Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 07:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe
-
Size
2.8MB
-
MD5
1962cec144630224183ee8103d28d116
-
SHA1
152159933027afbee33efddc8a7d5aac7122accd
-
SHA256
57a4bcc2e450cf6f5bf7daa405ffa6312b970c59673611429ac427b9ca75d459
-
SHA512
98bd05649b09df3a2c67d6e8aaa16932fdf6290a31c3582d40db190d9999f709612ddc95d6375a20065e3487ef833d6405801ad07a65cd7694c0890183292c6a
-
SSDEEP
49152:oX4uXjo0ZeY3dlI0SpxM3M7TF9FN5vUikV1XacrE1:I4uTo0ZewbI0Sp7yDXakE1
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 2 IoCs
resource yara_rule behavioral1/memory/2188-17433-0x0000000000400000-0x0000000000548000-memory.dmp unk_chinese_botnet behavioral1/memory/13292-17438-0x0000000000400000-0x0000000000548000-memory.dmp unk_chinese_botnet -
Executes dropped EXE 4 IoCs
pid Process 1064 SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe 2220 svchost.exe 2188 QQ.exe 13292 Kvzbtbs.exe -
Loads dropped DLL 5 IoCs
pid Process 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe -
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\Guazi - Ìáȡͼ±ê .&R SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\Guazi - Ìáȡͼ±ê .&R\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe %1" SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Guazi - Ìáȡͼ±ê .&R\command SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Guazi - Ìáȡͼ±ê .&R SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Guazi - Ìáȡͼ±ê .&R\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe %1" SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\Guazi - Ìáȡͼ±ê .&R\command SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Kvzbtbs.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 45 IoCs
pid Process 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 13292 Kvzbtbs.exe 13292 Kvzbtbs.exe 2188 QQ.exe 13292 Kvzbtbs.exe 2188 QQ.exe 13292 Kvzbtbs.exe 2188 QQ.exe 13292 Kvzbtbs.exe 2188 QQ.exe 13292 Kvzbtbs.exe 2188 QQ.exe 13292 Kvzbtbs.exe 2188 QQ.exe 13292 Kvzbtbs.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe 2188 QQ.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Kvzbtbs.exe QQ.exe File opened for modification C:\Program Files (x86)\Kvzbtbs.exe QQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-0e-14-f1-05-98\WpadDecision = "0" Kvzbtbs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Kvzbtbs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Kvzbtbs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{56FC3A2C-2FE4-44C5-83F1-B67E13CEB319} Kvzbtbs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{56FC3A2C-2FE4-44C5-83F1-B67E13CEB319}\WpadDecisionTime = 3007ca47d0a5da01 Kvzbtbs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{56FC3A2C-2FE4-44C5-83F1-B67E13CEB319}\WpadDecisionReason = "1" Kvzbtbs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{56FC3A2C-2FE4-44C5-83F1-B67E13CEB319}\WpadNetworkName = "Network 3" Kvzbtbs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-0e-14-f1-05-98 Kvzbtbs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-0e-14-f1-05-98\WpadDecisionTime = 3007ca47d0a5da01 Kvzbtbs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Kvzbtbs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Kvzbtbs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Kvzbtbs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Kvzbtbs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b6-0e-14-f1-05-98\WpadDecisionReason = "1" Kvzbtbs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Kvzbtbs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Kvzbtbs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Kvzbtbs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f003b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Kvzbtbs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{56FC3A2C-2FE4-44C5-83F1-B67E13CEB319}\WpadDecision = "0" Kvzbtbs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{56FC3A2C-2FE4-44C5-83F1-B67E13CEB319}\b6-0e-14-f1-05-98 Kvzbtbs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Kvzbtbs.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Kvzbtbs.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Kvzbtbs.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Kvzbtbs.exe -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Guazi - Ìáȡͼ±ê .&R\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe %1" SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\icofile\shell\Guazi - Ìáȡͼ±ê .&R\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe %1" SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dllfile SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Guazi - Ìáȡͼ±ê .&R\command SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Guazi - Ìáȡͼ±ê .&R\command SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Guazi - Ìáȡͼ±ê .&R SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Guazi - Ìáȡͼ±ê .&R\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe %1" SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Guazi - Ìáȡͼ±ê .&R SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\Guazi - Ìáȡͼ±ê .&R\command SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\Guazi - Ìáȡͼ±ê .&R\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe %1" SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\icofile\shell\Guazi - Ìáȡͼ±ê .&R\command SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\icofile SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\icofile\shell SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\icofile\shell\Guazi - Ìáȡͼ±ê .&R SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\Guazi - Ìáȡͼ±ê .&R SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2220 svchost.exe 1064 SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 1064 SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe 2220 svchost.exe 1064 SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1736 wrote to memory of 1064 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 28 PID 1736 wrote to memory of 1064 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 28 PID 1736 wrote to memory of 1064 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 28 PID 1736 wrote to memory of 1064 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 28 PID 1736 wrote to memory of 2220 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 29 PID 1736 wrote to memory of 2220 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 29 PID 1736 wrote to memory of 2220 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 29 PID 1736 wrote to memory of 2220 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 29 PID 1736 wrote to memory of 2188 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 30 PID 1736 wrote to memory of 2188 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 30 PID 1736 wrote to memory of 2188 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 30 PID 1736 wrote to memory of 2188 1736 2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_1962cec144630224183ee8103d28d116_icedid.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Roaming\SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe"C:\Users\Admin\AppData\Roaming\SGÎļþͼ±êÌáÈ¡¹¤¾ß.exe"2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1064
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2220
-
-
C:\Users\Admin\AppData\Roaming\QQ.exe"C:\Users\Admin\AppData\Roaming\QQ.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
PID:2188
-
-
C:\Program Files (x86)\Kvzbtbs.exe"C:\Program Files (x86)\Kvzbtbs.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
PID:13292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
936KB
MD5f21c518bcafa5fe911f17ffb3c1797b0
SHA16ddf4338b8802ed0e698af6d78695cc12d7e55d6
SHA256a64ace959b459d7f23ceb7b2ff1cbe7f9346e3aa412118d4078b940e13b087a8
SHA512482a3c93ed737da332be810d543a2afd274b6c20ebcdccf4a324cca756629ffcd402c7ba5b514ad19f91bb27ecdc3de0e3baa30f65658c1f152ad1bcc9f8f25f
-
Filesize
872KB
MD5257d8640f79f41db430b9dfa20c6d19e
SHA1d09f03d190c5a59cee6baa70dca1ea0ec976b4d1
SHA2568fe3afa3c6e44fdac6880dabb110abc4ff4a2b8a9c6df4b966d3a5a4ca31e64d
SHA512653451cb87b37ebb7ac129fbfb3a19bc59c0f00941b2a570c71beb74e5dc53ad669d165c2e4f9891fb7585ef78e0dd1ab1c41337604f610c7531cb1d792e9534
-
Filesize
296KB
MD5a6acb044a1e5f1813c671cd604e614b1
SHA135ea9a47a692cc805d6e9050b731d49e5609591b
SHA256c196618be7a7bac1f55f080c52ca2b51d80fd748554957708741b9ed3c722167
SHA512487fb1a1c56363d2276e1c5a4f5af2461b6c484e432a6d991e2e6caf2558328be8cd1bf1294c3b3218b21fb2b58bd006155584708fcb2bdc162bad17f187627e