IceTemp[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
IceTemp.exe
Size 1.1MB
Sample261113-e7w8jafw4z
SHA256 5b87a6bc1093a1efe035ffd2539c0c5b3258b8c450e325b738ace6f02c747093
MD5 5ab3802bf7976542cfa88ce662edd037
SHA1 bfd94336994c482314627f50fed8204b6363f365
SHA512 a78ed12704824ca1f58b5051d4d9df1878c1261181fa54a6e1a5fb167e810d1d26e245182d0606a14db448d964d6e4713fa1fa600ea7b048f949bd5d5d618d2d
SSDEEP 24576:xPnNFfYPGjFnyLg+emniQQ+T3U3sQ1sUVn:xPNlVcs+qgbbUVn
TLSH
T1F2359D47B5E444F8C17AC176CA97A50BDA367C0117208ADF63E1B9561F236E0AE7FB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
IceTemp.exe

File Explorer

IceTemp.exe

.exe 1.1MB

IceTemp.exe

IMPHASH 336082f4f6a3f9e36ef81e73e8b24829
SHA256 5b87a6bc1093a1efe035ffd2539c0c5b3258b8c450e325b738ace6f02c747093
MD5 5ab3802bf7976542cfa88ce662edd037
SHA1 bfd94336994c482314627f50fed8204b6363f365
SHA512 a78ed12704824ca1f58b5051d4d9df1878c1261181fa54a6e1a5fb167e810d1d26e245182d0606a14db448d964d6e4713fa1fa600ea7b048f949bd5d5d618d2d
SSDEEP 24576:xPnNFfYPGjFnyLg+emniQQ+T3U3sQ1sUVn:xPNlVcs+qgbbUVn
TLSH
T1F2359D47B5E444F8C17AC176CA97A50BDA367C0117208ADF63E1B9561F236E0AE7FB02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

434512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentThread Process32FirstW GetThreadContext GetCurrentProcessId WideCharToMultiByte IsDebuggerPresent CheckRemoteDebuggerPresent WriteFile TerminateProcess WaitForSingleObject CreateFileW GetFileAttributesW Sleep GetLastError GetFileAttributesExW CreateProcessW GetExitCodeProcess CreateDirectoryW WritePrivateProfileStringW GetEnvironmentVariableW MultiByteToWideChar GetPrivateProfileStringW GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency VerSetConditionMask QueryPerformanceCounter SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW K32GetModuleBaseNameW GetOEMCP GlobalLock IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetFileSizeEx GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetTimeZoneInformation ReadConsoleW PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc Process32NextW CreateToolhelp32Snapshot OpenProcess GetModuleHandleA GetVolumeInformationA GetComputerNameA AllocConsole GetModuleFileNameW ReadFile FreeLibraryAndExitThread GlobalUnlock GetConsoleWindow FreeLibrary GetCommandLineA LocalFree ExitThread CreateThread GetConsoleCP GetModuleHandleExW FlushConsoleInputBuffer GetProcAddress LoadLibraryW CloseHandle GlobalFree GlobalAlloc SetConsoleCursorInfo GetConsoleMode SetConsoleMode GetStdHandle GetCurrentProcess GetACP SetConsoleTitleA ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue RtlUnwind TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetModuleHandleW GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry

user32

EmptyClipboard PeekMessageW MessageBoxA TranslateMessage LoadCursorW ReleaseDC PostQuitMessage DispatchMessageW OpenClipboard CloseClipboard SetClipboardData GetClientRect SetCursor RegisterClassExW GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetClassLongPtrW SetProcessDPIAware IsWindowUnicode SetCursorPos GetCursorPos GetClipboardData FindWindowW ShowWindow CreateIconIndirect ReleaseCapture DefWindowProcW DestroyWindow GetDC SetWindowRgn CreateWindowExW SendMessageW GetSystemMetrics UnregisterClassW IsZoomed

gdi32

CreateRoundRectRgn CreateBitmap DeleteObject CreateDIBSection GetDeviceCaps

shell32

SHGetFolderPathW ShellExecuteA

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3d11

D3D11CreateDeviceAndSwapChain

dxgi

CreateDXGIFactory1

d3dcompiler_47

D3DCompile

advapi32

CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext ConvertSidToStringSidA GetUserNameA OpenProcessToken GetTokenInformation

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

VariantInit SysFreeString VariantClear SysAllocString

wininet

InternetReadFile InternetCloseHandle InternetOpenUrlA InternetOpenA

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

487KB

Virtual Size

486KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

IceTemp.exe

kernel32

user32

gdi32

shell32

imm32

d3d11

dxgi

d3dcompiler_47

advapi32

ole32

oleaut32

wininet

generic