bbdf6022d12ea88e1fad8b6806e5353b407a12cac98b82e3742a6b6aef43d0a8

General

Target

bbdf6022d12ea88e1fad8b6806e5353b407a12cac98b82e3742a6b6aef43d0a8.exe
Size

850KB
MD5

617935448c3a5753762ac8c59d002b09
SHA1

547c265e6940de4eaa9b756f3eabd44e5945b8aa
SHA256

bbdf6022d12ea88e1fad8b6806e5353b407a12cac98b82e3742a6b6aef43d0a8
SHA512

88dfba3cc824a0430b14962395d0f5ed93eb559e077d9162b1d4577d1f8a1e2110a9e87b2e5eb928560f4f087964d923644b120c1b384b43f232c2b1ca6245de
SSDEEP

6144:5tvrVv35gx/v6TTBgU5dsbopjLn5i2Lm8pbu5n+QKyX37RodENtQsEb8bKQdh/zH:HpvJKOdsKjL33e7RodvB5

Score

9^/10

miner upx

Malware Config

Signatures

Detectes Phoenix Miner Payload 3 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2008-74-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix
behavioral1/memory/2008-75-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix
behavioral1/memory/2008-76-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix

Executes dropped EXE 1 IoCs

Processes:

ICELIUF.exe

pid process

1096 ICELIUF.exe

pid	process
1096	ICELIUF.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2008-67-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral1/memory/2008-69-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral1/memory/2008-70-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral1/memory/2008-72-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral1/memory/2008-73-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral1/memory/2008-74-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral1/memory/2008-75-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral1/memory/2008-76-0x0000000140000000-0x000000014082B000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

272 cmd.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

RegSvcs.exe

pid process

2008 RegSvcs.exe
2008 RegSvcs.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

ICELIUF.exe

description pid process target process

PID 1096 set thread context of 2008 1096 ICELIUF.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1240 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1756 timeout.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ICELIUF.exe

pid process

1096 ICELIUF.exe

pid	process
272	cmd.exe

pid	process
2008	RegSvcs.exe
2008	RegSvcs.exe

description	pid	process	target process
PID 1096 set thread context of 2008	1096	ICELIUF.exe	RegSvcs.exe

pid	process
1240	schtasks.exe

pid	process
1756	timeout.exe

pid	process
1096	ICELIUF.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

bbdf6022d12ea88e1fad8b6806e5353b407a12cac98b82e3742a6b6aef43d0a8.exeICELIUF.exe

description	pid	process
Token: SeDebugPrivilege	1648	bbdf6022d12ea88e1fad8b6806e5353b407a12cac98b82e3742a6b6aef43d0a8.exe
Token: SeDebugPrivilege	1096	ICELIUF.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

bbdf6022d12ea88e1fad8b6806e5353b407a12cac98b82e3742a6b6aef43d0a8.execmd.exeICELIUF.execmd.exe

description	pid	process	target process
PID 1648 wrote to memory of 272	1648	bbdf6022d12ea88e1fad8b6806e5353b407a12cac98b82e3742a6b6aef43d0a8.exe	cmd.exe
PID 1648 wrote to memory of 272	1648	bbdf6022d12ea88e1fad8b6806e5353b407a12cac98b82e3742a6b6aef43d0a8.exe	cmd.exe
PID 1648 wrote to memory of 272	1648	bbdf6022d12ea88e1fad8b6806e5353b407a12cac98b82e3742a6b6aef43d0a8.exe	cmd.exe
PID 272 wrote to memory of 1756	272	cmd.exe	timeout.exe
PID 272 wrote to memory of 1756	272	cmd.exe	timeout.exe
PID 272 wrote to memory of 1756	272	cmd.exe	timeout.exe
PID 272 wrote to memory of 1096	272	cmd.exe	ICELIUF.exe
PID 272 wrote to memory of 1096	272	cmd.exe	ICELIUF.exe
PID 272 wrote to memory of 1096	272	cmd.exe	ICELIUF.exe
PID 1096 wrote to memory of 960	1096	ICELIUF.exe	cmd.exe
PID 1096 wrote to memory of 960	1096	ICELIUF.exe	cmd.exe
PID 1096 wrote to memory of 960	1096	ICELIUF.exe	cmd.exe
PID 960 wrote to memory of 1240	960	cmd.exe	schtasks.exe
PID 960 wrote to memory of 1240	960	cmd.exe	schtasks.exe
PID 960 wrote to memory of 1240	960	cmd.exe	schtasks.exe
PID 1096 wrote to memory of 2008	1096	ICELIUF.exe	RegSvcs.exe
PID 1096 wrote to memory of 2008	1096	ICELIUF.exe	RegSvcs.exe
PID 1096 wrote to memory of 2008	1096	ICELIUF.exe	RegSvcs.exe
PID 1096 wrote to memory of 2008	1096	ICELIUF.exe	RegSvcs.exe
PID 1096 wrote to memory of 2008	1096	ICELIUF.exe	RegSvcs.exe
PID 1096 wrote to memory of 2008	1096	ICELIUF.exe	RegSvcs.exe
PID 1096 wrote to memory of 2008	1096	ICELIUF.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\bbdf6022d12ea88e1fad8b6806e5353b407a12cac98b82e3742a6b6aef43d0a8.exe
"C:\Users\Admin\AppData\Local\Temp\bbdf6022d12ea88e1fad8b6806e5353b407a12cac98b82e3742a6b6aef43d0a8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpE3CB.tmp.bat""
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:272

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1756

C:\ProgramData\System0\ICELIUF.exe
"C:\ProgramData\System0\ICELIUF.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "ICELIUF" /tr "C:\ProgramData\System0\ICELIUF.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "ICELIUF" /tr "C:\ProgramData\System0\ICELIUF.exe"
5⤵
- Creates scheduled task(s)
PID:1240

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe -pool ssl://eu1-etc.ethermine.org:5555 -wal 0xaC24bB4F74b2c83F3ACa168B71B5f45764a95e91.Rig001 -coin etc -log 0
4⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\System0\ICELIUF.exe
Filesize
850KB

MD5
617935448c3a5753762ac8c59d002b09

SHA1
547c265e6940de4eaa9b756f3eabd44e5945b8aa

SHA256
bbdf6022d12ea88e1fad8b6806e5353b407a12cac98b82e3742a6b6aef43d0a8

SHA512
88dfba3cc824a0430b14962395d0f5ed93eb559e077d9162b1d4577d1f8a1e2110a9e87b2e5eb928560f4f087964d923644b120c1b384b43f232c2b1ca6245de

Download Submit
C:\ProgramData\System0\ICELIUF.exe
Filesize
850KB

MD5
617935448c3a5753762ac8c59d002b09

SHA1
547c265e6940de4eaa9b756f3eabd44e5945b8aa

SHA256
bbdf6022d12ea88e1fad8b6806e5353b407a12cac98b82e3742a6b6aef43d0a8

SHA512
88dfba3cc824a0430b14962395d0f5ed93eb559e077d9162b1d4577d1f8a1e2110a9e87b2e5eb928560f4f087964d923644b120c1b384b43f232c2b1ca6245de

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE3CB.tmp.bat
Filesize
143B

MD5
4f8b501cb099b16c662033c8e4548db1

SHA1
1d9edcff827b723dd2b04417c9acb70494057da2

SHA256
9fd0861069fdbc78207b44930fa777437f6f2723592c22775020632e530100c0

SHA512
aaef261e3d3ae79b66473efb85ddfe62f2e41a50f9e7a03cfad72bbdc0e1db3cd1790717dc0d5fcd7c8dc6e7586193db7904e20a82ee7574c579aa6439403604

Download Submit
\ProgramData\System0\ICELIUF.exe
Filesize
850KB

MD5
617935448c3a5753762ac8c59d002b09

SHA1
547c265e6940de4eaa9b756f3eabd44e5945b8aa

SHA256
bbdf6022d12ea88e1fad8b6806e5353b407a12cac98b82e3742a6b6aef43d0a8

SHA512
88dfba3cc824a0430b14962395d0f5ed93eb559e077d9162b1d4577d1f8a1e2110a9e87b2e5eb928560f4f087964d923644b120c1b384b43f232c2b1ca6245de

Download Submit
memory/272-55-0x0000000000000000-mapping.dmp

Download
memory/960-64-0x0000000000000000-mapping.dmp

Download
memory/1096-62-0x0000000000C70000-0x0000000000D48000-memory.dmp

Filesize
864KB

Download
memory/1096-59-0x0000000000000000-mapping.dmp

Download
memory/1096-63-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/1240-65-0x0000000000000000-mapping.dmp

Download
memory/1648-54-0x00000000012F0000-0x00000000013C8000-memory.dmp

Filesize
864KB

Download
memory/1756-57-0x0000000000000000-mapping.dmp

Download
memory/2008-69-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/2008-67-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/2008-66-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/2008-71-0x0000000140829C40-mapping.dmp

Download
memory/2008-70-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/2008-72-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/2008-73-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/2008-74-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/2008-75-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download
memory/2008-76-0x0000000140000000-0x000000014082B000-memory.dmp

Filesize
8.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads