Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/03/2025, 02:06
General
-
Target
2025-03-08_ceca87332b6baef1d4362835c645fde4_icedid.exe
-
Size
1.2MB
-
MD5
ceca87332b6baef1d4362835c645fde4
-
SHA1
42e1397a1919374ca330e89c56e950be9774a7f1
-
SHA256
3078bfd761b290630321b44bf7e068922cb3ed191c98785d9f6048e5d342e346
-
SHA512
12ad155df88d18bc250bdca709d63e2615316d046bcf8fdd9e0daab0f1d71d87e91992d4fb502d7131de061540429ad687652e05cda59733ba2e1c0d8f814714
-
SSDEEP
24576:RbndcEBtMIgeOZ+FzZ5flLBVv0p8o30k65zQtqBG3G3ndFBex92JeDty/IZs:tndJBth/t59Fp9aDiQc6YdFBex92Jep8
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Drops file in Windows directory 6 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-08_ceca87332b6baef1d4362835c645fde4_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-08_ceca87332b6baef1d4362835c645fde4_icedid.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\ProgramData\appsoft\\install32.dll,installsvc InstallService2⤵
- Server Software Component: Terminal Services DLL
- Sets service image path in registry
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\delself.bat"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe NetworkService 23042⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
279KB
MD502adb5a63d5d4fa74ddcc9e3b6976624
SHA1cbb6b7e8e537dad3892361f26837396ea9695848
SHA256d40e9f8176766b4a31ac9807837c3be0e957b755b6f3dd0eb8caf44aeb032060
SHA512d3458c37c9892868e63dddadf26686ba30751a40bf529fc51df0d936fcede8145446a611a82e737ee36adf55b48f73f3a72f8ce381fc880a879fec23b9c1592a
-
Filesize
52KB
MD5b39caefae13d0dc0344380b9b19c33c4
SHA16fe41d9026112599721916a251169ca360cc18e8
SHA256766cee16390c18a85fb3ec9b740986c8ab022cbc35660ff60fba6e72050d417c
SHA51276136b62ebfd8c969a6bf97c6e76127b67697ec0c7da1068c9951e6be4f8c8960d57103ad429f91ddc43702debbca069ba32ac2b6c179902111f339e7090e02a
-
Filesize
56KB
MD5823e689e34be362faeddb2bd8d32a05e
SHA1fcc66ea2198a03def308c53adda78d4a64ed22f7
SHA256b0a58c6c859833eb6fb1c7d8cb0c5875ab42be727996bcc20b17dd8ad0058ffa
SHA512f9910032025a61c97c8812249494ba1f6f92b6fce34854d485aff17e45f34c9c6e913484316f90ad4ffe1823083f104ad2b47dd6a2d92eae383ae7d4c0a63fb4
-
Filesize
1KB
MD58f490dc7ec6782d4fd16f67c1df1c5f3
SHA1038e54e03f3b8faf60c69a6d4c073df99bcb5953
SHA256b448c3c879a662e82f1e9dca21c53abd2c0bd2f7aab1631918a04e910e41e5ed
SHA512f1e9ab048bf6ea22f9d23d080ba10b7dcf7b395f09d4f32e39dbb9f03ab75ce61508b449f4d01e9c45dd236f1f43fc394ebd8facf02089925ef3acae55deaa7c
-
Filesize
307B
MD5ee84b4ec9e7d5d14f725ba596455147f
SHA15f9e205ffb52d2293821524be39a0d165dfe6a6c
SHA256e9b25efc10a6dea19e2b88a425f7ebcaaff90cebab175e8a1f12a2017892ba1d
SHA5120c1875f2c8c447adec41da1d5a4a457a35a05be8505b4bc302967843da793e5689ad9e884c727fbfe5504b80e4e1d231e4e08bbe0f43799c64c9b410b31cdac6
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
68KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
116KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
196KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
116KB