Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
13-07-2022 18:22
Static task
static1
Behavioral task
behavioral1
Sample
619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe
Resource
win10v2004-20220414-en
General
-
Target
619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe
-
Size
348KB
-
MD5
2be76cae2ba32867d8f244b65287d957
-
SHA1
6e7587064a02f11a831e0d9abb46603305e72665
-
SHA256
619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d
-
SHA512
748c6319825db2763941a639e640634fcdbf662d46ad683325e1e040fce6421152ec4a29d65cf9f26a4652dcb49570412b12930b8e79042d7bcbf4b71badab12
Malware Config
Signatures
-
Detects IceXLoader v3.0 4 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\ICE X.exe family_icexloader_v3 C:\Users\Admin\AppData\Roaming\ICE X.exe family_icexloader_v3 C:\Users\Admin\AppData\Roaming\ICE X.exe family_icexloader_v3 \Users\Admin\AppData\Roaming\ICE X.exe family_icexloader_v3 -
icexloader
IceXLoader is a downloader used to deliver other malware families.
-
Executes dropped EXE 1 IoCs
Processes:
ICE X.exepid process 616 ICE X.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 600 cmd.exe -
Drops startup file 1 IoCs
Processes:
619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ICE X.exe 619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1944 cmd.exe 1944 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run 619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\ICE X = "\"C:\\Users\\Admin\\AppData\\Roaming\\ICE X.exe\"" 619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICE X = "\"C:\\Users\\Admin\\AppData\\Roaming\\ICE X.exe\"" 619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 1140 timeout.exe 1368 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1732 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1732 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.execmd.execmd.exeICE X.execmd.exedescription pid process target process PID 328 wrote to memory of 1944 328 619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe cmd.exe PID 328 wrote to memory of 1944 328 619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe cmd.exe PID 328 wrote to memory of 1944 328 619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe cmd.exe PID 328 wrote to memory of 1944 328 619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe cmd.exe PID 328 wrote to memory of 600 328 619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe cmd.exe PID 328 wrote to memory of 600 328 619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe cmd.exe PID 328 wrote to memory of 600 328 619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe cmd.exe PID 328 wrote to memory of 600 328 619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe cmd.exe PID 1944 wrote to memory of 1368 1944 cmd.exe timeout.exe PID 1944 wrote to memory of 1368 1944 cmd.exe timeout.exe PID 1944 wrote to memory of 1368 1944 cmd.exe timeout.exe PID 1944 wrote to memory of 1368 1944 cmd.exe timeout.exe PID 600 wrote to memory of 1140 600 cmd.exe timeout.exe PID 600 wrote to memory of 1140 600 cmd.exe timeout.exe PID 600 wrote to memory of 1140 600 cmd.exe timeout.exe PID 600 wrote to memory of 1140 600 cmd.exe timeout.exe PID 1944 wrote to memory of 616 1944 cmd.exe ICE X.exe PID 1944 wrote to memory of 616 1944 cmd.exe ICE X.exe PID 1944 wrote to memory of 616 1944 cmd.exe ICE X.exe PID 1944 wrote to memory of 616 1944 cmd.exe ICE X.exe PID 616 wrote to memory of 1268 616 ICE X.exe cmd.exe PID 616 wrote to memory of 1268 616 ICE X.exe cmd.exe PID 616 wrote to memory of 1268 616 ICE X.exe cmd.exe PID 616 wrote to memory of 1268 616 ICE X.exe cmd.exe PID 1268 wrote to memory of 1732 1268 cmd.exe powershell.exe PID 1268 wrote to memory of 1732 1268 cmd.exe powershell.exe PID 1268 wrote to memory of 1732 1268 cmd.exe powershell.exe PID 1268 wrote to memory of 1732 1268 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe"C:\Users\Admin\AppData\Local\Temp\619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c timeout 2 & "C:\Users\Admin\AppData\Roaming\ICE X.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\ICE X.exe"C:\Users\Admin\AppData\Roaming\ICE X.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\file.bat"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableRealtimeMonitoring $true5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c timeout 1 & del /F "C:\Users\Admin\AppData\Local\Temp\619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\file.batFilesize
239B
MD5f6e9a890d89cbc6684cc81fdba858cb4
SHA1352924f71a6debb722a31af9d9a2c9bc157f6593
SHA2567300f298f3baf29ec7dfcffb6ed84a14eea910dd323d845f9c343990b8754c51
SHA512e0ddd4bdc29b355937be75ea90b1c8a0b4e9ce631364fcc35635a7f33b7e00a4a245402456cf17364a91a61cf1a551f2fb49d3f25133a4e488a5f379014264d9
-
C:\Users\Admin\AppData\Roaming\ICE X.exeFilesize
348KB
MD52be76cae2ba32867d8f244b65287d957
SHA16e7587064a02f11a831e0d9abb46603305e72665
SHA256619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d
SHA512748c6319825db2763941a639e640634fcdbf662d46ad683325e1e040fce6421152ec4a29d65cf9f26a4652dcb49570412b12930b8e79042d7bcbf4b71badab12
-
C:\Users\Admin\AppData\Roaming\ICE X.exeFilesize
348KB
MD52be76cae2ba32867d8f244b65287d957
SHA16e7587064a02f11a831e0d9abb46603305e72665
SHA256619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d
SHA512748c6319825db2763941a639e640634fcdbf662d46ad683325e1e040fce6421152ec4a29d65cf9f26a4652dcb49570412b12930b8e79042d7bcbf4b71badab12
-
\Users\Admin\AppData\Roaming\ICE X.exeFilesize
348KB
MD52be76cae2ba32867d8f244b65287d957
SHA16e7587064a02f11a831e0d9abb46603305e72665
SHA256619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d
SHA512748c6319825db2763941a639e640634fcdbf662d46ad683325e1e040fce6421152ec4a29d65cf9f26a4652dcb49570412b12930b8e79042d7bcbf4b71badab12
-
\Users\Admin\AppData\Roaming\ICE X.exeFilesize
348KB
MD52be76cae2ba32867d8f244b65287d957
SHA16e7587064a02f11a831e0d9abb46603305e72665
SHA256619356420efd4dc53704fb5eb5c93f1f5d4a0123ed1fdd5ce276a832381de51d
SHA512748c6319825db2763941a639e640634fcdbf662d46ad683325e1e040fce6421152ec4a29d65cf9f26a4652dcb49570412b12930b8e79042d7bcbf4b71badab12
-
memory/328-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/600-56-0x0000000000000000-mapping.dmp
-
memory/616-62-0x0000000000000000-mapping.dmp
-
memory/1140-58-0x0000000000000000-mapping.dmp
-
memory/1268-65-0x0000000000000000-mapping.dmp
-
memory/1368-57-0x0000000000000000-mapping.dmp
-
memory/1732-67-0x0000000000000000-mapping.dmp
-
memory/1732-69-0x0000000073800000-0x0000000073DAB000-memory.dmpFilesize
5.7MB
-
memory/1732-70-0x0000000073800000-0x0000000073DAB000-memory.dmpFilesize
5.7MB
-
memory/1944-55-0x0000000000000000-mapping.dmp