gh0strat | 8b39f3df619fa11eeffc6e19c7b73f5057e42827c307050743bf33fd2fc5c651

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
30/12/2024, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
Size

3.5MB
MD5

26d0b51d199c4fa8fe11a3df6070a513
SHA1

6a675c9a102b478cce0acd17af1744c4b31e1d50
SHA256

8b39f3df619fa11eeffc6e19c7b73f5057e42827c307050743bf33fd2fc5c651
SHA512

129da39094733df8294a4a04a705a3a16986e38b03a9325d9dc7fdc2585cac09c82eb05da69032ebdc91437c57e8cc126ccf8fbcf68548c137130880dd6b9732
SSDEEP

98304:TmIlfqCwgm/NulxZJt4HINy2LkCKZxknsmtk2aK:TR5wTNEiINy2LkBvKLV

Score

10^/10

gh0strat purplefox xred backdoor discovery macro persistence rat rootkit trojan upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Detect PurpleFox Rootkit 5 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral1/memory/2800-34-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2800-35-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2944-63-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2944-66-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2944-103-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/2800-34-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2800-35-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2944-63-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2944-66-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2944-103-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Purplefox family
purplefox
Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x0007000000016d9f-206.dat

Executes dropped EXE 10 IoCs

pid	Process
2168	ser.exe
1492	serevc.exe
2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
2800	RVN.exe
2988	TXPlatforn.exe
2944	TXPlatforn.exe
2528	HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
1424	._cache_HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
496	Synaptics.exe
3012	._cache_Synaptics.exe

Loads dropped DLL 16 IoCs

pid	Process
3032	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
3032	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
2168	ser.exe
2168	ser.exe
3032	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
2988	TXPlatforn.exe
2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
2528	HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
2528	HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
2528	HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
2528	HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
496	Synaptics.exe
496	Synaptics.exe
496	Synaptics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\serevc = "C:\\Users\\Admin\\Documents\\kjtkuthi\\serevc.exe"	serevc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\J:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\L:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\O:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\R:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\T:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\Z:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\G:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\S:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\Y:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\A:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\B:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\E:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\H:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\K:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\N:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\P:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\Q:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\U:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\W:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\X:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\M:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened (read-only)	\??\V:	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000012280-4.dat	upx
behavioral1/memory/2168-11-0x0000000000400000-0x00000000005C2000-memory.dmp	upx
behavioral1/memory/2800-34-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2168-40-0x0000000000400000-0x00000000005C2000-memory.dmp	upx
behavioral1/memory/2800-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2800-32-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2944-63-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2944-66-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2944-103-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	serevc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RVN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatforn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
932	PING.EXE
2960	cmd.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
932	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2508	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2944	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2800	RVN.exe
Token: SeLoadDriverPrivilege	2944	TXPlatforn.exe
Token: 33	2944	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2944	TXPlatforn.exe
Token: 33	2944	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2944	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3032	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
3032	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
2168	ser.exe
2168	ser.exe
1492	serevc.exe
1492	serevc.exe
2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
2508	EXCEL.EXE

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2168	3032	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	30
PID 3032 wrote to memory of 2168	3032	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	30
PID 3032 wrote to memory of 2168	3032	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	30
PID 3032 wrote to memory of 2168	3032	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	30
PID 2168 wrote to memory of 1492	2168	ser.exe	31
PID 2168 wrote to memory of 1492	2168	ser.exe	31
PID 2168 wrote to memory of 1492	2168	ser.exe	31
PID 2168 wrote to memory of 1492	2168	ser.exe	31
PID 3032 wrote to memory of 2252	3032	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	32
PID 3032 wrote to memory of 2252	3032	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	32
PID 3032 wrote to memory of 2252	3032	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	32
PID 3032 wrote to memory of 2252	3032	2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	32
PID 2252 wrote to memory of 2800	2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	33
PID 2252 wrote to memory of 2800	2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	33
PID 2252 wrote to memory of 2800	2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	33
PID 2252 wrote to memory of 2800	2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	33
PID 2252 wrote to memory of 2800	2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	33
PID 2252 wrote to memory of 2800	2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	33
PID 2252 wrote to memory of 2800	2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	33
PID 2800 wrote to memory of 2960	2800	RVN.exe	35
PID 2800 wrote to memory of 2960	2800	RVN.exe	35
PID 2800 wrote to memory of 2960	2800	RVN.exe	35
PID 2800 wrote to memory of 2960	2800	RVN.exe	35
PID 2988 wrote to memory of 2944	2988	TXPlatforn.exe	36
PID 2988 wrote to memory of 2944	2988	TXPlatforn.exe	36
PID 2988 wrote to memory of 2944	2988	TXPlatforn.exe	36
PID 2988 wrote to memory of 2944	2988	TXPlatforn.exe	36
PID 2988 wrote to memory of 2944	2988	TXPlatforn.exe	36
PID 2988 wrote to memory of 2944	2988	TXPlatforn.exe	36
PID 2988 wrote to memory of 2944	2988	TXPlatforn.exe	36
PID 2252 wrote to memory of 2528	2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	38
PID 2252 wrote to memory of 2528	2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	38
PID 2252 wrote to memory of 2528	2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	38
PID 2252 wrote to memory of 2528	2252	_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	38
PID 2960 wrote to memory of 932	2960	cmd.exe	39
PID 2960 wrote to memory of 932	2960	cmd.exe	39
PID 2960 wrote to memory of 932	2960	cmd.exe	39
PID 2960 wrote to memory of 932	2960	cmd.exe	39
PID 2528 wrote to memory of 1424	2528	HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	40
PID 2528 wrote to memory of 1424	2528	HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	40
PID 2528 wrote to memory of 1424	2528	HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	40
PID 2528 wrote to memory of 1424	2528	HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	40
PID 2528 wrote to memory of 496	2528	HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	41
PID 2528 wrote to memory of 496	2528	HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	41
PID 2528 wrote to memory of 496	2528	HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	41
PID 2528 wrote to memory of 496	2528	HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe	41
PID 496 wrote to memory of 3012	496	Synaptics.exe	42
PID 496 wrote to memory of 3012	496	Synaptics.exe	42
PID 496 wrote to memory of 3012	496	Synaptics.exe	42
PID 496 wrote to memory of 3012	496	Synaptics.exe	42

C:\Users\Admin\AppData\Local\Temp\2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\ser.exe
  C:\Users\Admin\AppData\Local\Temp\\ser.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\Documents\kjtkuthi\serevc.exe
    C:\Users\Admin\Documents\\kjtkuthi\serevc.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1492
- C:\Users\Admin\AppData\Local\Temp\_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
  C:\Users\Admin\AppData\Local\Temp\_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Users\Admin\AppData\Local\Temp\RVN.exe
    C:\Users\Admin\AppData\Local\Temp\\RVN.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 127.0.0.1
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:932
- - C:\Users\Admin\AppData\Local\Temp\HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
    C:\Users\Admin\AppData\Local\Temp\HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\._cache_HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1424
  - - C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:496
    - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3012

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:2944

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.5MB

MD5
43a309d76c3bb4a91e3d464b2adb1a70

SHA1
d12fc070e16edf51a1dbe8621fd3e1b2c4be60d3

SHA256
10801369a0b307d0b9abf07dab6a92263b7c66fa6fc66bb6d0c86260d2fba649

SHA512
6925d0cc83c2d8ca52fa58d49d98e94b667ec68d6e2de68d6bf3f3a406bc027a2db7f1aa3e5f4b13c84503d488b9d7392fcaf61e548dc27ddb102e45d327b9c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\xt19beQN.xlsm

Filesize
23KB

MD5
b051418c11b2dfe3a4faf3200d906115

SHA1
d67abdb3a6d2842f450e6bc64ccf664fe8010915

SHA256
853eff8b8e2d164764f158f5a5f738e3e6d2de3c2b2a898e832340e64dc0447e

SHA512
ee2757bd6af4d5f13c0a137065a63a1266ef9bf1f9c2b4a92373473abaff8f729fecda8dbc1828e07c4279c789bb4853c913c5d8c86e3cfbf2b55323678c6dd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\xt19beQN.xlsm

Filesize
30KB

MD5
b604f5546ee9a07c7ee62e80b1c075e5

SHA1
5937b78baa9d76ea8e39525bb92692bfd7defc6e

SHA256
284cc4e41c14e05b4e8087eef44cc4bf844b6d8f18b42ec30c1d2893b16b9f36

SHA512
ffaf48e1a7378d94b5cd219be4feed46df805a3be4ce8de14a3c2e4341ed27ccd5344ccb5d382766feec656cfdba8fd08943a4c908862e64e72f64ef50f7209d

Download Submit
C:\Users\Admin\AppData\Local\Temp\xt19beQN.xlsm

Filesize
29KB

MD5
10f30e0b9206c4b3265780bd8f5196df

SHA1
f1f69596b5bf8d3e4bb130a11319c686197a6bad

SHA256
397aa3ee55e6f5c3df98fbf0df5d53f41dd4b70aeda6ee00bcd62676ff2b6bbf

SHA512
99ff1615e086c93f0bec21bcff63830b0e1fe83bec81878cdf891c851043c8ba5f1a827dce746dc140d7779d147bbdf7ec4af3fbce98cb2da83479d186bf3b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\xt19beQN.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\xt19beQN.xlsm

Filesize
27KB

MD5
3da15a842319771cf97a6af75dd62a2c

SHA1
ac2bd264f3911443a900c792fd29a9cbfc4f9a0c

SHA256
b9c414ce3d05af8ad0ddde9efb697a238aadbf809799b981482b68a336aba18b

SHA512
2148731aaedd40f119890b523890cb58951cfe76bc6d82e763a2e3ca0f978983350a7a73088580cae964b3f3db669af8a3ff10afec315977f11d54ba0326d8fc

Download Submit
C:\Users\Admin\Downloads\~$RegisterLock.xlsx

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe

Filesize
89KB

MD5
fd5137d1998bf8fcbab832123dd72256

SHA1
155e5dd08ecbe6483167f596c927208f4cca8a39

SHA256
86ee28923d4e7255762442fe93f220237197a756182ce320f5f6887b5c7147c5

SHA512
fd9270902cec43a84048a0e90ded14e56c9bae46ef067081d10784c82ec1a0ef7dc605b11d8819c9c5d75dea342df8a419bdd61f8ef7411c25fee932038ea465

Download Submit
\Users\Admin\AppData\Local\Temp\HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe

Filesize
843KB

MD5
db06bd4b57933fb4dd26188ab9a013c7

SHA1
24fb49c4fbe2993e96595d1085dbae18d8a73db4

SHA256
5d3ccb3cf874eed6dabe680217d17a22096711ddfe184ecb825cf66b46837600

SHA512
cd20b5a3abc4b649ae490553e8ef4973a25b77cc6fc669f096928737eec359fdb53e00985314f14f94d3598bebf119ac17c760ece3cb45a0a56bc36c3521a784

Download Submit
\Users\Admin\AppData\Local\Temp\RVN.exe

Filesize
377KB

MD5
80ade1893dec9cab7f2e63538a464fcc

SHA1
c06614da33a65eddb506db00a124a3fc3f5be02e

SHA256
57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

SHA512
fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

Download Submit
\Users\Admin\AppData\Local\Temp\_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe

Filesize
2.3MB

MD5
273744044bbc6e49baffda91a9dd6b38

SHA1
1088749a1051fc3c909959cdcb8c8d6a1d8af316

SHA256
8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50

SHA512
e077864cebcc5305f1f5c7c4d6380a84b6cd304a8fda198609da77d1d19d2bb2298ee3a1861cd8854e10c48f9cf9d44612aa6ea6f98bd82a2bb5645e96683daf

Download Submit
\Users\Admin\AppData\Local\Temp\ser.exe

Filesize
403KB

MD5
cf686da098fea0536081545bc9276c35

SHA1
3ac479814a342211e3337c183d62c24441ac172a

SHA256
73c9a3ac159d8b5c797961d5502e2595c67d38d401957f749d811f0657777051

SHA512
7667040de8df22b37a88c95e37b04c5ca986487098d396414cec8e233304030e75e21d120d7d88810e1bf8079de80f0cefdcd67a1e54ff5b628a70da72cd944d

Download Submit
\Users\Admin\Documents\kjtkuthi\serevc.exe

Filesize
828KB

MD5
306c2108078b5250a1b8f3f86b820c81

SHA1
ab593ec5deec94eb622b5ed791aa4970b6d23903

SHA256
70d5b90cdd1686c42cd57bf514374628b1fe3803aa79b2033a4b9a73736027aa

SHA512
0fe75494676a291477a51181e65fa23458473e7112dc8dc012dc98e281aea1523a2f2bbeda43531009d249cf55639b08e984c2ceab8a10fb433f04e18bff611c

Download Submit
memory/496-226-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/496-232-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/496-274-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2168-40-0x0000000000400000-0x00000000005C2000-memory.dmp

Filesize
1.8MB

Download
memory/2168-11-0x0000000000400000-0x00000000005C2000-memory.dmp

Filesize
1.8MB

Download
memory/2508-145-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2528-129-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2800-32-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2800-35-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2800-34-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2944-63-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2944-103-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2944-66-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3032-9-0x0000000002500000-0x00000000026C2000-memory.dmp

Filesize
1.8MB

Download
memory/3032-225-0x0000000002500000-0x00000000026C2000-memory.dmp

Filesize
1.8MB

Download
memory/3032-10-0x0000000002500000-0x00000000026C2000-memory.dmp

Filesize
1.8MB

Download