Overview

overview

8

Static

static

iceix_1.2.2.3.vir.exe

windows7_x64

8

iceix_1.2.2.3.vir.exe

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    iceix_1.2.2.3.vir

  • Size

    140KB

  • Sample

    200719-42v3hn563n

  • MD5

    c84b29b97802a87d61edbd32411eb507

  • SHA1

    908e1224f6279f829b0611b387159335bb46b0e0

  • SHA256

    13fc782399baf36e770245323f843a4ac8232cd8a683709ef6e992ec229caf07

  • SHA512

    7acbc27992b8bb9c19f68b1ae54b0e74c07a4b6ad8954cdd2f16debe8aa69b3919cf4d22fc142c4a255425866d70f813e6c531ef84b63fb038f8f28fe6d5d484

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      iceix_1.2.2.3.vir

    • Size

      140KB

    • MD5

      c84b29b97802a87d61edbd32411eb507

    • SHA1

      908e1224f6279f829b0611b387159335bb46b0e0

    • SHA256

      13fc782399baf36e770245323f843a4ac8232cd8a683709ef6e992ec229caf07

    • SHA512

      7acbc27992b8bb9c19f68b1ae54b0e74c07a4b6ad8954cdd2f16debe8aa69b3919cf4d22fc142c4a255425866d70f813e6c531ef84b63fb038f8f28fe6d5d484

    Score
    8/10
    evasionpersistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Modifies service

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks