Malware Analysis Report

2025-04-13 21:02

Sample ID 250103-pt5b4atqbv
Target 2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid
SHA256 0c744a4f4902b8c94b87fa579065e1fb2d5f6f2d27a6ebbdff6f3501e2e78c35
Tags
xred backdoor discovery persistence upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0c744a4f4902b8c94b87fa579065e1fb2d5f6f2d27a6ebbdff6f3501e2e78c35

Threat Level: Known bad

The file 2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid was found to be: Known bad.

Malicious Activity Summary

xred backdoor discovery persistence upx

Xred

Xred family

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

UPX packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

Creates a Windows Service

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-03 12:38

Signatures

Xred family

xred

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-03 12:38

Reported

2025-01-03 12:40

Platform

win7-20241010-en

Max time kernel

148s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe"

Signatures

Xred

backdoor xred

Xred family

xred

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Roaming\Server.exe N/A

Creates a Windows Service

persistence

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Onetap (1).exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe N/A
File created C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Onetap (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Onetap (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Onetap (1).exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2612 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Server.exe
PID 2612 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Server.exe
PID 2612 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Server.exe
PID 2612 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Server.exe
PID 2612 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Onetap (1).exe
PID 2612 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Onetap (1).exe
PID 2612 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Onetap (1).exe
PID 2612 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Onetap (1).exe
PID 2168 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe
PID 2168 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe
PID 2168 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe
PID 2168 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe
PID 2168 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2168 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2168 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2168 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2836 wrote to memory of 2652 N/A C:\Windows\svchost.exe C:\Windows\svchost.exe
PID 2836 wrote to memory of 2652 N/A C:\Windows\svchost.exe C:\Windows\svchost.exe
PID 2836 wrote to memory of 2652 N/A C:\Windows\svchost.exe C:\Windows\svchost.exe
PID 2836 wrote to memory of 2652 N/A C:\Windows\svchost.exe C:\Windows\svchost.exe
PID 2924 wrote to memory of 1496 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2924 wrote to memory of 1496 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2924 wrote to memory of 1496 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2924 wrote to memory of 1496 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe

"C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe"

C:\Users\Admin\AppData\Roaming\Server.exe

"C:\Users\Admin\AppData\Roaming\Server.exe"

C:\Users\Admin\AppData\Roaming\Onetap (1).exe

"C:\Users\Admin\AppData\Roaming\Onetap (1).exe"

C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe"

C:\Windows\svchost.exe

C:\Windows\svchost.exe

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.exe

C:\Windows\svchost.exe Win7

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.cloudflare.com udp
US 8.8.8.8:53 jimeinb.e2.luyouxia.net udp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
US 8.8.8.8:53 docs.google.com udp
FR 216.58.214.174:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
FR 142.250.74.225:443 drive.usercontent.google.com tcp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 184.25.193.234:80 www.microsoft.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 88.221.134.146:80 crl.microsoft.com tcp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp

Files

\Users\Admin\AppData\Roaming\Server.exe

MD5 5ef868a2db9378a57d854c6c1f6257ad
SHA1 a7eb959eae127311d466adb45be4983ed1dc03da
SHA256 6b8f8725c13cf835a72b49583cd139c5e801ffc5983efbec1dbdb198d5dd55c9
SHA512 cd4e4c6604a653b0e8646659c578c0f2c59c0669c7a7fedafc283ca18b112057da443e37dff9f8eee14b715917f1fa4a195fffd790900a35121b0ea87643ae2d

C:\Users\Admin\AppData\Roaming\Onetap (1).exe

MD5 7309886b94ed89dbf84e663891b210aa
SHA1 64639fcc149630306e91523428f3e35b5fa38d1f
SHA256 aead45444baba74dfbf623c46189e9fd6b29c07839cb2e0ed414138bdf84c1cf
SHA512 d65339e0b5590a4b17d185a53596fad09762b1d6b7b633bc1469e3a2131350caab6e9e0739da5e830d7069861aa6308e5db11c13b4be6bd42ce95164bec49e0a

memory/2948-24-0x0000000077420000-0x0000000077422000-memory.dmp

memory/2948-22-0x0000000077420000-0x0000000077422000-memory.dmp

memory/2948-29-0x0000000077430000-0x0000000077432000-memory.dmp

memory/2948-27-0x0000000077430000-0x0000000077432000-memory.dmp

memory/2948-25-0x0000000077430000-0x0000000077432000-memory.dmp

memory/2948-20-0x0000000077420000-0x0000000077422000-memory.dmp

memory/2948-30-0x0000000140000000-0x000000014124B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe

MD5 a857b537e8649f06ef10a9960fbfb137
SHA1 a4e5e981e485d7eff80a60273e980e1dd55c1211
SHA256 27e5eae57a9eb81305e03e9c29692f605569e50203ea9bb428c86bc57fca11ca
SHA512 cb8d47037cb61432de00132bdda7dd8722db65a2f66384613b8ef9ad5e4f33090131aca2d88b0d72328d4f737f55799dcaa1cc93986cf8621fb781da26ed6dbc

memory/2800-52-0x0000000010000000-0x000000001000B000-memory.dmp

memory/2168-65-0x0000000000400000-0x000000000052C000-memory.dmp

memory/2800-84-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1980-88-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wk14jNdt.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\wk14jNdt.xlsm

MD5 ee100ba1df7d20ad12ef9f3fbaadbbf1
SHA1 d2874474a6811ab7be780eb88e353e10ba581021
SHA256 64b0067a6e1f04bd0d1d998e752cf09bc8e1228abd578f252005fc7ee4aae2ca
SHA512 1dc7d680993a13900a0c8fc303016e74f9c644cf9c42d135aefe5fcdff272605dfcc14ba73db39d7ac141e8bb56364d68fdb2eacfd3589e553382302fa4e7e5c

C:\Users\Admin\AppData\Local\Temp\wk14jNdt.xlsm

MD5 e53f21e6a08fdb5d1973ccd8bd293d9d
SHA1 0816dc8e14ca7297b9573c326ed6a95dd748248f
SHA256 71329910e1fe8d6f250f0f4766bfdff6b8de3f5d754007553ef33267679d2b9d
SHA512 b031ad05f8c952e0518b0e8aeef004528cb4c5e5d84d38d503f215b7d3738b3da9219cef6ca860773c0c9134ec038c45ef58573cd4b6c2a6e50d16c09634fc5c

C:\Users\Admin\AppData\Local\Temp\wk14jNdt.xlsm

MD5 9316bae989bb1a96838beff0fcf2d26c
SHA1 d0e5bb701493c6e38e7a51e2dbcefe4e102adae5
SHA256 a6d929dbc00c885c12ba57e7e42bbf65da7a39ed8f6d10ecc3214277203f89bd
SHA512 fda64cc1beffdca86459391c02773d52551e975eb4130e49dc95e63f88a4a8dba577b3194a6f3357700c668ec55fab14b8ae52533ce42cfa95a1ceb978cf58fa

C:\Users\Admin\AppData\Local\Temp\wk14jNdt.xlsm

MD5 5a2f816ac8abe86fcf413710d2ee373e
SHA1 224fdd181e71f146c13410ba3c1bb5d6aa26b1ed
SHA256 54f6ee8ff6111eda5ef55f18b81bc4ae6b9dc1a3b130618f93b0fed40cd385e8
SHA512 16318f8696ef69338ca5e43e48d16fe4efdb05af5a4dbf957a15dd9832ecf9c0ca866e68bfe075d955dee1df37df9b6a49d1e22c6fca51098f9e73163b775583

C:\Users\Admin\Desktop\~$WatchGrant.xlsx

MD5 ff09371174f7c701e75f357a187c06e8
SHA1 57f9a638fd652922d7eb23236c80055a91724503
SHA256 e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512 e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

C:\Users\Admin\AppData\Local\Temp\wk14jNdt.xlsm

MD5 4966af34fe4d8942251343438cb43e88
SHA1 b7c29f72177410c9a7af99bf383e0d53988c1b4c
SHA256 34e123046cb74792746c8375d042d3496fe1c1bb471550872b970df9f82525b8
SHA512 2126578577e5c347aabdebbd4a67148ac2d4b7fc35f8ab30bab3c7871bd1208eb04ea1c39da48de416b644833ca1337191141eaec06c9fc1a4f12506a847026b

memory/2924-179-0x0000000000400000-0x000000000052C000-memory.dmp

memory/2924-180-0x0000000000400000-0x000000000052C000-memory.dmp

memory/2924-214-0x0000000000400000-0x000000000052C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-03 12:38

Reported

2025-01-03 12:40

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe"

Signatures

Xred

backdoor xred

Xred family

xred

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Server.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Roaming\Server.exe N/A

Creates a Windows Service

persistence

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Onetap (1).exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe N/A
File opened for modification C:\Windows\svchost.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\svchost.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Roaming\Server.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Onetap (1).exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 208 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Server.exe
PID 208 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Server.exe
PID 208 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Server.exe
PID 208 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Onetap (1).exe
PID 208 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe C:\Users\Admin\AppData\Roaming\Onetap (1).exe
PID 3944 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe
PID 3944 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe
PID 3944 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe
PID 3944 wrote to memory of 392 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3944 wrote to memory of 392 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3944 wrote to memory of 392 N/A C:\Users\Admin\AppData\Roaming\Server.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 392 wrote to memory of 4732 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 392 wrote to memory of 4732 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 392 wrote to memory of 4732 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1128 wrote to memory of 4220 N/A C:\Windows\svchost.exe C:\Windows\svchost.exe
PID 1128 wrote to memory of 4220 N/A C:\Windows\svchost.exe C:\Windows\svchost.exe
PID 1128 wrote to memory of 4220 N/A C:\Windows\svchost.exe C:\Windows\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe

"C:\Users\Admin\AppData\Local\Temp\2025-01-03_85d2c8e0e00f4750107bac6f6b0b3445_icedid.exe"

C:\Users\Admin\AppData\Roaming\Server.exe

"C:\Users\Admin\AppData\Roaming\Server.exe"

C:\Users\Admin\AppData\Roaming\Onetap (1).exe

"C:\Users\Admin\AppData\Roaming\Onetap (1).exe"

C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.exe

C:\Windows\svchost.exe

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Windows\svchost.exe

C:\Windows\svchost.exe Win7

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 www.cloudflare.com udp
US 8.8.8.8:53 jimeinb.e2.luyouxia.net udp
US 8.8.8.8:53 xred.mooo.com udp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 167.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 docs.google.com udp
FR 216.58.214.174:443 docs.google.com tcp
US 8.8.8.8:53 174.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
FR 142.250.74.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 67.179.250.142.in-addr.arpa udp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
US 8.8.8.8:53 225.74.250.142.in-addr.arpa udp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
CN 123.99.198.201:26113 jimeinb.e2.luyouxia.net tcp

Files

C:\Users\Admin\AppData\Roaming\Server.exe

MD5 5ef868a2db9378a57d854c6c1f6257ad
SHA1 a7eb959eae127311d466adb45be4983ed1dc03da
SHA256 6b8f8725c13cf835a72b49583cd139c5e801ffc5983efbec1dbdb198d5dd55c9
SHA512 cd4e4c6604a653b0e8646659c578c0f2c59c0669c7a7fedafc283ca18b112057da443e37dff9f8eee14b715917f1fa4a195fffd790900a35121b0ea87643ae2d

memory/3944-15-0x0000000000720000-0x0000000000721000-memory.dmp

C:\Users\Admin\AppData\Roaming\Onetap (1).exe

MD5 7309886b94ed89dbf84e663891b210aa
SHA1 64639fcc149630306e91523428f3e35b5fa38d1f
SHA256 aead45444baba74dfbf623c46189e9fd6b29c07839cb2e0ed414138bdf84c1cf
SHA512 d65339e0b5590a4b17d185a53596fad09762b1d6b7b633bc1469e3a2131350caab6e9e0739da5e830d7069861aa6308e5db11c13b4be6bd42ce95164bec49e0a

C:\Users\Admin\AppData\Local\Temp\._cache_Server.exe

MD5 a857b537e8649f06ef10a9960fbfb137
SHA1 a4e5e981e485d7eff80a60273e980e1dd55c1211
SHA256 27e5eae57a9eb81305e03e9c29692f605569e50203ea9bb428c86bc57fca11ca
SHA512 cb8d47037cb61432de00132bdda7dd8722db65a2f66384613b8ef9ad5e4f33090131aca2d88b0d72328d4f737f55799dcaa1cc93986cf8621fb781da26ed6dbc

memory/3944-150-0x0000000000400000-0x000000000052C000-memory.dmp

memory/4756-151-0x0000000010000000-0x000000001000B000-memory.dmp

memory/2036-155-0x00000001402EA000-0x0000000140927000-memory.dmp

memory/2036-161-0x00007FFF69C60000-0x00007FFF69C62000-memory.dmp

memory/2036-162-0x0000000140000000-0x000000014124B000-memory.dmp

memory/2036-158-0x00007FFF69C50000-0x00007FFF69C52000-memory.dmp

memory/4756-1134-0x0000000000400000-0x0000000000470000-memory.dmp

memory/392-1176-0x0000000000400000-0x000000000052C000-memory.dmp

memory/2036-1177-0x00000001402EA000-0x0000000140927000-memory.dmp

memory/392-1202-0x0000000000400000-0x000000000052C000-memory.dmp