Analysis
-
max time kernel
301s -
max time network
306s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2022 14:58
Behavioral task
behavioral1
Sample
34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.exe
Resource
win10v2004-20220718-en
General
-
Target
34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.exe
-
Size
347KB
-
MD5
91de3fb29c2b6b09d64e693a6a018146
-
SHA1
91fbfd49bb7426f118ce8a9d2a781ae170da7fe1
-
SHA256
34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1
-
SHA512
f8e827c8616804c90900eb69eba63c2f6c33f4ef0532adcd1eee485195d4994e891afb92151648cd17b6ffada3badfd939d6bdd9535471f5a7152c27c82e2508
Malware Config
Signatures
-
icexloader
IceXLoader is a downloader used to deliver other malware families.
-
Drops startup file 1 IoCs
Processes:
34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OApp.exe 34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\Software\Microsoft\Windows\CurrentVersion\Run 34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OApp = "\"C:\\Users\\Admin\\AppData\\Roaming\\OApp.exe\"" 34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OApp = "\"C:\\Users\\Admin\\AppData\\Roaming\\OApp.exe\"" 34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 1812 powershell.exe 1812 powershell.exe 4916 powershell.exe 4916 powershell.exe 3528 powershell.exe 3528 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1812 powershell.exe Token: SeDebugPrivilege 4916 powershell.exe Token: SeDebugPrivilege 3528 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.execmd.exedescription pid process target process PID 4252 wrote to memory of 1720 4252 34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.exe cmd.exe PID 4252 wrote to memory of 1720 4252 34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.exe cmd.exe PID 4252 wrote to memory of 1720 4252 34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.exe cmd.exe PID 1720 wrote to memory of 1812 1720 cmd.exe powershell.exe PID 1720 wrote to memory of 1812 1720 cmd.exe powershell.exe PID 1720 wrote to memory of 1812 1720 cmd.exe powershell.exe PID 1720 wrote to memory of 4916 1720 cmd.exe powershell.exe PID 1720 wrote to memory of 4916 1720 cmd.exe powershell.exe PID 1720 wrote to memory of 4916 1720 cmd.exe powershell.exe PID 1720 wrote to memory of 3528 1720 cmd.exe powershell.exe PID 1720 wrote to memory of 3528 1720 cmd.exe powershell.exe PID 1720 wrote to memory of 3528 1720 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.exe"C:\Users\Admin\AppData\Local\Temp\34568d7cc3bf1a3c82438c5d6e2b8116a3e270ee18e723450e375b6e41f077d1.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\file.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionExtension "C:\Users\Admin\AppData\Roaming\OApp\.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD566efdaae39a4e060182da41f4c34aa01
SHA1e17d02ea96e2fe5a3e9edce74e51f1b9b9586236
SHA2564cbdddaecc1f143c2750a8c8e848c9e53978e52a45227111bf606e6b51fc5922
SHA5125b13224b9ec0f6fc3735f08d6a73f16afc5927021e422f1db07ead2738b79baf8210285eb5ed5177e5149a604c9e91074aef5ba0381e55c5d897dd45160951e0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD53dc4cb60a599844d56aabc76037081b1
SHA1c894bbcc0dd9da179de2cc04262446bf96dce773
SHA2563a01374f96a2280a5f0f9ae06a4f311b3d656827ba3b4286ff30b4b27b516b68
SHA5120bb26b2fdd456a968c12ffbadd8448eabcecd4f594d07a3bbdba4cc02009895beaa11c0f8f76a1248840b829fb36082219eae9d3dd9eb70772feea53c1cc1f5b
-
C:\Users\Admin\AppData\Local\Temp\file.batFilesize
238B
MD533523feaa8b71659f33821ba1f1888eb
SHA1d32e8a5048601b642e766c33873590b5fcf8603a
SHA256b9fa2d3b027597ab775e82d351d2e0d1f8c1e263bcc95d6f40254cd665c59449
SHA51279741c6f9b5e1c5cc482576ff12d937452aeedcd16b840a8621e73875d61ca9ca2e12aef0bb6776f275692af5e32f19695f46f297a9057b8e4ec78202cff7c07
-
memory/1720-130-0x0000000000000000-mapping.dmp
-
memory/1812-142-0x00000000074E0000-0x0000000007B5A000-memory.dmpFilesize
6.5MB
-
memory/1812-146-0x00000000070E0000-0x00000000070EE000-memory.dmpFilesize
56KB
-
memory/1812-137-0x0000000005480000-0x00000000054E6000-memory.dmpFilesize
408KB
-
memory/1812-138-0x0000000005BA0000-0x0000000005BBE000-memory.dmpFilesize
120KB
-
memory/1812-139-0x0000000006160000-0x0000000006192000-memory.dmpFilesize
200KB
-
memory/1812-140-0x0000000070470000-0x00000000704BC000-memory.dmpFilesize
304KB
-
memory/1812-141-0x0000000006130000-0x000000000614E000-memory.dmpFilesize
120KB
-
memory/1812-135-0x0000000004BE0000-0x0000000004C02000-memory.dmpFilesize
136KB
-
memory/1812-143-0x0000000006EA0000-0x0000000006EBA000-memory.dmpFilesize
104KB
-
memory/1812-144-0x0000000006F00000-0x0000000006F0A000-memory.dmpFilesize
40KB
-
memory/1812-145-0x0000000007130000-0x00000000071C6000-memory.dmpFilesize
600KB
-
memory/1812-136-0x0000000005410000-0x0000000005476000-memory.dmpFilesize
408KB
-
memory/1812-147-0x00000000071D0000-0x00000000071EA000-memory.dmpFilesize
104KB
-
memory/1812-148-0x0000000007120000-0x0000000007128000-memory.dmpFilesize
32KB
-
memory/1812-132-0x0000000000000000-mapping.dmp
-
memory/1812-134-0x0000000004C70000-0x0000000005298000-memory.dmpFilesize
6.2MB
-
memory/1812-133-0x0000000004600000-0x0000000004636000-memory.dmpFilesize
216KB
-
memory/3528-153-0x0000000000000000-mapping.dmp
-
memory/3528-155-0x0000000070470000-0x00000000704BC000-memory.dmpFilesize
304KB
-
memory/4916-152-0x0000000070470000-0x00000000704BC000-memory.dmpFilesize
304KB
-
memory/4916-149-0x0000000000000000-mapping.dmp