Malware Analysis Report

2025-04-13 21:01

Sample ID 250103-pqp31awrfj
Target 2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid
SHA256 0c744a4f4902b8c94b87fa579065e1fb2d5f6f2d27a6ebbdff6f3501e2e78c35
Tags
xred backdoor discovery macro persistence upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0c744a4f4902b8c94b87fa579065e1fb2d5f6f2d27a6ebbdff6f3501e2e78c35

Threat Level: Known bad

The file 2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid was found to be: Known bad.

Malicious Activity Summary

xred backdoor discovery macro persistence upx

Xred family

Xred

Suspicious Office macro

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

UPX packed file

Creates a Windows Service

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-03 12:32

Signatures

Xred family

xred

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-03 12:32

Reported

2025-01-03 12:34

Platform

win7-20240903-en

Max time kernel

141s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe"

Signatures

Xred

backdoor xred

Xred family

xred

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Roaming\Server.exe N/A

Creates a Windows Service

persistence

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Onetap (1).exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe N/A
File opened for modification C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Onetap (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Onetap (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Onetap (1).exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2384 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Server.exe
PID 2384 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Server.exe
PID 2384 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Server.exe
PID 2384 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Server.exe
PID 2384 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Onetap (1).exe
PID 2384 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Onetap (1).exe
PID 2384 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Onetap (1).exe
PID 2384 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Onetap (1).exe
PID 2988 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe
PID 2988 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe
PID 2988 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe
PID 2988 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe
PID 2988 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2988 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2988 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2988 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2824 wrote to memory of 2648 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2824 wrote to memory of 2648 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2824 wrote to memory of 2648 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2824 wrote to memory of 2648 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2600 wrote to memory of 2652 N/A C:\Windows\svchost.exe C:\Windows\svchost.exe
PID 2600 wrote to memory of 2652 N/A C:\Windows\svchost.exe C:\Windows\svchost.exe
PID 2600 wrote to memory of 2652 N/A C:\Windows\svchost.exe C:\Windows\svchost.exe
PID 2600 wrote to memory of 2652 N/A C:\Windows\svchost.exe C:\Windows\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe

"C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe"

C:\Users\Admin\AppData\Roaming\Server.exe

"C:\Users\Admin\AppData\Roaming\Server.exe"

C:\Users\Admin\AppData\Roaming\Onetap (1).exe

"C:\Users\Admin\AppData\Roaming\Onetap (1).exe"

C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.exe

C:\Windows\svchost.exe

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Windows\svchost.exe

C:\Windows\svchost.exe Win7

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.cloudflare.com udp
US 8.8.8.8:53 jimeinb.e2.luyouxia.net udp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
US 8.8.8.8:53 docs.google.com udp
FR 216.58.214.174:443 docs.google.com tcp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
FR 142.250.74.225:443 drive.usercontent.google.com tcp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 88.221.134.83:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 184.25.193.234:80 www.microsoft.com tcp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp

Files

\Users\Admin\AppData\Roaming\Server.exe

MD5 5ef868a2db9378a57d854c6c1f6257ad
SHA1 a7eb959eae127311d466adb45be4983ed1dc03da
SHA256 6b8f8725c13cf835a72b49583cd139c5e801ffc5983efbec1dbdb198d5dd55c9
SHA512 cd4e4c6604a653b0e8646659c578c0f2c59c0669c7a7fedafc283ca18b112057da443e37dff9f8eee14b715917f1fa4a195fffd790900a35121b0ea87643ae2d

\Users\Admin\AppData\Roaming\Onetap (1).exe

MD5 7309886b94ed89dbf84e663891b210aa
SHA1 64639fcc149630306e91523428f3e35b5fa38d1f
SHA256 aead45444baba74dfbf623c46189e9fd6b29c07839cb2e0ed414138bdf84c1cf
SHA512 d65339e0b5590a4b17d185a53596fad09762b1d6b7b633bc1469e3a2131350caab6e9e0739da5e830d7069861aa6308e5db11c13b4be6bd42ce95164bec49e0a

C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe

MD5 a857b537e8649f06ef10a9960fbfb137
SHA1 a4e5e981e485d7eff80a60273e980e1dd55c1211
SHA256 27e5eae57a9eb81305e03e9c29692f605569e50203ea9bb428c86bc57fca11ca
SHA512 cb8d47037cb61432de00132bdda7dd8722db65a2f66384613b8ef9ad5e4f33090131aca2d88b0d72328d4f737f55799dcaa1cc93986cf8621fb781da26ed6dbc

memory/2776-37-0x0000000010000000-0x000000001000B000-memory.dmp

memory/2988-49-0x0000000000400000-0x000000000052C000-memory.dmp

memory/2128-63-0x00000000773A0000-0x00000000773A2000-memory.dmp

memory/2128-61-0x00000000773A0000-0x00000000773A2000-memory.dmp

memory/2128-59-0x00000000773A0000-0x00000000773A2000-memory.dmp

memory/2128-58-0x0000000077390000-0x0000000077392000-memory.dmp

memory/2128-68-0x0000000140000000-0x000000014124B000-memory.dmp

memory/2128-56-0x0000000077390000-0x0000000077392000-memory.dmp

memory/2128-54-0x0000000077390000-0x0000000077392000-memory.dmp

memory/2656-82-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wTXYm37F.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\wTXYm37F.xlsm

MD5 6578f3d7494c9999e643d773cc8594b0
SHA1 c441d6ce1178a3c7ca21584e9013e950a8a5206b
SHA256 7df70a24be870d1b739d28ad33c5a2b35942040c99ebe3f4a35059e86f2fd67d
SHA512 1eabb7dfc889eb801acff1b372e854ac48faadb02bf6e913e07cd049440548662691fceaa0a53ed00ce8b8b6a7c7c365d2666bfe581ae18e7e811660d009b8d5

memory/2776-130-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2824-131-0x0000000000400000-0x000000000052C000-memory.dmp

memory/2824-132-0x0000000000400000-0x000000000052C000-memory.dmp

memory/2824-164-0x0000000000400000-0x000000000052C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-03 12:32

Reported

2025-01-03 12:34

Platform

win10v2004-20241007-en

Max time kernel

142s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe"

Signatures

Xred

backdoor xred

Xred family

xred

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Server.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Roaming\Server.exe N/A

Creates a Windows Service

persistence

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Onetap (1).exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe N/A
File opened for modification C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\svchost.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Roaming\Server.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Onetap (1).exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3976 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Server.exe
PID 3976 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Server.exe
PID 3976 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Server.exe
PID 3976 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Onetap (1).exe
PID 3976 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Onetap (1).exe
PID 3140 wrote to memory of 840 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe
PID 3140 wrote to memory of 840 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe
PID 3140 wrote to memory of 840 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe
PID 3140 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3140 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3140 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1556 wrote to memory of 4948 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1556 wrote to memory of 4948 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1556 wrote to memory of 4948 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 4396 wrote to memory of 4288 N/A C:\Windows\svchost.exe C:\Windows\svchost.exe
PID 4396 wrote to memory of 4288 N/A C:\Windows\svchost.exe C:\Windows\svchost.exe
PID 4396 wrote to memory of 4288 N/A C:\Windows\svchost.exe C:\Windows\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe

"C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe"

C:\Users\Admin\AppData\Roaming\Server.exe

"C:\Users\Admin\AppData\Roaming\Server.exe"

C:\Users\Admin\AppData\Roaming\Onetap (1).exe

"C:\Users\Admin\AppData\Roaming\Onetap (1).exe"

C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe"

C:\Windows\svchost.exe

C:\Windows\svchost.exe

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

C:\Windows\svchost.exe

C:\Windows\svchost.exe Win7

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 jimeinb.e2.luyouxia.net udp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
US 8.8.8.8:53 www.cloudflare.com udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 18.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
US 8.8.8.8:53 docs.google.com udp
FR 216.58.214.174:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 174.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 67.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 drive.usercontent.google.com udp
FR 142.250.74.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 225.74.250.142.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp

Files

C:\Users\Admin\AppData\Roaming\Server.exe

MD5 5ef868a2db9378a57d854c6c1f6257ad
SHA1 a7eb959eae127311d466adb45be4983ed1dc03da
SHA256 6b8f8725c13cf835a72b49583cd139c5e801ffc5983efbec1dbdb198d5dd55c9
SHA512 cd4e4c6604a653b0e8646659c578c0f2c59c0669c7a7fedafc283ca18b112057da443e37dff9f8eee14b715917f1fa4a195fffd790900a35121b0ea87643ae2d

C:\Users\Admin\AppData\Roaming\Onetap (1).exe

MD5 7309886b94ed89dbf84e663891b210aa
SHA1 64639fcc149630306e91523428f3e35b5fa38d1f
SHA256 aead45444baba74dfbf623c46189e9fd6b29c07839cb2e0ed414138bdf84c1cf
SHA512 d65339e0b5590a4b17d185a53596fad09762b1d6b7b633bc1469e3a2131350caab6e9e0739da5e830d7069861aa6308e5db11c13b4be6bd42ce95164bec49e0a

memory/3140-17-0x00000000006E0000-0x00000000006E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe

MD5 a857b537e8649f06ef10a9960fbfb137
SHA1 a4e5e981e485d7eff80a60273e980e1dd55c1211
SHA256 27e5eae57a9eb81305e03e9c29692f605569e50203ea9bb428c86bc57fca11ca
SHA512 cb8d47037cb61432de00132bdda7dd8722db65a2f66384613b8ef9ad5e4f33090131aca2d88b0d72328d4f737f55799dcaa1cc93986cf8621fb781da26ed6dbc

memory/840-140-0x0000000010000000-0x000000001000B000-memory.dmp

memory/3140-154-0x0000000000400000-0x000000000052C000-memory.dmp

memory/1584-223-0x00007FFBC73D0000-0x00007FFBC73E0000-memory.dmp

memory/1584-225-0x00007FFBC73D0000-0x00007FFBC73E0000-memory.dmp

memory/1584-226-0x00007FFBC73D0000-0x00007FFBC73E0000-memory.dmp

memory/1584-228-0x00007FFBC73D0000-0x00007FFBC73E0000-memory.dmp

memory/1584-224-0x00007FFBC73D0000-0x00007FFBC73E0000-memory.dmp

memory/1584-229-0x00007FFBC4A70000-0x00007FFBC4A80000-memory.dmp

memory/840-230-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4844-235-0x00007FFC07560000-0x00007FFC07562000-memory.dmp

memory/4844-231-0x00007FFC07550000-0x00007FFC07552000-memory.dmp

memory/4844-239-0x0000000140000000-0x000000014124B000-memory.dmp

memory/1584-240-0x00007FFBC4A70000-0x00007FFBC4A80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bQBeS1BM.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\9DE75E00

MD5 76532ed7fdbcf57b1097e0dc2390ecf8
SHA1 1f462af97b0e2e31b273ca9fa406f8584591b2d4
SHA256 0519422e42e816415a22a26a789e466812f2d82a6a66c53edfdf91a867b60d8f
SHA512 4f1bd1da93d4a80f2464af1f60bffa263bac475ce4185052ed9d571bd4ed2412823cb93af7ccdded09ae64ede2efa60ca99adb6170406319ad1d8fb36e6a1141

memory/1556-1228-0x0000000000400000-0x000000000052C000-memory.dmp

memory/1556-1259-0x0000000000400000-0x000000000052C000-memory.dmp