Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2024 14:43
Behavioral task
behavioral1
Sample
2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe
Resource
win7-20241023-en
General
-
Target
2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe
-
Size
2.8MB
-
MD5
703ef2034e4a8d51679fae3ca9d2a910
-
SHA1
f88d802057f4218729b23fcb011ba0547617a3d0
-
SHA256
d01685aa51c1ddc668fda95f0dc4e6add1774dd8c297d4040a73d3610cfa27ba
-
SHA512
099bd3b810ec26f8925c7eddfb490e2a370425c5903affdb197ab2cd82940514ec4464bf0a8c473988ce9b3811af99df8b3b0159345782585efe2023e6e96a92
-
SSDEEP
49152:vYREXSVMDi3LBSJXAJXx/nsHyjtk2MYC5GD+J1ipFKspIO/ROixDwwT:w2SVMD8LBSKJB/nsmtk2aLQ7wO/RO+cs
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023c7a-5.dat family_gh0strat -
Gh0strat family
-
Xred family
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240626796.bat" look2.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation ._cache_HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation ._cache_Synaptics.exe -
Executes dropped EXE 8 IoCs
pid Process 3624 look2.exe 1376 HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 4256 ._cache_HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 3128 Synaptics.exe 2360 ._cache_Synaptics.exe 1736 fastboot.exe 3864 fastboot.exe 4092 svchcst.exe -
Loads dropped DLL 7 IoCs
pid Process 3624 look2.exe 952 svchost.exe 1736 fastboot.exe 1736 fastboot.exe 3864 fastboot.exe 3864 fastboot.exe 4092 svchcst.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe File created C:\Windows\SysWOW64\240626796.bat look2.exe File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fastboot.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fastboot.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language look2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 60 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2912 2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 2912 2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2912 2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 2912 2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2912 wrote to memory of 3624 2912 2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 83 PID 2912 wrote to memory of 3624 2912 2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 83 PID 2912 wrote to memory of 3624 2912 2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 83 PID 2912 wrote to memory of 1376 2912 2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 87 PID 2912 wrote to memory of 1376 2912 2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 87 PID 2912 wrote to memory of 1376 2912 2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 87 PID 1376 wrote to memory of 4256 1376 HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 90 PID 1376 wrote to memory of 4256 1376 HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 90 PID 1376 wrote to memory of 4256 1376 HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 90 PID 1376 wrote to memory of 3128 1376 HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 91 PID 1376 wrote to memory of 3128 1376 HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 91 PID 1376 wrote to memory of 3128 1376 HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 91 PID 4256 wrote to memory of 2896 4256 ._cache_HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 92 PID 4256 wrote to memory of 2896 4256 ._cache_HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 92 PID 4256 wrote to memory of 2896 4256 ._cache_HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe 92 PID 3128 wrote to memory of 2360 3128 Synaptics.exe 95 PID 3128 wrote to memory of 2360 3128 Synaptics.exe 95 PID 3128 wrote to memory of 2360 3128 Synaptics.exe 95 PID 2896 wrote to memory of 1736 2896 cmd.exe 97 PID 2896 wrote to memory of 1736 2896 cmd.exe 97 PID 2896 wrote to memory of 1736 2896 cmd.exe 97 PID 2360 wrote to memory of 2712 2360 ._cache_Synaptics.exe 98 PID 2360 wrote to memory of 2712 2360 ._cache_Synaptics.exe 98 PID 2360 wrote to memory of 2712 2360 ._cache_Synaptics.exe 98 PID 2712 wrote to memory of 3864 2712 cmd.exe 101 PID 2712 wrote to memory of 3864 2712 cmd.exe 101 PID 2712 wrote to memory of 3864 2712 cmd.exe 101 PID 952 wrote to memory of 4092 952 svchost.exe 106 PID 952 wrote to memory of 4092 952 svchost.exe 106 PID 952 wrote to memory of 4092 952 svchost.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3624
-
-
C:\Users\Admin\AppData\Local\Temp\HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exeC:\Users\Admin\AppData\Local\Temp\HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\._cache_HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe"C:\Users\Admin\AppData\Local\Temp\._cache_HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\查询.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\fastboot.exefastboot oem get-product-model5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1736
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\查询.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\fastboot.exefastboot oem get-product-model6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3864
-
-
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵PID:2116
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\240626796.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4092
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:60
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
728KB
MD537df14b0d7d2cb963ed26b74d0babb8f
SHA13c5ee015a92577f025fed3968ec9803fa2cbb16e
SHA25630fa902fec4d8c487971c63b9793f8f6d3766851d8e2a95fee9092e7c251205a
SHA51219806ab7530e11fd46e3ec06140fffc31991f13cda50f7acbfcde70156956b74c15ec482d85c630c14486cb163536e781974862df6df038ebdd6fc3a064151fc
-
Filesize
23KB
MD5a4c618cdc3725089633aa687a8e6b1fc
SHA1b4d55cb7f16b9b6e35daa5a00369d1ace703133d
SHA2565062335558801ce02d7b59e0e4edfcf9204d977cf57ee2c4e3a7810b81a6e6ba
SHA5121236d153d7a3f8f6a7526c71d7145fc9441c5a686143b554c25e6f29e8bcc139dafb34d9450538c4168fdd193b665dab906157ffaf7026eb7dae1deea74f47ed
-
Filesize
1.4MB
MD576dbbb13aa89987452679c7ae6a06198
SHA19563b7053af723c53dfdbed23f6760b07b5e000e
SHA2567c3f596a8a122c596a60b1e38311983c31c45eefbafc35781dd269368523b0da
SHA512e04fff85cd9e9ac02d50cda3213d3ce1417cd46d44139389d9de9c15184df6caefd8b92325a22836f579ec39fff5989ab21a6606da749f48e8d6801ebdb306fd
-
Filesize
1.3MB
MD55d244c2f766f8e5b23866d3e4797dec8
SHA1f06947c861db3de513fc5f60341570288c44daa8
SHA2566c531e987c5ceae066bbf70fc3bc196984c9b9149d21315eb150ca01e34bf088
SHA512cfe6d70e729f643c169b11f3cd6050034afdede3af66c0a733f2386d36b4aa76d6c94686ee2cb53df5b2ae4d0a6dccfd3ef820e3e1616003263f5e4552de6f63
-
Filesize
94KB
MD58a65c4ba30a650100527b8423bd14cb8
SHA173416dec1b6d45f56365e061a15b1dcd2af96841
SHA25625261db3376ea5f708e44e57a2ddd357696b09c9636483923204a2baf7f7403b
SHA512d46b776513491b7decf64f80e19f5f1bcd0be994ab8a238c8a532e1a2efb7a087ac244b0ead926a920c00002e208d26561ccd660633073098e442e0adf1114de
-
Filesize
59KB
MD5b4cc916be7b9fc863e4b7b8521aa4cd1
SHA12aa8fc5c549edbd52c1181ca2cb109be11eaced9
SHA25669e1a1d22de2483eb04bc752845d0120b8ba3790d3d23721bdab8645eb9d638b
SHA51250c1fdd08b538aeba7bab465dd9f7477cc6bdabb8a209d26e6dd7f419c3fdc2fa5e549520ec9e5b9c8e49f6f2ce69a14ab2b06f18eb4398a893c43e3ce59f00f
-
Filesize
153KB
MD553e766a1a124f5d7300c211e092986ef
SHA1948962914af90eff9f646c85d5e4437ee4f37c3e
SHA2561ad0d504c0eadab3b4958eda4655ea158ffe03b47886f5a112620a37aaa17260
SHA5123870fce8052a797f0c18b4434038585bb5ed09a1445d6e62fb5b1870e46f7e220c2555f5aeef34bea0403b320a5a823725ee07febe34f176000cfcbc0625fc96
-
Filesize
318B
MD59b867fb27ceb0e6ab8001704cdbbc2de
SHA11c226d6745d3d45edd85633309c5c86c5479a6a4
SHA25620b2b4e0cf5f3115e7fcdbd69f7e39bf32bd69be8b00e26b86907753f37857a2
SHA512d6c7b815538f6b84ae0f25c65a45757e9000969078107bcfbb1436fed5c3d5d064c50463e24d4276cceb528fdf527ed6fad98ca7e1f2ca6331c5e11b3c7e43c4
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
337KB
MD52f3b6f16e33e28ad75f3fdaef2567807
SHA185e907340faf1edfc9210db85a04abd43d21b741
SHA25686492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857
SHA512db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4
-
Filesize
51KB
MD5a3c70104a6044076b01239f8a6e76652
SHA1615d25b7ab096d8cefdcf033bc0f5c9150fc56ef
SHA25607b7cb6ea312d14c42a6b8959548dd306308cfa0b5c7f232b7a5455c9b30bc7e
SHA512e527262019246fd6c6b2025a0597404ad40bf65ee4ca6ce2ed503bc0a8c1c0b9231344ac2d6267ee286e79ab961de0d7ab4eb567690e4e94ecf7353fa64aa96a
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641