Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04-02-2024 02:23
General
-
Target
2024-02-04_2e6c2043d52211dde035bcde1a74a4d6_icedid.exe
-
Size
9.5MB
-
MD5
2e6c2043d52211dde035bcde1a74a4d6
-
SHA1
e71ea4d436c789af01c5416c2e1815bcdf717998
-
SHA256
68a5375b61bf9a4fd4ff8d4f1ae13073391f60289f2efe8d83b297924b643ecd
-
SHA512
686ac6211a439a8a4dde3424a48dde1c0b5ee728cd478c9dc64d935ccbc614e336c1ec8d9709e900e407f6da6d3fa7265859cdf94b7e50c91e3d40c760daefa3
-
SSDEEP
24576:sHnmlJblvSdFP8THlhqe1khlqT6vpAj0qzswz5BJ:2mHz0TqevpGawzx
Malware Config
Signatures
-
Gh0st RAT payload 10 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Detects Windows executables referencing non-Windows User-Agents 8 IoCs
-
Detects executables built or packed with MPress PE compressor 6 IoCs
-
UPX dump on OEP (original entry point) 11 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 4 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_2e6c2043d52211dde035bcde1a74a4d6_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_2e6c2043d52211dde035bcde1a74a4d6_icedid.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_2e6c2043d52211dde035bcde1a74a4d6_icedid.exe2⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
437KB
MD522a57cb21c6f4c41cfac53aaf0e51f39
SHA103468759b0dc3d933e5d9b74bf43a8279ed5361a
SHA25662812b73ddd45e3d6ad5f670a1fa4a656f0d569b008c6408d88a684686109457
SHA51281fd3acc043268350e8f50bbc481219e1db6847a138d28e5a00073adf6ec866fd84dce29816c3d286465502128db9dc169f1f8a5fda1ed0d2540ad76ca39d46c
-
Filesize
162KB
MD58f8c9db30ca253fd406c3337dcbba70a
SHA1387fc59eadadee010c56ed7ef9dce1fef36c1d13
SHA2560a99a5e7cb88ad136ff84889d20fcba47a94e753fdf4e08a85dacd9b9a5e5979
SHA512a7b3c9e7765ad0c2feb03d1607e07b765b23fc28be8b657e1dc1012ea45d7b30ed5e7308c581f24001beaeb7539e040803e6c9f00f72e8093d2f3e0b056d36d3
-
Filesize
104KB
MD5c2c282672459d8ca8d591d66cdd8d72b
SHA143389b371520ee24ad6118e8fc90e282267f9d1c
SHA25652073fb48a6a23f78db1cbab9504432b4dea7fced311968881003deceeef0c6a
SHA512651a12d13c4120feb43c28bc7340628932ce77ecf23def363af5bf2ae8f8b43429aa9713a653cedadc4f3b7a13acd140ae863b8de4832a4835060354c385d1c1
-
Filesize
630KB
MD5d194312bd6dad6bd9f59d07d3960a93b
SHA145d6517c99510b71b8d9af8fe26d59dab777ab26
SHA256426501ad18441faa3284f02864d60d7031033e2796d74c628bf573ce3ce18cc4
SHA51266fd40bcea3088979f4fc1d682e7c47e448ed80f52b7a2dce0d742ebaabe322dc07996f3f25554df9b0c6650f6cb58c2ffbe093298b09ae2b026f13932e83724
-
Filesize
486KB
MD507dbb7dcd47dee2d2ad7c5eb3a39d586
SHA1ef0f7405f63db673ecb63f7f95205aac3608191d
SHA2563b447818b08c6ad0ac28624b6dd8924b2bfd80482e4675aeecda7ee312f07170
SHA512936ca28d8188ad1383d53e53484fcfcc4bd4a01d8c743775b9169cf8f471d978b5e8b6650bb84f2a177327da69ddc2e7eb7c67191428fc4ac5926bc78913d37c
-
Filesize
36KB
MD57cf8d66ebfe8dd081e6ea62d4d7e8650
SHA137f3703ebdde987939d094732bec73e507b41eb6
SHA256068b00c5df982994b67ba601c689bffe12a1430d33bb5192b599b2cb2095d1ea
SHA512ac537267c5b079a26672fbf5dd7c74013dc3d510578324f4965fa43b03d8d7c05c5ce3f9f7d7992cd37716f272856ab112caa65611e70c89295cabb39496309c
-
Filesize
1.1MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
488KB
-
Filesize
3.4MB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
488KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
488KB