Malware Analysis Report

2024-09-22 15:16

Sample ID 240531-lp1assed72
Target 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid
SHA256 9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7
Tags
gh0strat purplefox persistence rat rootkit trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7

Threat Level: Known bad

The file 2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox persistence rat rootkit trojan upx

Detect PurpleFox Rootkit

Gh0strat

PurpleFox

Gh0st RAT payload

UPX dump on OEP (original entry point)

Drops file in Drivers directory

Sets service image path in registry

UPX packed file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: LoadsDriver

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Runs ping.exe

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-31 09:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-31 09:43

Reported

2024-05-31 09:45

Platform

win7-20231129-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401de74b3fb3da01 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000084a48ec2bfe0414aaf19374bc3d07c190000000002000000000010660000000100002000000003a3e54df9d324ade5b9b027f8f680a5d321d55736dd5f217f72371a1043e21c000000000e800000000200002000000003e0bcc988d3873da6bedf3287298945e70a82895bc502f369e2285aa3d81550200000007d2a5dd44864110203ad4b39e6f4e50b9e3ec3b339ef7b11e9e406a095c221a840000000efd6b055060fd6720ee5a9c9cf2a2c31fa89030d1af4e385fddc2adda34c007e676ecf68ca8fdcb48062ff2b6f550ebcce678dc56eea4271aea82c3351e4965c C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000084a48ec2bfe0414aaf19374bc3d07c1900000000020000000000106600000001000020000000c478fdbd2027fd8cd829cbede9f28e113af1fadc7c40d2d6dabe1a963b068343000000000e80000000020000200000000228ac300961e118c26c071e7b3300a1b850d4233c5afe220e971da01a4bf0c79000000093774e4035e97a487fddb1ca5405faf1c20c6099b2a42b410f71ca1aae154b8e9f1db7d7cdd6c8f770d45868e65780e11355f07d9c36fbbec9e870fd4a6337d59b2ecef60b48a6fecfb45997b5de0722e70012088f752461317c87dc494d6f35fd51647b150cf59b8e8856a98638c0b5abc35aacc2956b654ad536c4df37337d9455f306cf809046c120ac247184a08140000000bdb3afadc139aa38b308692bbb1df1f2a01699a66ba6243f4949039ebf3c699b04a29a3e30ae93c815e98a927809a63e530e0da03e34b9ba97daadfb6c1b65b7 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423310469" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37AFCA21-1F32-11EF-B459-56A82BE80DF6} = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2320 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2320 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2320 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2320 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2320 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2320 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2320 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2880 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2880 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2880 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2880 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 1660 wrote to memory of 3052 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1660 wrote to memory of 3052 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1660 wrote to memory of 3052 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1660 wrote to memory of 3052 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1660 wrote to memory of 3052 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1660 wrote to memory of 3052 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1660 wrote to memory of 3052 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2320 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe
PID 2320 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe
PID 2320 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe
PID 2320 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe
PID 2832 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2832 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2832 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2832 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2532 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2532 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2532 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2532 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1968 wrote to memory of 2720 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 1968 wrote to memory of 2720 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 1968 wrote to memory of 2720 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 1968 wrote to memory of 2720 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2720 wrote to memory of 1920 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2720 wrote to memory of 1920 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2720 wrote to memory of 1920 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2720 wrote to memory of 1920 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe

C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://se.360.cn/

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://se.360.cn/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2720 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 se.360.cn udp
US 8.8.8.8:53 se.360.cn udp
US 104.192.108.192:80 se.360.cn tcp
US 104.192.108.192:80 se.360.cn tcp
US 8.8.8.8:53 browser.360.cn udp
CN 120.226.150.228:443 browser.360.cn tcp
CN 120.226.150.228:443 browser.360.cn tcp
CN 171.15.110.228:443 browser.360.cn tcp
CN 171.15.110.228:443 browser.360.cn tcp
CN 1.193.215.228:443 browser.360.cn tcp
CN 1.193.215.228:443 browser.360.cn tcp
CN 36.158.204.228:443 browser.360.cn tcp
CN 36.158.204.228:443 browser.360.cn tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
CN 61.163.171.161:443 browser.360.cn tcp
CN 61.163.171.161:443 browser.360.cn tcp
BE 2.17.107.120:80 www.bing.com tcp
BE 2.17.107.120:80 www.bing.com tcp

Files

\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/2880-8-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2880-9-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2880-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2880-5-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1660-18-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2880-22-0x0000000010000000-0x00000000101B6000-memory.dmp

\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe

MD5 acafd63654acc5f3799fbeb8f73d6b16
SHA1 1d4402e6a26a06779a35a2362d186ebca951b1b1
SHA256 1ab0fdf2d3c814acfd991054a001c4a19dc2fb1605e706a27f531cb32c79a6cb
SHA512 e127508b1f300d6499a9200a87c6a9e6bb2a6a174d05b84485d446663186562e6ff4eb3c827acf59bcd2d095d9889b6e4ddd8b5e41dd7a20d78d04ee06b79ed2

memory/3052-33-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1660-35-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3052-36-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3052-40-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 55de90887452d29933661ea4386b7801
SHA1 374e75e5f3ffbae4fcb50a433aa93dc7e0268f06
SHA256 2458a07a425b2129985ad1f44d3c8f89a20ee237b47ae6b569a49dec48241bff
SHA512 227dcfe33eefb85166c421a4593e4aa13a3d5a633de82dbe8238a447fb75c9ff05b5de4500d76c6a264dff0798e0b619da6475322f4a4adb67519baaf20c4ed3

memory/3052-68-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar326B.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 130a18bedf6157aee5d6f74545f898de
SHA1 85da6a64e8f571fe871831ed724596668cdb4488
SHA256 ecef9042032476160904a4c361b1ee53cb0856863ea4a74ceebbfe7f0228c86a
SHA512 bb8a186031d6fe1259955786d79840e94cb74dd1c145fd649eaa9a6ab35ed4c4ed5f734d21d008e7c20300d72c1091a58a4cb512b02c39188002b82e18dee81e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 56bf10253a298eb0eda454a667953e14
SHA1 6af34fbeaf0fa623b4a11f8e450c2fab680fde48
SHA256 e58622a3fcc8d5f6b02d6226242a79f63cd6d1601cb0922c020c60009f8a854c
SHA512 a651e594de0cfcfd047e47792376c1f28810dfd025304faf0fd99c14989de65c3c687d4979d6f77553cd4ff52d728f97f9a673388705aae6b71ebb99961f6224

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 69e7b8b512c1fc9c498e62a072ee50f3
SHA1 0b05eefe2af7f85668db11745a4c9edcc1fb6f19
SHA256 9ea80c54c0f9cf498493d9e2818d403b4b5cddf199b474bb08956c64314ba4dd
SHA512 b147e86ed8e40499823b817c135f8333c2d397d0f859071617395c387f3d7cebfdbd9cfbc3077e4f8225d62525b8a27ed57e32ab9df82208f98f8fc698097add

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4fcd835df62b35b7198feccd6e2b8ef7
SHA1 480c2236cfc98398078a1a920c068b6fae16ad63
SHA256 e2431f7d1cf7e5797b50f86a49b47d418f0a312b6914d3f3ec2c5aeed41cc524
SHA512 b9caa43951bb652c4bc802a9354d7d1aa03728f769c943aa83f78d6056ab5316d3f6540de491584723dfcdf04e1df798a56b07a6ae0ef1a615059eedf44dd617

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 862520ba2cc36f0a821e61740a739729
SHA1 de9389acc3ab58320f2b74daebf88c724a98207e
SHA256 56b54ce91156e5eb9795ecf564b222c1d7ac38add8c601ecfadff96a58f2f116
SHA512 fc4ad67e91be112b496eb420b0324797f568e1865b2a4a33bdb4cbe89c585daeb574d4674fc2ea8e3f1bde973e2e3e028ec1745ea59d68025738640536aebbec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c572db424d65827717e37d0db1822b6b
SHA1 bbd56f8a83a00608e667b4ed26617dd084ff8efc
SHA256 6993ba83a6c3d20e2e066c6390cf6c5ced8d9138dc0a262361508ae313ccc7c8
SHA512 75ea7a1bdd233b1f0f07fd239b0c53999e7fca5da275c20ddac8ba61028ad03c2e1a19b4f5ad7e9dbf23cef0ce48a79ba253376fb678c5883d20aa8974201a43

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e659eb79b5c53a59fcc34935176b1395
SHA1 4d98b47ef154a6cc98a7cd58b0426fe6087fabf4
SHA256 97395a10f961d77356aa1c3be61c9b93b3d6c9664a7cf58fbdf7596c962ff32f
SHA512 2f6e3645668166acaac426d4bb38bf4783e22bc8be9bb49c8fb3ec8843564425a36ffe40941dcea30a7f0e44f18f2f17edbae3bfe5d59225066a0104a3765366

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 69bf93130214209347f74396b311a75a
SHA1 9818a25499dbc8987d3493a6e410c351bc4106f1
SHA256 11adc31ac031748f32d2766167b138969c1df1292a15b65bfd21b41d12ae472a
SHA512 e766ceeacf50fabe118cc4c4a6ffb29d7bbc0dab072d07ed2ef4c6af682ff88fa8b5eeda7560ef567fc4e447c6caa246286405d126248a6a595560f601918106

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 48fd40cd4bebaadc1264edf2e9896a41
SHA1 377f875aeb66782f88d9f77161b3c01a033bec60
SHA256 400bd17bf78b258130c31219ab265d53e2ab7be52e4a081e9a789a12a74c462f
SHA512 8d8013c09731b0c6917648888e06d6c8afab34dc568310cc82ce51c4f5ad5c050d9b6686d24ebdc4046cd581b977eba1e14270a4d2114f394c75ab5902f7109b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1aa79ed916054710000166f2a34fa2f5
SHA1 c3bf416a1b6b65e69c379a7585c31230c15113f0
SHA256 9970b9cbafd794e88acb66ebd65bcf4d66d319a889ef492514a79b281c34fdfa
SHA512 9722c724e8b25751aa4f24d19f80f4504206d9aaa985a4becc5236fc4a39c4921100860c1b29ceadc1c3b160a65f51b012e7352c4ba1b1f8c0a1e72ae86a54b5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c8617e8e22d15968ccf86c6fecf18fc2
SHA1 f8b3aa45774bd1be0f022ee441d4daeffe0bc5ae
SHA256 25f9ef333aae27960eafcef98578f2ab7c856fb7070268efd35fdc113b696d6e
SHA512 5d723815a1b08205471e0c801b799e6d872d2312881c2e7d245877b96c717ffdae74796e62292dd18a1ffc3ae0361f7cbfaf1811e67a6cee7fd4cd4b68c1a470

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c3ca09b0c4ada6dae4ef25a56d2ee3d9
SHA1 9bb97148c6c4fb5befb44c78e6a2037f0583f27e
SHA256 01b2a4617f5665842a17148d500f8bf5561e19bbcb85e6f62ddffce15245fbad
SHA512 f5cd35e2c28b5394d5bc8084ff7be9278c7b6625e2afbed1fab83bfbc330ecb85988d0aab591b0024511c46dc4baa8ecdb74594e206d1b8df1d56fff2074fde7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 07f958fa3c0af3425de94f61ee55398b
SHA1 1fd2c0e2b4c41e0f224af80ffeeed47b1e9fb8a4
SHA256 2554ee0047c880ec525bcc815af4e037a2a56d9d30b84d10da38533516d56666
SHA512 a8c538ada42c51ca42cc10f6c4681089ada00a31c9f0653e4ddb9d7754d23cbe6078e668b06bc12ee8c2ce771cb7bee64105a74e354ee25781e0e3a9df7880fd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f810f64ee16cce8df28fd957376c6e2b
SHA1 22e25c97f17f3905e34d12a50cc2fe2dca3cb767
SHA256 91c82e86c74c09a5da7f549a92b769bc29e9828c2c1ece9302141fd185504939
SHA512 41dddbc8a5fc9ec8a484798fb75b5641d8ae496bda16330098dd19a3fe0b97e338227d816ff693a6885a6917cfe054a8a8f363fce7bfaad4a8903637d5ceb300

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0dc304dad29dc4d797b1bc1a2c1a33f1
SHA1 c3afc105d75c271bcf4413ca7a8c0b5ae6dfd2ce
SHA256 1527eab22a29f15408d4845da3ec22c9e2e12b695850007f5c76e6fedfba7e36
SHA512 f805513aed01aa79b05024990fbc6a60604b00ed440019ab304347ce96411107bc2e73f5ba5a535de27f6fd38419676b5ce4b2e8aac9b7a900d2a659dab93e0e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9f23a790bc18a1216f4a529af2abf3da
SHA1 07cd86afb7041a693bdba73720dab0537b38fbe9
SHA256 e7b04f51b55fdb9c73869cf897f82f3ef1a0630e502a66019656b2001872e827
SHA512 cc05cd8c7f725e5d2204873b997ccb42989c7b046d4cd372eb7554b9bedb1e4c4460ffe8444d236b45ae0a625c9097349ed1b6a60abf0c78d135e1dbfa739640

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 50de63bb9385890615462260165d5b7c
SHA1 ccfcd736f12cf524bdd074a4ad9934ac68efd078
SHA256 109c70df73ef9d5f2c95da9f084aa8a30d3ea3de8a08d3454b940b38677405f7
SHA512 88733a343a9ee33bc219995236ff82766da25c7f2503ea8c3469d2e6bec1bf15a5b5c57ad1bc91b627ca94add4da6b9a1e162336d64a30fb370b8ef857876233

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6d0dca1c4373d830c1986180bf910604
SHA1 a798fe1f98bc1938b4601bcfaa5324b02a9f4fbd
SHA256 086e61f5d40af3166671c545a95e29ecb445454822c85aca44fbad8ea1b44578
SHA512 f3df903e0cba08725b5734ed8f50b25be7db8faa54cfd2b5e6e1b05e7a06329adb02e565eaac28f085aabf3435ef7b19166340bf80db41e7e3ecb7ffd8bfd696

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8f65f22d02f049ebcebdd8e5ec6e4220
SHA1 3c43ea011c372c9c80a28a45645d1550d57650e5
SHA256 c0a74befc44ab89f629ad342d30feba91ece11e6cbd05da1293b2060beb2bb1d
SHA512 42159942a71c2ea377bf2dfacec590a000c19da31c79e0d6344a518d3c1640d830c1bc581a548a8332ac0ff9ff14dabd7b89581fbf9c0b46ae97c05658dc200a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a3a12937ed12582d542862e600f10c7c
SHA1 78e015f60d9c611af3e42cc33d3efc1d305b10ca
SHA256 1cc09469a398ed482f6f70db212fbc30061c23a1d8da8cc17411ffc6dfae2c99
SHA512 b7ebf1b8b176e888eb06619c0650c94cb605f033afd29c894a0274385b6510637ce514c61fffc06ad89567203439934882b404085f43f3935989ac39ea42967d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b4763cdffdf44d591aec9ec2f8d003ee
SHA1 4c41af2183f5387a1e1c12a12d84ac4ce534df33
SHA256 f31d9a2f0db591805849d9cde5d8a7b6292986906daa6faed8ea5ec8e6412a52
SHA512 582f0becf5d7b87545d59e30edc0ee8490451b086af15778c4e6348d94f3036744281ca437be64bdf800cc8c3871b5ea164eca25d1dfa09a7ea191569676ccaa

C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

MD5 da597791be3b6e732f0bc8b20e38ee62
SHA1 1125c45d285c360542027d7554a5c442288974de
SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-31 09:43

Reported

2024-05-31 09:45

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31109951" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "213726442" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31109951" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000006633b135c95c54191e4d28dd78c83740000000002000000000010660000000100002000000023e26b5d33fd99e1fad071918e3c4ff0111c10d445f70a71e2cfa6dd7b3a5715000000000e8000000002000020000000ad5ce8ef47eb1b8ae465fc63f1b563b6457aaad4f68691163084c22246bf90032000000080b37f2acdbf80517c7af2263e34d0ead425dff012374c7ab23aa45bd5eb656f40000000abc7fa9bb45a92b70dc8798ea43ee306f3167722c58c18079734f18ea866b0b5b3b0aff0d8f87620a21c7e9ae4938fc161d3b8b070f64ec96fb3e8e9559b365f C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "214819987" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "213726442" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "214819987" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31109951" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423913577" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000006633b135c95c54191e4d28dd78c83740000000002000000000010660000000100002000000012656e353838a5fac8bc4a1988daca412b89e704fc6dcd148c29723d9c6117e0000000000e8000000002000020000000dedf01c18a00d208f0909613986a4bdce236160a990357ab371973bff2ef997220000000c3c4748de4ba2f9452946d5eb39ff85ba1e8f7c602a4fcd900290ec11a732ffc40000000074aca2b200b599967dfd8f27a1c09e9ae797bb15ee3ff73d03337f6044c7550a3d0f3af28b50ca5c91e7ff833be50991f6e6d7c16537c4470dbc0fd8b90d6ac C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31109951" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40877e223fb3da01 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{385146F9-1F32-11EF-A084-FE55E2F65CCF} = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b385223fb3da01 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3820 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 3820 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 3820 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1924 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 1924 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 1924 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 224 wrote to memory of 5004 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 224 wrote to memory of 5004 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 224 wrote to memory of 5004 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3820 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe
PID 3820 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe
PID 3820 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe
PID 2196 wrote to memory of 1412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2196 wrote to memory of 1412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2196 wrote to memory of 1412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4788 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4788 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4788 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4720 wrote to memory of 3268 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 4720 wrote to memory of 3268 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 3268 wrote to memory of 1620 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3268 wrote to memory of 1620 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3268 wrote to memory of 1620 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe

C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://se.360.cn/

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://se.360.cn/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3268 CREDAT:17410 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 171.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 se.360.cn udp
US 104.192.108.23:80 se.360.cn tcp
US 104.192.108.23:80 se.360.cn tcp
US 8.8.8.8:53 browser.360.cn udp
US 8.8.8.8:53 23.108.192.104.in-addr.arpa udp
CN 61.163.171.161:443 browser.360.cn tcp
CN 61.163.171.161:443 browser.360.cn tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
CN 61.184.9.227:443 browser.360.cn tcp
CN 61.184.9.227:443 browser.360.cn tcp
CN 111.6.185.228:443 browser.360.cn tcp
CN 111.6.185.228:443 browser.360.cn tcp
CN 111.47.131.99:443 browser.360.cn tcp
CN 111.47.131.99:443 browser.360.cn tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
CN 111.47.229.228:443 browser.360.cn tcp
CN 111.47.229.228:443 browser.360.cn tcp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 se.360.cn udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp

Files

C:\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/1924-6-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1924-4-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1924-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1924-10-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/224-13-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/224-15-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/224-16-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/224-19-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_2024-05-31_7743bba6cfb7dcf82717f58a5c8ee6d5_icedid.exe

MD5 acafd63654acc5f3799fbeb8f73d6b16
SHA1 1d4402e6a26a06779a35a2362d186ebca951b1b1
SHA256 1ab0fdf2d3c814acfd991054a001c4a19dc2fb1605e706a27f531cb32c79a6cb
SHA512 e127508b1f300d6499a9200a87c6a9e6bb2a6a174d05b84485d446663186562e6ff4eb3c827acf59bcd2d095d9889b6e4ddd8b5e41dd7a20d78d04ee06b79ed2

memory/5004-28-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/224-27-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/5004-30-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/5004-32-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/5004-35-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 55de90887452d29933661ea4386b7801
SHA1 374e75e5f3ffbae4fcb50a433aa93dc7e0268f06
SHA256 2458a07a425b2129985ad1f44d3c8f89a20ee237b47ae6b569a49dec48241bff
SHA512 227dcfe33eefb85166c421a4593e4aa13a3d5a633de82dbe8238a447fb75c9ff05b5de4500d76c6a264dff0798e0b619da6475322f4a4adb67519baaf20c4ed3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5 c6440d653995acea2a63cd83b7c4d444
SHA1 5c5b83061ac0f31ff83d3a472fd77899c3bab3f0
SHA256 73e12cf5c60f5dc8dc6ad13d2d8581e5dfbbfdbd3848caa564745c19bc584d37
SHA512 d79dc9496f78dc4eb8d0376bcdca421ed8b8fb8653f654d7d3ae84afa05bbc9571589413677a4d989a04558d3bb2381ffcdabb639ce231ccd7e0cd558696d75b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5 7efd4d07e43198d298b7833afe91eb53
SHA1 73be7707dca7a51535cd47c39cce16e9da55aa99
SHA256 9ebdfb9b923bd4d873c00074c7b199e5cde440e566e966ddcf7ef8c008e1db06
SHA512 cccc88e409a898f05dbd696e0c3804ef39bb396182f1592f0a772f985d0015ed2a0cd6fdac71d5cf0b1c3bd9394fe1f0b6c531e3d56be599214350a51ff5a791

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verD9F5.tmp

MD5 1a545d0052b581fbb2ab4c52133846bc
SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DL7YY2B9\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee