Behavioral task
behavioral1
Sample
Ice.exe
Resource
win7-20230712-en
General
-
Target
Ice.exe
-
Size
228KB
-
MD5
5f25397473870629f943edcc0b137281
-
SHA1
368474f6392f0547bc02b138fe199a7b005d0122
-
SHA256
03dbbb05e1588d2303720a4edfb8cb0c6dfef922b85ed66d43b67cde6bc68c3e
-
SHA512
de326d719bb44fade2693afbdf79b8f89a38f4405eadf087bf75a049af27195cda9b8b2b1bae0c254d7202f3f2539217201389135b5255584e16ecb8eb6af1e7
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4v2AsbhS6FiAxDeebdyb8e1m/i:joZtL+EP8v2AsbhS6FiAxDeeb4h
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1134522402752172043/8EJp_9pCTCvpuTgMYBDcd2nuK13GxYf4SCK7CGg_sajnsqKTxj4pixGeImKdnzXQGR7M
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Ice.exe
Files
-
Ice.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ