Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-11-2024 14:43

General

  • Target

    2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe

  • Size

    2.8MB

  • MD5

    703ef2034e4a8d51679fae3ca9d2a910

  • SHA1

    f88d802057f4218729b23fcb011ba0547617a3d0

  • SHA256

    d01685aa51c1ddc668fda95f0dc4e6add1774dd8c297d4040a73d3610cfa27ba

  • SHA512

    099bd3b810ec26f8925c7eddfb490e2a370425c5903affdb197ab2cd82940514ec4464bf0a8c473988ce9b3811af99df8b3b0159345782585efe2023e6e96a92

  • SSDEEP

    49152:vYREXSVMDi3LBSJXAJXx/nsHyjtk2MYC5GD+J1ipFKspIO/ROixDwwT:w2SVMD8LBSKJB/nsmtk2aLQ7wO/RO+cs

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Gh0strat family
  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Users\Admin\AppData\Local\Temp\look2.exe
      C:\Users\Admin\AppData\Local\Temp\\look2.exe
      2⤵
      • Server Software Component: Terminal Services DLL
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:3624
    • C:\Users\Admin\AppData\Local\Temp\HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe
      C:\Users\Admin\AppData\Local\Temp\HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1376
      • C:\Users\Admin\AppData\Local\Temp\._cache_HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4256
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\查询.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2896
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\fastboot.exe
            fastboot oem get-product-model
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1736
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3128
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2360
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\查询.bat" "
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2712
            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\fastboot.exe
              fastboot oem get-product-model
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:3864
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "svchcst"
    1⤵
      PID:2116
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "svchcst"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:952
      • C:\Windows\SysWOW64\svchcst.exe
        C:\Windows\system32\svchcst.exe "c:\windows\system32\240626796.bat",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4092
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:60

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\._cache_HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe

      Filesize

      728KB

      MD5

      37df14b0d7d2cb963ed26b74d0babb8f

      SHA1

      3c5ee015a92577f025fed3968ec9803fa2cbb16e

      SHA256

      30fa902fec4d8c487971c63b9793f8f6d3766851d8e2a95fee9092e7c251205a

      SHA512

      19806ab7530e11fd46e3ec06140fffc31991f13cda50f7acbfcde70156956b74c15ec482d85c630c14486cb163536e781974862df6df038ebdd6fc3a064151fc

    • C:\Users\Admin\AppData\Local\Temp\DDB75E00

      Filesize

      23KB

      MD5

      a4c618cdc3725089633aa687a8e6b1fc

      SHA1

      b4d55cb7f16b9b6e35daa5a00369d1ace703133d

      SHA256

      5062335558801ce02d7b59e0e4edfcf9204d977cf57ee2c4e3a7810b81a6e6ba

      SHA512

      1236d153d7a3f8f6a7526c71d7145fc9441c5a686143b554c25e6f29e8bcc139dafb34d9450538c4168fdd193b665dab906157ffaf7026eb7dae1deea74f47ed

    • C:\Users\Admin\AppData\Local\Temp\HD_2024-11-06_703ef2034e4a8d51679fae3ca9d2a910_icedid.exe

      Filesize

      1.4MB

      MD5

      76dbbb13aa89987452679c7ae6a06198

      SHA1

      9563b7053af723c53dfdbed23f6760b07b5e000e

      SHA256

      7c3f596a8a122c596a60b1e38311983c31c45eefbafc35781dd269368523b0da

      SHA512

      e04fff85cd9e9ac02d50cda3213d3ce1417cd46d44139389d9de9c15184df6caefd8b92325a22836f579ec39fff5989ab21a6606da749f48e8d6801ebdb306fd

    • C:\Users\Admin\AppData\Local\Temp\HD_X.dat

      Filesize

      1.3MB

      MD5

      5d244c2f766f8e5b23866d3e4797dec8

      SHA1

      f06947c861db3de513fc5f60341570288c44daa8

      SHA256

      6c531e987c5ceae066bbf70fc3bc196984c9b9149d21315eb150ca01e34bf088

      SHA512

      cfe6d70e729f643c169b11f3cd6050034afdede3af66c0a733f2386d36b4aa76d6c94686ee2cb53df5b2ae4d0a6dccfd3ef820e3e1616003263f5e4552de6f63

    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\AdbWinApi.dll

      Filesize

      94KB

      MD5

      8a65c4ba30a650100527b8423bd14cb8

      SHA1

      73416dec1b6d45f56365e061a15b1dcd2af96841

      SHA256

      25261db3376ea5f708e44e57a2ddd357696b09c9636483923204a2baf7f7403b

      SHA512

      d46b776513491b7decf64f80e19f5f1bcd0be994ab8a238c8a532e1a2efb7a087ac244b0ead926a920c00002e208d26561ccd660633073098e442e0adf1114de

    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\AdbWinUsbApi.dll

      Filesize

      59KB

      MD5

      b4cc916be7b9fc863e4b7b8521aa4cd1

      SHA1

      2aa8fc5c549edbd52c1181ca2cb109be11eaced9

      SHA256

      69e1a1d22de2483eb04bc752845d0120b8ba3790d3d23721bdab8645eb9d638b

      SHA512

      50c1fdd08b538aeba7bab465dd9f7477cc6bdabb8a209d26e6dd7f419c3fdc2fa5e549520ec9e5b9c8e49f6f2ce69a14ab2b06f18eb4398a893c43e3ce59f00f

    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\fastboot.exe

      Filesize

      153KB

      MD5

      53e766a1a124f5d7300c211e092986ef

      SHA1

      948962914af90eff9f646c85d5e4437ee4f37c3e

      SHA256

      1ad0d504c0eadab3b4958eda4655ea158ffe03b47886f5a112620a37aaa17260

      SHA512

      3870fce8052a797f0c18b4434038585bb5ed09a1445d6e62fb5b1870e46f7e220c2555f5aeef34bea0403b320a5a823725ee07febe34f176000cfcbc0625fc96

    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\查询.bat

      Filesize

      318B

      MD5

      9b867fb27ceb0e6ab8001704cdbbc2de

      SHA1

      1c226d6745d3d45edd85633309c5c86c5479a6a4

      SHA256

      20b2b4e0cf5f3115e7fcdbd69f7e39bf32bd69be8b00e26b86907753f37857a2

      SHA512

      d6c7b815538f6b84ae0f25c65a45757e9000969078107bcfbb1436fed5c3d5d064c50463e24d4276cceb528fdf527ed6fad98ca7e1f2ca6331c5e11b3c7e43c4

    • C:\Users\Admin\AppData\Local\Temp\iT7o5q8B.xlsm

      Filesize

      17KB

      MD5

      e566fc53051035e1e6fd0ed1823de0f9

      SHA1

      00bc96c48b98676ecd67e81a6f1d7754e4156044

      SHA256

      8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

      SHA512

      a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

    • C:\Users\Admin\AppData\Local\Temp\look2.exe

      Filesize

      337KB

      MD5

      2f3b6f16e33e28ad75f3fdaef2567807

      SHA1

      85e907340faf1edfc9210db85a04abd43d21b741

      SHA256

      86492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857

      SHA512

      db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4

    • C:\Windows\SysWOW64\240626796.bat

      Filesize

      51KB

      MD5

      a3c70104a6044076b01239f8a6e76652

      SHA1

      615d25b7ab096d8cefdcf033bc0f5c9150fc56ef

      SHA256

      07b7cb6ea312d14c42a6b8959548dd306308cfa0b5c7f232b7a5455c9b30bc7e

      SHA512

      e527262019246fd6c6b2025a0597404ad40bf65ee4ca6ce2ed503bc0a8c1c0b9231344ac2d6267ee286e79ab961de0d7ab4eb567690e4e94ecf7353fa64aa96a

    • C:\Windows\SysWOW64\svchcst.exe

      Filesize

      60KB

      MD5

      889b99c52a60dd49227c5e485a016679

      SHA1

      8fa889e456aa646a4d0a4349977430ce5fa5e2d7

      SHA256

      6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

      SHA512

      08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

    • memory/60-180-0x00007FFCE9070000-0x00007FFCE9080000-memory.dmp

      Filesize

      64KB

    • memory/60-181-0x00007FFCE9070000-0x00007FFCE9080000-memory.dmp

      Filesize

      64KB

    • memory/60-182-0x00007FFCE9070000-0x00007FFCE9080000-memory.dmp

      Filesize

      64KB

    • memory/60-179-0x00007FFCE9070000-0x00007FFCE9080000-memory.dmp

      Filesize

      64KB

    • memory/60-201-0x00007FFCE6E20000-0x00007FFCE6E30000-memory.dmp

      Filesize

      64KB

    • memory/60-203-0x00007FFCE6E20000-0x00007FFCE6E30000-memory.dmp

      Filesize

      64KB

    • memory/60-178-0x00007FFCE9070000-0x00007FFCE9080000-memory.dmp

      Filesize

      64KB

    • memory/1376-130-0x0000000000400000-0x0000000000578000-memory.dmp

      Filesize

      1.5MB

    • memory/1376-18-0x0000000002310000-0x0000000002311000-memory.dmp

      Filesize

      4KB

    • memory/1736-266-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/3128-262-0x0000000000400000-0x0000000000578000-memory.dmp

      Filesize

      1.5MB

    • memory/3128-305-0x0000000000400000-0x0000000000578000-memory.dmp

      Filesize

      1.5MB

    • memory/3864-267-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB