6d8f99b5f17d74011562db2b88a2d6feb86bc7e697d5735f1feb1838ecaaaf96 | Triage

Analysis

max time kernel
128s
max time network
44s
platform
windows10_x64
resource
win10v200430
submitted
19-07-2020 19:45

Sharing

Report Analysis Logs

General

Target

iceix_1.2.6.4.vir.exe
Size

383KB
MD5

0deaa0d1c6973665b40db76bed2897c3
SHA1

32fcfd4c0a1f1c5a46f5dae3b8140e8cc41c5a20
SHA256

6d8f99b5f17d74011562db2b88a2d6feb86bc7e697d5735f1feb1838ecaaaf96
SHA512

d70a85fe5645e8cd76f2426b510b90554dea3b7ba6f421ac5f00a85ef1f30df211e722fd582c619eb7bc8783407d29c4a55459924a558b5747380e94808327f8

Score

5^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

iceix_1.2.6.4.vir.exe

description	pid	process	target process
PID 1500 wrote to memory of 1660	1500	iceix_1.2.6.4.vir.exe	iceix_1.2.6.4.vir.exe
PID 1500 wrote to memory of 1660	1500	iceix_1.2.6.4.vir.exe	iceix_1.2.6.4.vir.exe
PID 1500 wrote to memory of 1660	1500	iceix_1.2.6.4.vir.exe	iceix_1.2.6.4.vir.exe
PID 1500 wrote to memory of 1660	1500	iceix_1.2.6.4.vir.exe	iceix_1.2.6.4.vir.exe
PID 1500 wrote to memory of 1660	1500	iceix_1.2.6.4.vir.exe	iceix_1.2.6.4.vir.exe
PID 1500 wrote to memory of 1660	1500	iceix_1.2.6.4.vir.exe	iceix_1.2.6.4.vir.exe
PID 1500 wrote to memory of 1660	1500	iceix_1.2.6.4.vir.exe	iceix_1.2.6.4.vir.exe
PID 1500 wrote to memory of 1660	1500	iceix_1.2.6.4.vir.exe	iceix_1.2.6.4.vir.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

iceix_1.2.6.4.vir.exe

description pid process target process

PID 1500 set thread context of 1660 1500 iceix_1.2.6.4.vir.exe iceix_1.2.6.4.vir.exe

C:\Users\Admin\AppData\Local\Temp\iceix_1.2.6.4.vir.exe
"C:\Users\Admin\AppData\Local\Temp\iceix_1.2.6.4.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1500

C:\Users\Admin\AppData\Local\Temp\iceix_1.2.6.4.vir.exe
C:\Users\Admin\AppData\Local\Temp\iceix_1.2.6.4.vir.exe
2⤵
PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1660-1-0x0000000000413349-mapping.dmp

Download
memory/1660-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1660-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download