sparkrat | c75135589b49ee21ad509b308893c9eaa76ed00d38319e177a465a40584c0a6d

General

Target
2026-11-05_98cc318b4a7ef056714b80827ac86031_icedid.exe
Size 10.5MB
Sample261106-sne2sszzav
SHA256 c75135589b49ee21ad509b308893c9eaa76ed00d38319e177a465a40584c0a6d
MD5 98cc318b4a7ef056714b80827ac86031
SHA1 52812cc08de202f44ac17675e61c6ab490ac9a0d
SHA512 e69855638ea693530978aa54e32128505c13d5c0aae4f538471567c729b70a49f2a271c733703a363b0f70e4214acf791690c47dc4cff88a3b64ec626df27977
SSDEEP 196608:4kLfezwvntMppVr7cQJrOEPhOMTE7nAPWDQ8uNPQx+I52/f+RFTk+UP6tCob4O6q:WSMxrZKEPExwWbEQgI52/feUP6UoM
TLSH
T17CB6332905AC59D3E4C3807E19602D40DAB73539BB7CA0CFBB80AD718FA65D98ECE751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution sparkrat persistence spyware trojan

Malware Config

Signatures

Family: Sparkrat
Sparkrat is a cross-platfrom backdoor written in Golang.
backdoor sparkrat

Detects SparkRAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/6052-3-0x000001F246950000-0x000001F247404000-memory.dmp	family_sparkrat
behavioral2/memory/6052-11-0x000001F246950000-0x000001F247404000-memory.dmp	family_sparkrat
behavioral2/memory/6052-12-0x000001F246950000-0x000001F247404000-memory.dmp	family_sparkrat
behavioral2/memory/6052-13-0x000001F246950000-0x000001F247404000-memory.dmp	family_sparkrat
behavioral2/memory/6052-14-0x000001F246950000-0x000001F247404000-memory.dmp	family_sparkrat
behavioral2/memory/6052-15-0x000001F246950000-0x000001F247404000-memory.dmp	family_sparkrat
behavioral2/memory/6052-17-0x000001F246950000-0x000001F247404000-memory.dmp	family_sparkrat

Executes dropped EXE 1 IoCs

pid	Process
6052	FeiQ.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipapi.co
1	ip-api.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\FeiQ\FeiQ\3.0.0.1\FeiQ.exe	2026-11-05_98cc318b4a7ef056714b80827ac86031_icedid.exe
File created	C:\Program Files\FeiQ\FeiQ\3.0.0.1\.powkey	FeiQ.exe
File created	C:\Program Files\FeiQ\FeiQ\3.0.0.1\.persist	FeiQ.exe
File created	C:\Program Files\FeiQ\FeiQ\3.0.0.1\FeiQ.exe	2026-11-05_98cc318b4a7ef056714b80827ac86031_icedid.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4124	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	FeiQ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	FeiQ.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FeiQ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FeiQ.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	4	Go-http-client/1.1

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	FeiQ.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2436	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6052	FeiQ.exe
Token: SeDebugPrivilege	6052	FeiQ.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 4124	5112	2026-11-05_98cc318b4a7ef056714b80827ac86031_icedid.exe	91
PID 4124 wrote to memory of 6052	4124	cmd.exe	93
PID 6052 wrote to memory of 4960	6052	FeiQ.exe	94
PID 6052 wrote to memory of 2436	6052	FeiQ.exe	96
PID 6052 wrote to memory of 124	6052	FeiQ.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-05_98cc318b4a7ef056714b80827ac86031_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-05_98cc318b4a7ef056714b80827ac86031_icedid.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c start "" /b "C:\Program Files\FeiQ\FeiQ\3.0.0.1\FeiQ.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Program Files\FeiQ\FeiQ\3.0.0.1\FeiQ.exe
    "C:\Program Files\FeiQ\FeiQ\3.0.0.1\FeiQ.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies trusted root certificate store through registry
    - Reads the TCP/IP host and domain name from the registry
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn "FeiQ" /f 2>nul
      4⤵
      PID:4960
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "FeiQ" /tr "cmd.exe /c start \"\" /b \"C:\Program Files\FeiQ\FeiQ\3.0.0.1\FeiQ.exe\"" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2436
  - - C:\Windows\system32\cmd.exe
      cmd ver
      4⤵
      PID:124

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

2

T1553

Install Root Certificate

2

T1553.004

Credential Access

Discovery

Query Registry

1

T1012

System Network Configuration Discovery

2

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FeiQ.exe

Path C:\Program Files\FeiQ\FeiQ\3.0.0.1\FeiQ.exe
Size 10.5MB
SHA256 c75135589b49ee21ad509b308893c9eaa76ed00d38319e177a465a40584c0a6d
MD5 98cc318b4a7ef056714b80827ac86031
SHA1 52812cc08de202f44ac17675e61c6ab490ac9a0d
SHA512 e69855638ea693530978aa54e32128505c13d5c0aae4f538471567c729b70a49f2a271c733703a363b0f70e4214acf791690c47dc4cff88a3b64ec626df27977
SSDEEP 196608:4kLfezwvntMppVr7cQJrOEPhOMTE7nAPWDQ8uNPQx+I52/f+RFTk+UP6tCob4O6q:WSMxrZKEPExwWbEQgI52/feUP6UoM
TLSH
T17CB6332905AC59D3E4C3807E19602D40DAB73539BB7CA0CFBB80AD718FA65D98ECE751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6052-3-0x000001F246950000-0x000001F247404000-memory.dmp

Download

memory/6052-11-0x000001F246950000-0x000001F247404000-memory.dmp

Download

memory/6052-12-0x000001F246950000-0x000001F247404000-memory.dmp

Download

memory/6052-13-0x000001F246950000-0x000001F247404000-memory.dmp

Download

memory/6052-14-0x000001F246950000-0x000001F247404000-memory.dmp

Download

memory/6052-15-0x000001F246950000-0x000001F247404000-memory.dmp

Download

memory/6052-17-0x000001F246950000-0x000001F247404000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads