Overview

overview

10

Static

static

10

79915A1352...BA.exe

windows7-x64

10

79915A1352...BA.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    79915A1352DA45F69FBD193F7BD28BBA64949DFE6C2BA.exe

  • Size

    348KB

  • Sample

    220926-ccn8bsghf7

  • MD5

    6210be523c5fab6a205772fc1a6abfb4

  • SHA1

    b9ad3b37702aa0187592fb39b26148d8b320b6ca

  • SHA256

    79915a1352da45f69fbd193f7bd28bba64949dfe6c2baf8090151e676aad2448

  • SHA512

    a98fb903c1d9f2d23a9a7a67e8bc7f27228f054105ac43413e6887ff8c0de29968b5d71218a116f7f73a814a8be4bc50b4c78c4e913c5da1b1083c51c80fbdab

  • SSDEEP

    6144:ZbslI7b8btZ1WMYORbMV9bwkn8gfyVQhAyPlb/2:ZbvwnEMtWwk3fyVQhAyPlb/2

Score
10/10
icexloaderloaderpersistence

Malware Config

Extracted

Family

icexloader

C2

http://onedemandone.biz/Server/Script.php

Targets

    • Target

      79915A1352DA45F69FBD193F7BD28BBA64949DFE6C2BA.exe

    • Size

      348KB

    • MD5

      6210be523c5fab6a205772fc1a6abfb4

    • SHA1

      b9ad3b37702aa0187592fb39b26148d8b320b6ca

    • SHA256

      79915a1352da45f69fbd193f7bd28bba64949dfe6c2baf8090151e676aad2448

    • SHA512

      a98fb903c1d9f2d23a9a7a67e8bc7f27228f054105ac43413e6887ff8c0de29968b5d71218a116f7f73a814a8be4bc50b4c78c4e913c5da1b1083c51c80fbdab

    • SSDEEP

      6144:ZbslI7b8btZ1WMYORbMV9bwkn8gfyVQhAyPlb/2:ZbvwnEMtWwk3fyVQhAyPlb/2

    Score
    10/10
    icexloaderloaderpersistence

    • icexloader

      IceXLoader is a downloader used to deliver other malware families.

      loadericexloader

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks