Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 09:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe
Resource
win7-20231129-en
General
-
Target
2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe
-
Size
4.0MB
-
MD5
7743bba6cfb7dcf82717f58a5c8ee6d5
-
SHA1
16618c8210a37be3575a34f04803e83c346cba48
-
SHA256
9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7
-
SHA512
4f99608fa3d12704d0018b043f7c91c903500c58302cfd83dbdcd28c1dee4050ac4ed28f24f02e2d70054f52f3c39fbd77aaad721eebd59152dafe6e4f68c2a3
-
SSDEEP
98304:9ZJt4HINy2Lk+ip46cXdVpVpmby+r2Ohkgkh:viINy2Lk1hQA28VS
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1924-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1924-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1924-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/224-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/224-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/224-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/5004-28-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/224-27-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/5004-30-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/5004-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/5004-35-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/1924-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1924-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1924-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/224-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/224-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/224-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/5004-28-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/224-27-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/5004-30-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/5004-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/5004-35-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
UPX dump on OEP (original entry point) 13 IoCs
Processes:
resource yara_rule behavioral2/memory/1924-6-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/1924-4-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/1924-7-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/1924-10-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/224-13-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/224-15-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/224-16-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/224-19-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/5004-28-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/224-27-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/5004-30-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/5004-32-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/5004-35-0x0000000010000000-0x00000000101B6000-memory.dmp UPX -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe -
Executes dropped EXE 4 IoCs
Processes:
RVN.exeTXPlatforn.exeTXPlatforn.exeHD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exepid process 1924 RVN.exe 224 TXPlatforn.exe 5004 TXPlatforn.exe 4788 HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe -
Processes:
resource yara_rule behavioral2/memory/1924-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1924-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1924-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1924-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/224-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/224-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/224-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/224-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5004-28-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/224-27-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5004-30-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5004-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5004-35-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
RVN.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 5 IoCs
Processes:
2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31109951" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "213726442" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31109951" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000006633b135c95c54191e4d28dd78c83740000000002000000000010660000000100002000000023e26b5d33fd99e1fad071918e3c4ff0111c10d445f70a71e2cfa6dd7b3a5715000000000e8000000002000020000000ad5ce8ef47eb1b8ae465fc63f1b563b6457aaad4f68691163084c22246bf90032000000080b37f2acdbf80517c7af2263e34d0ead425dff012374c7ab23aa45bd5eb656f40000000abc7fa9bb45a92b70dc8798ea43ee306f3167722c58c18079734f18ea866b0b5b3b0aff0d8f87620a21c7e9ae4938fc161d3b8b070f64ec96fb3e8e9559b365f IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "214819987" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "213726442" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "214819987" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31109951" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423913577" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000006633b135c95c54191e4d28dd78c83740000000002000000000010660000000100002000000012656e353838a5fac8bc4a1988daca412b89e704fc6dcd148c29723d9c6117e0000000000e8000000002000020000000dedf01c18a00d208f0909613986a4bdce236160a990357ab371973bff2ef997220000000c3c4748de4ba2f9452946d5eb39ff85ba1e8f7c602a4fcd900290ec11a732ffc40000000074aca2b200b599967dfd8f27a1c09e9ae797bb15ee3ff73d03337f6044c7550a3d0f3af28b50ca5c91e7ff833be50991f6e6d7c16537c4470dbc0fd8b90d6ac IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31109951" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40877e223fb3da01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{385146F9-1F32-11EF-A084-FE55E2F65CCF} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b385223fb3da01 IEXPLORE.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exepid process 3820 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe 3820 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 5004 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RVN.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 1924 RVN.exe Token: SeLoadDriverPrivilege 5004 TXPlatforn.exe Token: 33 5004 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 5004 TXPlatforn.exe Token: 33 5004 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 5004 TXPlatforn.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 3268 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exeIEXPLORE.EXEIEXPLORE.EXEpid process 3820 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe 3820 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe 3268 IEXPLORE.EXE 3268 IEXPLORE.EXE 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exeRVN.exeTXPlatforn.execmd.exeHD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exeiexplore.exeIEXPLORE.EXEdescription pid process target process PID 3820 wrote to memory of 1924 3820 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe RVN.exe PID 3820 wrote to memory of 1924 3820 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe RVN.exe PID 3820 wrote to memory of 1924 3820 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe RVN.exe PID 1924 wrote to memory of 2196 1924 RVN.exe cmd.exe PID 1924 wrote to memory of 2196 1924 RVN.exe cmd.exe PID 1924 wrote to memory of 2196 1924 RVN.exe cmd.exe PID 224 wrote to memory of 5004 224 TXPlatforn.exe TXPlatforn.exe PID 224 wrote to memory of 5004 224 TXPlatforn.exe TXPlatforn.exe PID 224 wrote to memory of 5004 224 TXPlatforn.exe TXPlatforn.exe PID 3820 wrote to memory of 4788 3820 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe PID 3820 wrote to memory of 4788 3820 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe PID 3820 wrote to memory of 4788 3820 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe PID 2196 wrote to memory of 1412 2196 cmd.exe PING.EXE PID 2196 wrote to memory of 1412 2196 cmd.exe PING.EXE PID 2196 wrote to memory of 1412 2196 cmd.exe PING.EXE PID 4788 wrote to memory of 4720 4788 HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe iexplore.exe PID 4788 wrote to memory of 4720 4788 HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe iexplore.exe PID 4788 wrote to memory of 4720 4788 HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe iexplore.exe PID 4720 wrote to memory of 3268 4720 iexplore.exe IEXPLORE.EXE PID 4720 wrote to memory of 3268 4720 iexplore.exe IEXPLORE.EXE PID 3268 wrote to memory of 1620 3268 IEXPLORE.EXE IEXPLORE.EXE PID 3268 wrote to memory of 1620 3268 IEXPLORE.EXE IEXPLORE.EXE PID 3268 wrote to memory of 1620 3268 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exeC:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://se.360.cn/3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://se.360.cn/4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3268 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5c6440d653995acea2a63cd83b7c4d444
SHA15c5b83061ac0f31ff83d3a472fd77899c3bab3f0
SHA25673e12cf5c60f5dc8dc6ad13d2d8581e5dfbbfdbd3848caa564745c19bc584d37
SHA512d79dc9496f78dc4eb8d0376bcdca421ed8b8fb8653f654d7d3ae84afa05bbc9571589413677a4d989a04558d3bb2381ffcdabb639ce231ccd7e0cd558696d75b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD57efd4d07e43198d298b7833afe91eb53
SHA173be7707dca7a51535cd47c39cce16e9da55aa99
SHA2569ebdfb9b923bd4d873c00074c7b199e5cde440e566e966ddcf7ef8c008e1db06
SHA512cccc88e409a898f05dbd696e0c3804ef39bb396182f1592f0a772f985d0015ed2a0cd6fdac71d5cf0b1c3bd9394fe1f0b6c531e3d56be599214350a51ff5a791
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verD9F5.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DL7YY2B9\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exeFilesize
2.8MB
MD5acafd63654acc5f3799fbeb8f73d6b16
SHA11d4402e6a26a06779a35a2362d186ebca951b1b1
SHA2561ab0fdf2d3c814acfd991054a001c4a19dc2fb1605e706a27f531cb32c79a6cb
SHA512e127508b1f300d6499a9200a87c6a9e6bb2a6a174d05b84485d446663186562e6ff4eb3c827acf59bcd2d095d9889b6e4ddd8b5e41dd7a20d78d04ee06b79ed2
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.2MB
MD555de90887452d29933661ea4386b7801
SHA1374e75e5f3ffbae4fcb50a433aa93dc7e0268f06
SHA2562458a07a425b2129985ad1f44d3c8f89a20ee237b47ae6b569a49dec48241bff
SHA512227dcfe33eefb85166c421a4593e4aa13a3d5a633de82dbe8238a447fb75c9ff05b5de4500d76c6a264dff0798e0b619da6475322f4a4adb67519baaf20c4ed3
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeFilesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
memory/224-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/224-19-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/224-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/224-27-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/224-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1924-10-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1924-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1924-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1924-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5004-28-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5004-30-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5004-32-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5004-35-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB