Overview

overview

10

Static

static

10

2024-12-30...id.exe

windows7-x64

10

2024-12-30...id.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2024 12:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe

  • Size

    3.5MB

  • MD5

    26d0b51d199c4fa8fe11a3df6070a513

  • SHA1

    6a675c9a102b478cce0acd17af1744c4b31e1d50

  • SHA256

    8b39f3df619fa11eeffc6e19c7b73f5057e42827c307050743bf33fd2fc5c651

  • SHA512

    129da39094733df8294a4a04a705a3a16986e38b03a9325d9dc7fdc2585cac09c82eb05da69032ebdc91437c57e8cc126ccf8fbcf68548c137130880dd6b9732

  • SSDEEP

    98304:TmIlfqCwgm/NulxZJt4HINy2LkCKZxknsmtk2aK:TR5wTNEiINy2LkBvKLV

Score
10/10
gh0stratpurplefoxxredbackdoordiscoverypersistenceratrootkittrojanupx

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Detect PurpleFox Rootkit 9 IoCs

    Detect PurpleFox Rootkit.

    rootkit
  • Gh0st RAT payload 9 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Gh0strat family
    gh0strat
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox
  • Purplefox family
    purplefox
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Users\Admin\AppData\Local\Temp\ser.exe
      C:\Users\Admin\AppData\Local\Temp\\ser.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1864
      • C:\Users\Admin\Documents\kjtkqbxa\serevc.exe
        C:\Users\Admin\Documents\\kjtkqbxa\serevc.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:464
    • C:\Users\Admin\AppData\Local\Temp\_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
      C:\Users\Admin\AppData\Local\Temp\_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Users\Admin\AppData\Local\Temp\RVN.exe
        C:\Users\Admin\AppData\Local\Temp\\RVN.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3380
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:3328
          • C:\Windows\SysWOW64\PING.EXE
            ping -n 2 127.0.0.1
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2808
      • C:\Users\Admin\AppData\Local\Temp\HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
        C:\Users\Admin\AppData\Local\Temp\HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:724
        • C:\Users\Admin\AppData\Local\Temp\._cache_HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1264
        • C:\ProgramData\Synaptics\Synaptics.exe
          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2816
          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4128
  • C:\Windows\SysWOW64\TXPlatforn.exe
    C:\Windows\SysWOW64\TXPlatforn.exe -auto
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3640
    • C:\Windows\SysWOW64\TXPlatforn.exe
      C:\Windows\SysWOW64\TXPlatforn.exe -acsi
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Executes dropped EXE
      • Suspicious behavior: LoadsDriver
      • Suspicious use of AdjustPrivilegeToken
      PID:1280
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\._cache_HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
    Filesize

    89KB

    MD5

    fd5137d1998bf8fcbab832123dd72256

    SHA1

    155e5dd08ecbe6483167f596c927208f4cca8a39

    SHA256

    86ee28923d4e7255762442fe93f220237197a756182ce320f5f6887b5c7147c5

    SHA512

    fd9270902cec43a84048a0e90ded14e56c9bae46ef067081d10784c82ec1a0ef7dc605b11d8819c9c5d75dea342df8a419bdd61f8ef7411c25fee932038ea465

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\D1B75E00
    Filesize

    20KB

    MD5

    919a890a7b62522fc89f76ce4e16c62e

    SHA1

    a54ebe2a3a3af1f15c31cbba05bf56e532612fbc

    SHA256

    4e6d88adc2dcd11e0379575a6b02f987d3890a8da4068f2f388e434148020029

    SHA512

    15af9b5037a43890779f51cd823f63bc4d70e1aba0674b6af34f06ffd49c234c310959a9c9e78ff5d23282c470c075cbe193e43adfc9a1b4a6d54e9778929eff

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\HD_X.dat
    Filesize

    1.5MB

    MD5

    43a309d76c3bb4a91e3d464b2adb1a70

    SHA1

    d12fc070e16edf51a1dbe8621fd3e1b2c4be60d3

    SHA256

    10801369a0b307d0b9abf07dab6a92263b7c66fa6fc66bb6d0c86260d2fba649

    SHA512

    6925d0cc83c2d8ca52fa58d49d98e94b667ec68d6e2de68d6bf3f3a406bc027a2db7f1aa3e5f4b13c84503d488b9d7392fcaf61e548dc27ddb102e45d327b9c4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\HD__cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
    Filesize

    843KB

    MD5

    db06bd4b57933fb4dd26188ab9a013c7

    SHA1

    24fb49c4fbe2993e96595d1085dbae18d8a73db4

    SHA256

    5d3ccb3cf874eed6dabe680217d17a22096711ddfe184ecb825cf66b46837600

    SHA512

    cd20b5a3abc4b649ae490553e8ef4973a25b77cc6fc669f096928737eec359fdb53e00985314f14f94d3598bebf119ac17c760ece3cb45a0a56bc36c3521a784

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RVN.exe
    Filesize

    377KB

    MD5

    80ade1893dec9cab7f2e63538a464fcc

    SHA1

    c06614da33a65eddb506db00a124a3fc3f5be02e

    SHA256

    57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

    SHA512

    fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_cacheaw2024-12-30_26d0b51d199c4fa8fe11a3df6070a513_icedid.exe
    Filesize

    2.3MB

    MD5

    273744044bbc6e49baffda91a9dd6b38

    SHA1

    1088749a1051fc3c909959cdcb8c8d6a1d8af316

    SHA256

    8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50

    SHA512

    e077864cebcc5305f1f5c7c4d6380a84b6cd304a8fda198609da77d1d19d2bb2298ee3a1861cd8854e10c48f9cf9d44612aa6ea6f98bd82a2bb5645e96683daf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\mORe6XiN.xlsm
    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ser.exe
    Filesize

    403KB

    MD5

    cf686da098fea0536081545bc9276c35

    SHA1

    3ac479814a342211e3337c183d62c24441ac172a

    SHA256

    73c9a3ac159d8b5c797961d5502e2595c67d38d401957f749d811f0657777051

    SHA512

    7667040de8df22b37a88c95e37b04c5ca986487098d396414cec8e233304030e75e21d120d7d88810e1bf8079de80f0cefdcd67a1e54ff5b628a70da72cd944d

    Download Submit

  • C:\Users\Admin\Documents\kjtkqbxa\serevc.exe
    Filesize

    828KB

    MD5

    306c2108078b5250a1b8f3f86b820c81

    SHA1

    ab593ec5deec94eb622b5ed791aa4970b6d23903

    SHA256

    70d5b90cdd1686c42cd57bf514374628b1fe3803aa79b2033a4b9a73736027aa

    SHA512

    0fe75494676a291477a51181e65fa23458473e7112dc8dc012dc98e281aea1523a2f2bbeda43531009d249cf55639b08e984c2ceab8a10fb433f04e18bff611c

    Download Submit

  • memory/724-178-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

    Download

  • memory/1280-43-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1280-42-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1280-40-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1280-47-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1280-51-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1280-52-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1864-21-0x0000000000400000-0x00000000005C2000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/1864-5-0x0000000000400000-0x00000000005C2000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2816-353-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

    Download

  • memory/2816-402-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

    Download

  • memory/3380-24-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/3380-25-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/3380-22-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/3640-33-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/3640-32-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/3640-30-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/4320-300-0x00007FF835550000-0x00007FF835560000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4320-301-0x00007FF835550000-0x00007FF835560000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4320-302-0x00007FF835550000-0x00007FF835560000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4320-303-0x00007FF835550000-0x00007FF835560000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4320-304-0x00007FF835550000-0x00007FF835560000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4320-305-0x00007FF833460000-0x00007FF833470000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4320-306-0x00007FF833460000-0x00007FF833470000-memory.dmp

    Filesize

    64KB

    Download