1256 wrote to memory of 1780 1256 iceix_1.2.6.4.vir.exe cmd.exe PID 1256 wrote to memory of 1780 1256 iceix_1.2.6.4.vir.exe cmd.exe PID 1256 wrote to memory of 1780 1256 iceix_1.2.6.4.vir.exe cmd.exe PID 308 wrote to memory of 1520 308 leabtal.exe WinMail.exe PID 308 wrote to memory of 1520 308 leabtal.exe WinMail.exe PID 308 wrote to memory of 1520 308 leabtal.exe WinMail.exe PID 308 wrote to memory of 1520 308 leabtal.exe WinMail.exe PID 308 wrote to memory of 1520 308 leabtal.exe WinMail.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
iceix_1.2.6.4.vir.exeleabtal.exeiceix_1.2.6.4.vir.exedescription pid process target process PID 1144 set thread context of 1256 1144 iceix_1.2.6.4.vir.exe iceix_1.2.6.4.vir.exe PID 1448 set thread context of 308 1448 leabtal.exe leabtal.exe PID 1256 set thread context of 1780 1256 iceix_1.2.6.4.vir.exe cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
iceix_1.2.6.4.vir.exepid process 1256 iceix_1.2.6.4.vir.exe -
Processes:
iceix_1.2.6.4.vir.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" iceix_1.2.6.4.vir.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy iceix_1.2.6.4.vir.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
leabtal.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run leabtal.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{BACFDE6A-20FA-8665-8420-6646A34DB10B} = "C:\\Users\\Admin\\AppData\\Roaming\\Kaet\\leabtal.exe" leabtal.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\iceix_1.2.6.4.vir.exe"C:\Users\Admin\AppData\Local\Temp\iceix_1.2.6.4.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\iceix_1.2.6.4.vir.exeC:\Users\Admin\AppData\Local\Temp\iceix_1.2.6.4.vir.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Loads dropped DLL
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpa04808eb.bat"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="explore" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Kaet\leabtal.exe"5⤵
- Modifies service
-
C:\Users\Admin\AppData\Roaming\Kaet\leabtal.exe"C:\Users\Admin\AppData\Roaming\Kaet\leabtal.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Kaet\leabtal.exeC:\Users\Admin\AppData\Roaming\Kaet\leabtal.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp3c41b01c.bat"4⤵
- Suspicious use of AdjustPrivilegeToken
- Deletes itself
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
- NTFS ADS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1956344981764915940-1146837645-1764480986-588226036-4072285391241354762136506459"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3c41b01c.bat
-
C:\Users\Admin\AppData\Local\Temp\tmpa04808eb.bat
-
C:\Users\Admin\AppData\Roaming\Huy\kobuer.nys
-
C:\Users\Admin\AppData\Roaming\Kaet\leabtal.exe
-
C:\Users\Admin\AppData\Roaming\Kaet\leabtal.exe
-
C:\Users\Admin\AppData\Roaming\Kaet\leabtal.exe
-
\Users\Admin\AppData\Roaming\Kaet\leabtal.exe
-
memory/308-10-0x0000000000413349-mapping.dmp
-
memory/316-3-0x0000000000000000-mapping.dmp
-
memory/836-8-0x0000000000000000-mapping.dmp
-
memory/1256-2-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1256-14-0x0000000000413349-mapping.dmp
-
memory/1256-1-0x0000000000413349-mapping.dmp
-
memory/1256-0-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1448-5-0x0000000000000000-mapping.dmp
-
memory/1520-17-0x0000000003930000-0x0000000003B30000-memory.dmpFilesize
2.0MB
-
memory/1520-32-0x0000000003E50000-0x0000000003E52000-memory.dmpFilesize
8KB
-
memory/1520-21-0x0000000003A30000-0x0000000003B30000-memory.dmpFilesize
1024KB
-
memory/1520-25-0x00000000024E0000-0x00000000024E2000-memory.dmpFilesize
8KB
-
memory/1520-26-0x00000000024F0000-0x00000000024F2000-memory.dmpFilesize
8KB
-
memory/1520-27-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/1520-15-0x0000000003930000-0x0000000003A30000-memory.dmpFilesize
1024KB
-
memory/1520-36-0x0000000003C20000-0x0000000003C22000-memory.dmpFilesize
8KB
-
memory/1520-19-0x0000000003930000-0x0000000003A30000-memory.dmpFilesize
1024KB
-
memory/1520-31-0x0000000003E10000-0x0000000003E12000-memory.dmpFilesize
8KB
-
memory/1520-20-0x0000000003930000-0x0000000003B30000-memory.dmpFilesize
2.0MB
-
memory/1520-33-0x0000000003EC0000-0x0000000003EC2000-memory.dmpFilesize
8KB
-
memory/1520-34-0x0000000003E10000-0x0000000003E12000-memory.dmpFilesize
8KB
-
memory/1520-35-0x00000000024E0000-0x00000000024E2000-memory.dmpFilesize
8KB
-
memory/1780-29-0x0000000000062FC6-mapping.dmp
-
memory/1780-28-0x0000000000050000-0x0000000000078000-memory.dmpFilesize
160KB