Analysis
-
max time kernel
155s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-06-2022 17:55
Static task
static1
Behavioral task
behavioral1
Sample
6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe
Resource
win10v2004-20220414-en
General
-
Target
6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe
-
Size
348KB
-
MD5
0075306f5fda6d70684ecd0f29a61f2e
-
SHA1
4e9d843f432c27434898864258d53787c7b207f9
-
SHA256
6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794
-
SHA512
a55d1d7b927d8923bd0d63cb0060358d081f0fddfc454b85087c0658a3e049ca9ba123994eb0be5307c2cd23131b456af382c81d7ef25e4483efec7f38a27e40
Malware Config
Signatures
-
Detects IceXLoader v3.0 ⋅ 2 IoCs
Processes:
resource yara_rule behavioral2/files/0x000b000000000038-135.dat family_icexloader_v3 behavioral2/files/0x000b000000000038-136.dat family_icexloader_v3 -
icexloader
IceXLoader is a downloader used to deliver other malware families.
-
Executes dropped EXE ⋅ 1 IoCs
Processes:
EGe.exepid process 3880 EGe.exe -
Drops startup file ⋅ 1 IoCs
Processes:
6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EGe.exe 6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe -
Adds Run key to start application ⋅ 2 TTPs 4 IoCs
Processes:
6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run 6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EGe = "\"C:\\Users\\Admin\\AppData\\Roaming\\EGe.exe\"" 6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EGe = "\"C:\\Users\\Admin\\AppData\\Roaming\\EGe.exe\"" 6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe -
Delays execution with timeout.exe ⋅ 2 IoCs
Processes:
timeout.exetimeout.exepid process 4820 timeout.exe 2664 timeout.exe -
Suspicious behavior: EnumeratesProcesses ⋅ 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 3580 powershell.exe 3580 powershell.exe 3536 powershell.exe 3536 powershell.exe 5056 powershell.exe 5056 powershell.exe -
Suspicious use of AdjustPrivilegeToken ⋅ 13 IoCs
Processes:
powershell.exeEGe.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3580 powershell.exe Token: SeRemoteShutdownPrivilege 3880 EGe.exe Token: SeRemoteShutdownPrivilege 3880 EGe.exe Token: SeRemoteShutdownPrivilege 3880 EGe.exe Token: SeRemoteShutdownPrivilege 3880 EGe.exe Token: SeRemoteShutdownPrivilege 3880 EGe.exe Token: SeRemoteShutdownPrivilege 3880 EGe.exe Token: SeRemoteShutdownPrivilege 3880 EGe.exe Token: SeRemoteShutdownPrivilege 3880 EGe.exe Token: SeRemoteShutdownPrivilege 3880 EGe.exe Token: SeRemoteShutdownPrivilege 3880 EGe.exe Token: SeDebugPrivilege 3536 powershell.exe Token: SeDebugPrivilege 5056 powershell.exe -
Suspicious use of WriteProcessMemory ⋅ 27 IoCs
Processes:
6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.execmd.execmd.exeEGe.execmd.exedescription pid process target process PID 1828 wrote to memory of 2428 1828 6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe cmd.exe PID 1828 wrote to memory of 2428 1828 6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe cmd.exe PID 1828 wrote to memory of 2428 1828 6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe cmd.exe PID 1828 wrote to memory of 2888 1828 6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe cmd.exe PID 1828 wrote to memory of 2888 1828 6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe cmd.exe PID 1828 wrote to memory of 2888 1828 6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe cmd.exe PID 2428 wrote to memory of 4820 2428 cmd.exe timeout.exe PID 2428 wrote to memory of 4820 2428 cmd.exe timeout.exe PID 2428 wrote to memory of 4820 2428 cmd.exe timeout.exe PID 2888 wrote to memory of 2664 2888 cmd.exe timeout.exe PID 2888 wrote to memory of 2664 2888 cmd.exe timeout.exe PID 2888 wrote to memory of 2664 2888 cmd.exe timeout.exe PID 2428 wrote to memory of 3880 2428 cmd.exe EGe.exe PID 2428 wrote to memory of 3880 2428 cmd.exe EGe.exe PID 2428 wrote to memory of 3880 2428 cmd.exe EGe.exe PID 3880 wrote to memory of 3468 3880 EGe.exe cmd.exe PID 3880 wrote to memory of 3468 3880 EGe.exe cmd.exe PID 3880 wrote to memory of 3468 3880 EGe.exe cmd.exe PID 3468 wrote to memory of 3580 3468 cmd.exe powershell.exe PID 3468 wrote to memory of 3580 3468 cmd.exe powershell.exe PID 3468 wrote to memory of 3580 3468 cmd.exe powershell.exe PID 3468 wrote to memory of 3536 3468 cmd.exe powershell.exe PID 3468 wrote to memory of 3536 3468 cmd.exe powershell.exe PID 3468 wrote to memory of 3536 3468 cmd.exe powershell.exe PID 3468 wrote to memory of 5056 3468 cmd.exe powershell.exe PID 3468 wrote to memory of 5056 3468 cmd.exe powershell.exe PID 3468 wrote to memory of 5056 3468 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exePID:1828"C:\Users\Admin\AppData\Local\Temp\6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe"Drops startup fileAdds Run key to start applicationSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exePID:2428cmd /c timeout 2 & "C:\Users\Admin\AppData\Roaming\EGe.exe"Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exePID:4820timeout 2Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\EGe.exePID:3880"C:\Users\Admin\AppData\Roaming\EGe.exe"Executes dropped EXESuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exePID:3468cmd /c "C:\Users\Admin\AppData\Local\Temp\file.bat"Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePID:3580powershell -Command Set-MpPreference -DisableRealtimeMonitoring $trueSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePID:3536powershell -Command Add-MpPreference -ExclusionExtension "C:\Users\Admin\AppData\Roaming\EGe\.exe"Suspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePID:5056powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin"Suspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exePID:2888cmd /c timeout 1 & del /F "C:\Users\Admin\AppData\Local\Temp\6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794.exe"Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exePID:2664timeout 1Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5a19322492b756a9ae41a3437b5eb12f7
SHA1cd0603dcd1fc917f84ffca7f86e58ed9274c17d5
SHA2560e3df1acbc083f5eb8cca52dfc81309db3e83eaed2cb1e9f7a572482edbff37b
SHA512c3b6a73f9b2d92423fa427e081ce2dcff81162557c270a2a0c5faf271c8a19a47de9c8a0d7a284684e33456ca7b7017a9bd8254814493443dd8ce8126dd7fe9c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5296174ceb70afb378f19d6ebc88f33a5
SHA1cfbd5e7793b9167a7f3fc9c339221ed4994063a5
SHA25670adac0ea0b25eeebf18263c40a820f21451025d22c2f9ceea81ddde2fe74043
SHA512ab065c96846de14f9e65b08ca5250539dcd015f46e7e8d3e72632b50a9d8ca32008de339c776f8c1ff3d8dd087f6f638346171175ad2a90c70990787c40787e8
-
C:\Users\Admin\AppData\Local\Temp\file.batFilesize
237B
MD592f81be29f73852cd4b4c90c05587137
SHA199fc680c6e41734b0d79d957dc124ef272d04241
SHA256f8242358557a69f6a079a5c1b2c821b2429740ac51a11643949a237f027bf133
SHA512a1bc282b8da2794fa0f1de1f102867bf9baca8d0bf28546757a4c42b1f24ac31f1b5b0f7c3756dadd9802d58f4da7312e0ce992c17079e7f418060c14b472481
-
C:\Users\Admin\AppData\Roaming\EGe.exeFilesize
348KB
MD50075306f5fda6d70684ecd0f29a61f2e
SHA14e9d843f432c27434898864258d53787c7b207f9
SHA2566d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794
SHA512a55d1d7b927d8923bd0d63cb0060358d081f0fddfc454b85087c0658a3e049ca9ba123994eb0be5307c2cd23131b456af382c81d7ef25e4483efec7f38a27e40
-
C:\Users\Admin\AppData\Roaming\EGe.exeFilesize
348KB
MD50075306f5fda6d70684ecd0f29a61f2e
SHA14e9d843f432c27434898864258d53787c7b207f9
SHA2566d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794
SHA512a55d1d7b927d8923bd0d63cb0060358d081f0fddfc454b85087c0658a3e049ca9ba123994eb0be5307c2cd23131b456af382c81d7ef25e4483efec7f38a27e40
-
memory/2428-130-0x0000000000000000-mapping.dmp
-
memory/2664-133-0x0000000000000000-mapping.dmp
-
memory/2888-131-0x0000000000000000-mapping.dmp
-
memory/3468-137-0x0000000000000000-mapping.dmp
-
memory/3536-159-0x0000000070F80000-0x0000000070FCC000-memory.dmpFilesize
304KB
-
memory/3536-156-0x0000000000000000-mapping.dmp
-
memory/3580-146-0x0000000006D00000-0x0000000006D32000-memory.dmpFilesize
200KB
-
memory/3580-153-0x0000000007C90000-0x0000000007C9E000-memory.dmpFilesize
56KB
-
memory/3580-144-0x00000000060F0000-0x0000000006156000-memory.dmpFilesize
408KB
-
memory/3580-145-0x0000000006740000-0x000000000675E000-memory.dmpFilesize
120KB
-
memory/3580-142-0x0000000005970000-0x0000000005992000-memory.dmpFilesize
136KB
-
memory/3580-147-0x0000000070880000-0x00000000708CC000-memory.dmpFilesize
304KB
-
memory/3580-148-0x0000000006CE0000-0x0000000006CFE000-memory.dmpFilesize
120KB
-
memory/3580-149-0x00000000080C0000-0x000000000873A000-memory.dmpFilesize
6MB
-
memory/3580-150-0x0000000005440000-0x000000000545A000-memory.dmpFilesize
104KB
-
memory/3580-151-0x0000000007AB0000-0x0000000007ABA000-memory.dmpFilesize
40KB
-
memory/3580-152-0x0000000007CE0000-0x0000000007D76000-memory.dmpFilesize
600KB
-
memory/3580-143-0x0000000006080000-0x00000000060E6000-memory.dmpFilesize
408KB
-
memory/3580-154-0x0000000007D80000-0x0000000007D9A000-memory.dmpFilesize
104KB
-
memory/3580-155-0x0000000007CD0000-0x0000000007CD8000-memory.dmpFilesize
32KB
-
memory/3580-141-0x00000000059B0000-0x0000000005FD8000-memory.dmpFilesize
6MB
-
memory/3580-140-0x00000000030C0000-0x00000000030F6000-memory.dmpFilesize
216KB
-
memory/3580-139-0x0000000000000000-mapping.dmp
-
memory/3880-134-0x0000000000000000-mapping.dmp
-
memory/4820-132-0x0000000000000000-mapping.dmp
-
memory/5056-160-0x0000000000000000-mapping.dmp
-
memory/5056-162-0x0000000070DC0000-0x0000000070E0C000-memory.dmpFilesize
304KB