Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
16/04/2024, 15:16
General
-
Target
2024-04-16_9648684da39757165bcbfcc5190692a8_icedid.exe
-
Size
2.9MB
-
MD5
9648684da39757165bcbfcc5190692a8
-
SHA1
72c3c6124b8d5ce7785fb93447fb3f7665a1e9fa
-
SHA256
f728af4444a9eb3fd2913a11f26fdf7cc54fbb0cc119b5f04de2e824b2b6fd62
-
SHA512
5f60922649bf4c96d276065d0a85a23960ef72025b9749bfd63bd75607271483b88b47ebc03700f32e9fcb1eac2d565337b4682a0aedafe136441a1e3e056f17
-
SSDEEP
49152:dCwsbCANnKXferL7Vwe/Gg0P+WhIymgoeR6fphT40p15l:gws2ANnKXOaeOgmhIymbeR6fNp
Malware Config
Signatures
-
Detect PurpleFox Rootkit 9 IoCs
Detect PurpleFox Rootkit.
-
Gh0st RAT payload 11 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
UPX dump on OEP (original entry point) 12 IoCs
-
Drops file in Drivers directory 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 3 IoCs
-
UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 6 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_9648684da39757165bcbfcc5190692a8_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_9648684da39757165bcbfcc5190692a8_icedid.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_2024-04-16_9648684da39757165bcbfcc5190692a8_icedid.exeC:\Users\Admin\AppData\Local\Temp\HD_2024-04-16_9648684da39757165bcbfcc5190692a8_icedid.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240594156.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
492KB
MD56bb49688af9f7ea092d6ee1a8bad7970
SHA1684c44dd250909168cbbd7788e72dc10dd87ce3c
SHA2561a4b6cd9c717866c6442f5775eaab2662f40c94e49f6fa7e637f51f4d0c622c7
SHA512ef52b8678eb5135484befa122de626d1fc534c1b4768529ca995451dc4d53a226e091f8b6e89705d6920177b787f036bcd45da16bc2e150ef7c197498d8886d1
-
Filesize
2.4MB
MD5180e7b0bb8f6eec04a5becc418eabb2d
SHA137fc6e44c8489e70b5235af1760135ef93aa8625
SHA256f0ed3a5891c4f5147d7ef987442499673d821bc5cbfbfaa56124ac64ebd88a58
SHA512a67bdb3db3bfa74b8430626bff65216d92be7f9a31ed548f0edccf8af97e4f440760f63b815b325cf7cbbab0414c707288a7edfb235076e733526729c37a68c6
-
Filesize
377KB
MD54a36a48e58829c22381572b2040b6fe0
SHA1f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA2563de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA5125d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
-
Filesize
941KB
MD58dc3adf1c490211971c1e2325f1424d2
SHA14eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
-
Filesize
899KB
MD57ab5c6c30a1bab3d784f106e1e4f5976
SHA1f07493d8db8a75cf3b0e0b4ee905dd194311beb6
SHA256b254870ff1cd938303b2fabb57bb1242361b8b961b38c19dd2d13dc12f9da604
SHA51289938bad865b5de50fe2c8f4bb02848770bc4b6ae75ae4561e2b0f311d9da152df86318230314781662da751a6b894415faf8e6d7267b3b6e268ae5af165eca2
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB