Where to Buy Trend Micro Products

For Home

For Small Business

1-888-762-8736
(M-F 8:00am-5:00pm CST)

For Enterprise

1-877-218-7353
(M-F 8:00am-5:00pm CST)

Not in the United States?
Select the country/language of your choice:

Asia Pacific Region

Europe

The Americas

Not in the United States?
Select the country/language of your choice:

Asia/Pacific

Europe

America

Login

For Home

For Business

For Partners

Threat Encyclopedia

TSPY_ICEIX.A

ANALYSIS BY

Roland Marco Dela Paz


PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

OVERALL RISK RATING:
REPORTED INFECTION:
SYSTEM IMPACT RATING:
INFORMATION EXPOSURE:

  • Threat Type:Spyware

  • Destructiveness:No

  • Encrypted: Yes

  • In the wild: Yes

OVERVIEW


This spyware is designed to steal banking information and is known in media reports as the “Ice IX bot”. It is based on Zeus 2.x source code, thus, its behavior is similar to Zeus incorporated with minor changes in its routines. It is capable of monitoring the user's online banking transactions via means of the hooked APIs. It can also obtain personal certificates through the modified PFXImportCertStore API.

To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below.

It intercepts the APIs to perform its malicious routines.

It connects to specific URLs to download its configuration file.

This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It is injected into all running processes to remain memory resident.

TECHNICAL DETAILS

File Size:

99,840 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

24 Aug 2011

Arrival Details

This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This spyware drops the following files:

  • %Application Data%\{random2}\{random}.{random}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

  • %Application Data%\{random1}\{random}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It creates the following folders:

  • %Application Data%\{random1}
  • %Application Data%\{random2}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It is injected into all running processes to remain memory resident.

It adds the following mutexes to ensure that only one of its copies runs at any one time:

  • Global\{GUID}
  • Local\{GUID}

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{35D54A61-7071-B7F6-1D93-58D85F80CF3F} = "%Application Data%\{random1}\{random}.exe"

Other System Modifications

This spyware adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
{random}
{random1} = "{hex values}"

HKEY_CURRENT_USER\Software\Microsoft\
{random}
{random2} = "{hex values}"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\0
1609 = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1406 = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1609 = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\2
1609 = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1406 = "0"

(Note: The default value data of the said registry entry is 3.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1609 = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\4
1406 = "0"

(Note: The default value data of the said registry entry is 3.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\4
1609 = "0"

(Note: The default value data of the said registry entry is 1.)

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
C:\WINDOWS\explorer.exe = "C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer"

NOTES:

Information Theft

It intercepts the following APIs to perform its malicious routines. Some of which are used for information theft.

  • ntdll.dll
    • NtCreateThread
    • LdrLoadDll
  • kernel32.dll
    • GetFileAttributesExW
  • USER32.dll
    • ReleaseDC
    • GetDC
    • TranslateMessage
    • GetWindowDC
    • GetMessageW
    • PeekMessageW
    • GetCapture
    • RegisterClassW
    • RegisterClassExW
    • OpenInputDesktop
    • SwitchDesktop
    • DefDlgProcW
    • GetMessageA
    • RegisterClassExA
    • DefWindowProcW
    • BeginPaint
    • EndPaint
    • GetCursorPos
    • GetMessagePos
    • CallWindowProcW
    • PeekMessageA
    • GetUpdateRect
    • CallWindowProcA
    • DefWindowProcA
    • SetCapture
    • ReleaseCapture
    • GetDCEx
    • RegisterClassA
    • GetUpdateRgn
    • DefFrameProcW
    • DefMDIChildProcW
    • GetClipboardData
    • DefDlgProcA
    • DefFrameProcA
    • DefMDIChildProcA
    • SetCursorPos
  • WS2_32.dll
    • closesocket
    • send
    • WSASend
  • CRYPT32.dll
    • PFXImportCertStore
  • WININET.dll
    • InternetCloseHandle
    • HttpSendRequestA
    • HttpQueryInfoA
    • InternetReadFile
    • InternetReadFile
    • HttpSendRequestExW
    • InternetQueryDataAvailable
    • InternetReadFileExA
    • HttpSendRequestW
    • HttpSendRequestExA
  • NSPR4.dll
    • PR_OpenTCPSocket
    • PR_Close
    • PR_Read
    • PR_Write
  • Bot Information:
    • name: ice9
    • version: 1.0.5.0

It connects to the following URL. Once connected, the server replies with a binary attachment which is the malware's configuration file.

  • http://{BLOCKED}utcaffee2.net/photos/zb1/cc/ccc.php

The configuration file contains encrypted information. When decrypted, it reveals the URL where an updated copy of itself can be downloaded:

  • http://{BLOCKED}utcaffee.net/photos/zb1/cc/bot.exe

server:

  • http://{BLOCKED}utcaffee.net/photos/zb1/gate.php

URL where the configuration file can be downloaded:

  • http://{BLOCKED}utcaffee2.net/photos/zb1/cc/ccc.php
Monitored URLs:
  • *.abbeynational.co.uk/*
  • *.barclays.co.uk*
  • *.firstdirect.com/*splash*trusteer*
  • *.firstdirect.com/1/2/*
  • *.hsbc.co.uk/1/2/!ut/*
  • *.mybank.alliance-leicester.co.uk*
  • *.rbsdigital.com*
  • *barclaycard.co.uk*initialLogon*
  • *commissioncontrol.net*
  • *coventrybuildingsociety.co.uk*
  • *halifax-online.co.uk*
  • *halifax-online.co.uk/_mem_bin/*ormslogin.asp*
  • *halifax-online.co.uk/CustomerManage/MyAccounts.aspx*
  • *npbs.co.uk*
  • *nwolb.co*
  • *retail.santander.co.uk*
  • *securebank.cahoot.com*
  • *tuxedomoney.com*
  • http*://*alliance-leicester.co.uk*
  • http*://*cbonline.co.uk*
  • http*://*co-operativebank.co.uk*
  • http*://*smile.co.uk*
  • http*halifax-online.co.uk/**/
  • https://cardservicing.tescofinance.com/RBSG_Consumer/UserLogin.do*
  • https://cardservicing.tescofinance.com/RBSG_Consumer/VerifyLogin.do*
  • https://database.acornmediauk.com/*
  • https://ibank.cahoot.com/*
  • https://my.if.com/_mem_bin/formslogin.asp*
  • https://online.islamic-bank.com/online/aspscripts/secretenter.asp*
  • https://secure.ingdirect.co.uk/InitialINGDirect.html*
  • https://secure.natweststockbrokers.co.uk/nws-secure2/*
  • https://service.oneaccount.com/*/OSV2?event=login&pt=3
  • https://uk.virginmoney.com/virgin/service/credit-card/*
  • https://welcome23.smile.co.uk/SmileWeb/*
  • https://welcome23.smile.co.uk/SmileWeb/passcode.do
  • https://welcome27.co-operativebank.co.uk/CBIBSWeb/*
  • https://welcome27.co-operativebank.co.uk/CBIBSWeb/passcode.do
  • https://www.accessmycardonline.com/RBS_Consumer/*
  • https://www.barclayswealth.com/login/action/logon/unauthenticated/personal/loginDetailsNotStored
  • https://www.barclayswealth.com/login/action/logon/unauthenticated/personal/loginSigning
  • https://www.caterallenonline.co.uk/WebAccess.dll
  • https://www.edirectdebit.com/administration/client/logon.aspx
  • https://www.mybusinessbank.co.uk/cs70_banking/*
  • https://www.mybusinessbank.co.uk/cs70_banking/logon*
  • https://www.mybusinessbank.co.uk/cs70_banking/logon/challenge/submit
  • https://www.mybusinessbank.co.uk/cs70_banking/logon/logon/enrollPassword
  • https://www.mybusinessbank.co.uk/cs70_banking/logon/logon/password
  • https://www.mybusinessbank.co.uk/cs70_banking/logon/logon/pmPassword
  • https://www.mybusinessbank.co.uk/cs70_banking/logon/sbuser/getPassword
  • https://www.nochex.com/*
  • https://www.offshore.hsbc.com/1/2/!ut/p/kcxml/*
  • https://www.offshore.hsbc.com/1/2/idv.Authentication

Targeted Institutions:

  • Acorn Media
  • Alliance & Leicester
  • Banco Santander
  • Barclays
  • Cahoot Bank
  • Cater Allen Online
  • Clydesdale Bank
  • Co-operative Bank
  • E-Direct Debit
  • First Direct
  • Halifax
  • HSBC UK
  • Islamic Bank
  • My Business Bank
  • Natwest
  • Nochex
  • Royal Bank of Scotland
  • Tesco Finance
  • Virgin Money UK

*Note that the contents of the configuration file may change anytime.

By means of the hooked APIs, it is capable of monitoring the user's online banking transactions. It can also obtain personal certificates through the modified PFXImportCertStore API. Grabbed certificates are stored in the following format:

  • certs\{computername}|{username}\grabbed_dd_mm_yyyy.pfx

In addition, it can also obtain email addresses by hooking WSASend and send APIs and by checking the Windows Address Book (WAB) and MS Outlook files.

It may also get stored passwords in the following registry locations:

HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\Active Directory GC

HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\Bigfoot

HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\VeriSign

HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\WhoWhere

All gathered information are then saved and encrypted to the following file, and sent later on to its server:

  • %Application Data%\{random2}\{random}.{random}

Other Details

It checks if the running process is its dropped copy. If not, it will terminate and delete itself by creating and executing a batch file:

  • %User Temp%\tmp{random}.bat

This batch file is also deleted afterwards.

SOLUTION

Minimum Scan Engine:

8.900

FIRST VSAPI PATTERN FILE:

8.388.05

FIRST VSAPI PATTERN DATE:

29 Aug 2011

VSAPI OPR PATTERN File:

8.389.00

VSAPI OPR PATTERN Date:

29 Aug 2011

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Scan your computer with your Trend Micro product and note files detected as TSPY_ICEIX.A

Step 3

Restart in Safe Mode

[ Learn More ]

Step 4

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.


  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • {35D54A61-7071-B7F6-1D93-58D85F80CF3F} = "%Application Data%\{random1}\{random}.exe"
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\
    Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    • C:\WINDOWS\explorer.exe = "C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer"

Step 5

Restore this modified registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\0
    • From: 1609 = "0"
      To: 1609 = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\1
    • From: 1406 = "0"
      To: 1406 = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\1
    • From: 1609 = "0"
      To: 1609 = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\2
    • From: 1609 = "0"
      To: 1609 = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\3
    • From: 1406 = "0"
      To: 1406 = "3"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\3
    • From: 1609 = "0"
      To: 1609 = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\4
    • From: 1406 = "0"
      To: 1406 = "3"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\4
    • From: 1609 = "0"
      To: 1609 = "1"

Step 6

Search and delete this file

[ Learn More ]
There may be some component files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden files and folders in the search result.
  • %Application Data%\{random2}\{random}.{random}

Step 7

Search and delete these folders

[ Learn More ]
Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.
  • %Application Data%\{random1}
  • %Application Data%\{random2}

Step 8

Restart in normal mode and scan your computer with your Trend Micro product for files detected as TSPY_ICEIX.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.

Featured Stories

Connect with us on