Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20220722-en -
resource tags
arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system -
submitted
10-08-2022 14:13
Static task
static1
Behavioral task
behavioral1
Sample
678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe
Resource
win10-20220722-en
General
-
Target
678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe
-
Size
1.1MB
-
MD5
b603ce4a15e89ee253d97c1b1deb4941
-
SHA1
9a436e302870bbb2460fb6824333a170df577b95
-
SHA256
678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688
-
SHA512
3e82f7b6db17b094543e5e29d6c11c643b403809ff3ea6f541b71a778c498664afe63e1a5196b1c2d058233cfad3fd88851629490809d3234a0ca9f1787d2f93
Malware Config
Signatures
-
Detects IceXLoader v3.0 3 IoCs
Processes:
resource yara_rule behavioral1/memory/4512-1688-0x00000000004010BA-mapping.dmp family_icexloader_v3 behavioral1/memory/4512-1725-0x0000000000400000-0x0000000000451000-memory.dmp family_icexloader_v3 behavioral1/memory/4512-1764-0x0000000000400000-0x0000000000451000-memory.dmp family_icexloader_v3 -
icexloader
IceXLoader is a downloader used to deliver other malware families.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\bob = "\"C:\\Users\\Admin\\AppData\\Roaming\\bob.exe\"" 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exedescription pid process target process PID 2180 set thread context of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exepowershell.exepid process 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe 2292 powershell.exe 2292 powershell.exe 2292 powershell.exe 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe Token: SeDebugPrivilege 2292 powershell.exe Token: SeRemoteShutdownPrivilege 4512 InstallUtil.exe Token: SeRemoteShutdownPrivilege 4512 InstallUtil.exe Token: SeRemoteShutdownPrivilege 4512 InstallUtil.exe Token: SeRemoteShutdownPrivilege 4512 InstallUtil.exe Token: SeRemoteShutdownPrivilege 4512 InstallUtil.exe Token: SeRemoteShutdownPrivilege 4512 InstallUtil.exe Token: SeRemoteShutdownPrivilege 4512 InstallUtil.exe Token: SeRemoteShutdownPrivilege 4512 InstallUtil.exe Token: SeRemoteShutdownPrivilege 4512 InstallUtil.exe Token: SeRemoteShutdownPrivilege 4512 InstallUtil.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exedescription pid process target process PID 2180 wrote to memory of 2292 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe powershell.exe PID 2180 wrote to memory of 2292 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe powershell.exe PID 2180 wrote to memory of 2292 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe powershell.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe PID 2180 wrote to memory of 4512 2180 678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe"C:\Users\Admin\AppData\Local\Temp\678c05e87b07f6f9a979ae0f032956baf9ccb338aec4b50af77284d62fc97688.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2180-127-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-128-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-129-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-130-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-131-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-132-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-133-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-134-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-135-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-136-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-137-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-138-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-140-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-139-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-141-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-142-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-143-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-144-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-145-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-146-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-147-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-148-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-149-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-150-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-151-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-152-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-153-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-154-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-155-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-156-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-157-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-158-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-159-0x0000000000E50000-0x0000000000F70000-memory.dmpFilesize
1.1MB
-
memory/2180-160-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-161-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-162-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-163-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-164-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-165-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-166-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-167-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-168-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-169-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-170-0x0000000005690000-0x0000000005796000-memory.dmpFilesize
1.0MB
-
memory/2180-171-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2180-172-0x0000000005692000-0x0000000005793000-memory.dmpFilesize
1.0MB
-
memory/2180-173-0x0000000005692000-0x0000000005793000-memory.dmpFilesize
1.0MB
-
memory/2180-175-0x0000000005692000-0x0000000005793000-memory.dmpFilesize
1.0MB
-
memory/2180-177-0x0000000005692000-0x0000000005793000-memory.dmpFilesize
1.0MB
-
memory/2180-179-0x0000000005692000-0x0000000005793000-memory.dmpFilesize
1.0MB
-
memory/2180-181-0x0000000005692000-0x0000000005793000-memory.dmpFilesize
1.0MB
-
memory/2180-183-0x0000000005692000-0x0000000005793000-memory.dmpFilesize
1.0MB
-
memory/2180-185-0x0000000005692000-0x0000000005793000-memory.dmpFilesize
1.0MB
-
memory/2180-187-0x0000000005692000-0x0000000005793000-memory.dmpFilesize
1.0MB
-
memory/2180-189-0x0000000005692000-0x0000000005793000-memory.dmpFilesize
1.0MB
-
memory/2180-191-0x0000000005692000-0x0000000005793000-memory.dmpFilesize
1.0MB
-
memory/2180-1576-0x0000000005AA0000-0x0000000005B32000-memory.dmpFilesize
584KB
-
memory/2180-1578-0x0000000005B80000-0x0000000005BA2000-memory.dmpFilesize
136KB
-
memory/2180-1580-0x0000000005BB0000-0x0000000005F00000-memory.dmpFilesize
3.3MB
-
memory/2292-1600-0x0000000000000000-mapping.dmp
-
memory/2292-1636-0x0000000004790000-0x00000000047C6000-memory.dmpFilesize
216KB
-
memory/2292-1641-0x0000000006E50000-0x0000000007478000-memory.dmpFilesize
6.2MB
-
memory/2292-1659-0x0000000007480000-0x00000000074E6000-memory.dmpFilesize
408KB
-
memory/2292-1661-0x0000000007600000-0x0000000007666000-memory.dmpFilesize
408KB
-
memory/2292-1664-0x00000000076F0000-0x000000000770C000-memory.dmpFilesize
112KB
-
memory/2292-1665-0x0000000007CA0000-0x0000000007CEB000-memory.dmpFilesize
300KB
-
memory/2292-1669-0x0000000007F10000-0x0000000007F86000-memory.dmpFilesize
472KB
-
memory/2292-1680-0x00000000097C0000-0x0000000009E38000-memory.dmpFilesize
6.5MB
-
memory/2292-1681-0x0000000008D20000-0x0000000008D3A000-memory.dmpFilesize
104KB
-
memory/4512-1688-0x00000000004010BA-mapping.dmp
-
memory/4512-1725-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4512-1764-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB