Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/03/2024, 12:55
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe
Resource
win7-20240221-en
General
-
Target
2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe
-
Size
2.7MB
-
MD5
ef6f176d3684993f92127151a2ca54a3
-
SHA1
89df7c7dbaa8915c586ed43171245bd180ff16a1
-
SHA256
453ccb6b9df8e32459e12468145871aca07122c3f82b3d8b9cd2f7126324e751
-
SHA512
0ac47e09fd1c157812b9f0fb2ab08cd0ab4d290d8e0f5abc2a949d6a2be9ef427b9220ca8040b2aaf5e36199f7cfdf1548101b6fe1758eadbb5a79a920d7defb
-
SSDEEP
24576:yCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHf:yCwsbCANnKXferL7Vwe/Gg0P+WhOj
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2844-22-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2844-20-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2844-35-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2544-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2464-49-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2464-51-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2464-54-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
resource yara_rule behavioral1/files/0x000b000000014fe1-6.dat family_gh0strat behavioral1/memory/2844-21-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2844-22-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2844-20-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2544-30-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2844-35-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2544-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2464-46-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2464-49-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2464-51-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2464-54-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
UPX dump on OEP (original entry point) 11 IoCs
resource yara_rule behavioral1/memory/2844-18-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2844-21-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2844-22-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2844-20-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2544-30-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2844-35-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2544-36-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2464-46-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2464-49-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2464-51-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2464-54-0x0000000010000000-0x00000000101B6000-memory.dmp UPX -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\259421659.txt" R.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatfor.exe -
Executes dropped EXE 6 IoCs
pid Process 2940 R.exe 2844 N.exe 2544 TXPlatfor.exe 2464 TXPlatfor.exe 2548 HD_2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 2776 Remote Data.exe -
Loads dropped DLL 8 IoCs
pid Process 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 2940 R.exe 2204 svchost.exe 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 2544 TXPlatfor.exe 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 2204 svchost.exe 2776 Remote Data.exe -
resource yara_rule behavioral1/memory/2844-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2844-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2844-22-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2844-20-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2544-30-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2844-35-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2544-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2464-46-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2464-49-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2464-51-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2464-54-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ini.ini R.exe File created C:\Windows\SysWOW64\Remote Data.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Remote Data.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe N.exe File created C:\Windows\SysWOW64\259421659.txt R.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2336 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2464 TXPlatfor.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2844 N.exe Token: SeLoadDriverPrivilege 2464 TXPlatfor.exe Token: 33 2464 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 2464 TXPlatfor.exe Token: 33 2464 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 2464 TXPlatfor.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2940 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 28 PID 2804 wrote to memory of 2940 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 28 PID 2804 wrote to memory of 2940 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 28 PID 2804 wrote to memory of 2940 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 28 PID 2804 wrote to memory of 2844 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 31 PID 2804 wrote to memory of 2844 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 31 PID 2804 wrote to memory of 2844 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 31 PID 2804 wrote to memory of 2844 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 31 PID 2804 wrote to memory of 2844 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 31 PID 2804 wrote to memory of 2844 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 31 PID 2804 wrote to memory of 2844 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 31 PID 2544 wrote to memory of 2464 2544 TXPlatfor.exe 34 PID 2544 wrote to memory of 2464 2544 TXPlatfor.exe 34 PID 2544 wrote to memory of 2464 2544 TXPlatfor.exe 34 PID 2544 wrote to memory of 2464 2544 TXPlatfor.exe 34 PID 2544 wrote to memory of 2464 2544 TXPlatfor.exe 34 PID 2544 wrote to memory of 2464 2544 TXPlatfor.exe 34 PID 2544 wrote to memory of 2464 2544 TXPlatfor.exe 34 PID 2844 wrote to memory of 2560 2844 N.exe 33 PID 2844 wrote to memory of 2560 2844 N.exe 33 PID 2844 wrote to memory of 2560 2844 N.exe 33 PID 2844 wrote to memory of 2560 2844 N.exe 33 PID 2804 wrote to memory of 2548 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 35 PID 2804 wrote to memory of 2548 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 35 PID 2804 wrote to memory of 2548 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 35 PID 2804 wrote to memory of 2548 2804 2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe 35 PID 2560 wrote to memory of 2336 2560 cmd.exe 37 PID 2560 wrote to memory of 2336 2560 cmd.exe 37 PID 2560 wrote to memory of 2336 2560 cmd.exe 37 PID 2560 wrote to memory of 2336 2560 cmd.exe 37 PID 2204 wrote to memory of 2776 2204 svchost.exe 38 PID 2204 wrote to memory of 2776 2204 svchost.exe 38 PID 2204 wrote to memory of 2776 2204 svchost.exe 38 PID 2204 wrote to memory of 2776 2204 svchost.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2940
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2336
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exeC:\Users\Admin\AppData\Local\Temp\HD_2024-03-18_ef6f176d3684993f92127151a2ca54a3_icedid.exe2⤵
- Executes dropped EXE
PID:2548
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵PID:2076
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\259421659.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD534af7d270d98a093109cf44e63106d56
SHA1e68131e4f332cfd4463a76299c83744b08615453
SHA2561a874a2a9cc4a7196438cf7a734265940cc5ea27b2882298e847b45df0aa851a
SHA51238368b6f99d484b87dfb2f920f236d89b8c96334573fb931e5b9410aac090003f9c6b3e500649a5485e3c1b92a338d4b6e19d6b75e23c7fe6769ff0a1d1ffc78
-
Filesize
2.6MB
MD5274fe01eb0f4cd402c3cfdeda4b30715
SHA172db93e86caaadf2f28e5265ebfbc2ea6ba9e705
SHA256843743adaef60d2f490d2702487f7687ffa36524d11ad89feed31bbddfd21d40
SHA5126d71d57566f436c6e1242421070bca8c62ba95a7ccfc73ae5efef54f93482b3e3b742bda361b7c713a5e5158f11310401341bd1ddd4f011ba33f77c5e9543798
-
Filesize
241KB
MD539693f595bbfd94ea8d89701214a47b7
SHA10fa465ab13670c236859c392cee50a639e8f4749
SHA256422d23e4d64ca5521935dd2ce4d030c539e610f5a794a4d3bc0aee229f227fcc
SHA5120ca4179e8fe874b8a207fb22a61ecea8c8d4c86797a3d0c41d24e5b2a0a79250b792985813803188ee274604ed52c63d84efdb2245f7e8ff19055582f7e0d42e
-
Filesize
377KB
MD54a36a48e58829c22381572b2040b6fe0
SHA1f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA2563de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA5125d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
-
Filesize
941KB
MD58dc3adf1c490211971c1e2325f1424d2
SHA14eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
-
Filesize
899KB
MD5492d1f672ab75c457be67c42ef217acc
SHA1bfc079eb2cb48462d08bd0dd1f3dbc8eeaca16db
SHA25684cc248fed70d36df6b2f825435e332e4c60dabac7d63b0e3969f5614ee0b293
SHA5127d8f59bb90ea008726af8be69fed87216f924e5a9897130880dcb923dd8c989df37d8435de42671d4aa86a9dc32ccc0a261c65bcde26d00d8da0fcb1686f8714
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
Filesize
259KB
MD5d8d09de01b54932f264ee35e910b6fab
SHA13b8af881dde50a250cebc491b7c1b919c45a1cff
SHA2565a7601cb84b20f5aeceaed38ec88dc89b590fe7f3fc9fd1b60f208505f90e8e5
SHA512f26e73424230553bf5f6ea6e39c503070a31efa9cc7054bcf344fee74490a3a94097c066f72b047bb405ccea731a2b6440493ef8670e1b9f5ad59e2c34957638