TSPY_ICEIX.A
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Spyware
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
This spyware is designed to steal banking information and is known in media reports as the “Ice IX bot”. It is based on Zeus 2.x source code, thus, its behavior is similar to Zeus incorporated with minor changes in its routines. It is capable of monitoring the user's online banking transactions via means of the hooked APIs. It can also obtain personal certificates through the modified PFXImportCertStore API.
To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below.
It intercepts the APIs to perform its malicious routines.
It connects to specific URLs to download its configuration file.
This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.
It is injected into all running processes to remain memory resident.
TECHNICAL DETAILS
Arrival Details
This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users.
It may be downloaded by other malware/grayware/spyware from remote sites.
It may be unknowingly downloaded by a user while visiting malicious websites.
Installation
This spyware drops the following files:
- %Application Data%\{random2}\{random}.{random}
(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)
It drops the following copies of itself into the affected system:
- %Application Data%\{random1}\{random}.exe
(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)
It creates the following folders:
- %Application Data%\{random1}
- %Application Data%\{random2}
(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)
It is injected into all running processes to remain memory resident.
It adds the following mutexes to ensure that only one of its copies runs at any one time:
- Global\{GUID}
- Local\{GUID}
Autostart Technique
This spyware adds the following registry entries to enable its automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{35D54A61-7071-B7F6-1D93-58D85F80CF3F} = "%Application Data%\{random1}\{random}.exe"
Other System Modifications
This spyware adds the following registry entries as part of its installation routine:
HKEY_CURRENT_USER\Software\Microsoft\
{random}
{random1} = "{hex values}"
HKEY_CURRENT_USER\Software\Microsoft\
{random}
{random2} = "{hex values}"
It modifies the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\0
1609 = "0"
(Note: The default value data of the said registry entry is 1.)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1406 = "0"
(Note: The default value data of the said registry entry is 1.)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1609 = "0"
(Note: The default value data of the said registry entry is 1.)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\2
1609 = "0"
(Note: The default value data of the said registry entry is 1.)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1406 = "0"
(Note: The default value data of the said registry entry is 3.)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1609 = "0"
(Note: The default value data of the said registry entry is 1.)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\4
1406 = "0"
(Note: The default value data of the said registry entry is 3.)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\4
1609 = "0"
(Note: The default value data of the said registry entry is 1.)
It creates the following registry entry(ies) to bypass Windows Firewall:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
C:\WINDOWS\explorer.exe = "C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer"
NOTES:
Information Theft
It intercepts the following APIs to perform its malicious routines. Some of which are used for information theft.
- ntdll.dll
- NtCreateThread
- LdrLoadDll
- kernel32.dll
- GetFileAttributesExW
- USER32.dll
- ReleaseDC
- GetDC
- TranslateMessage
- GetWindowDC
- GetMessageW
- PeekMessageW
- GetCapture
- RegisterClassW
- RegisterClassExW
- OpenInputDesktop
- SwitchDesktop
- DefDlgProcW
- GetMessageA
- RegisterClassExA
- DefWindowProcW
- BeginPaint
- EndPaint
- GetCursorPos
- GetMessagePos
- CallWindowProcW
- PeekMessageA
- GetUpdateRect
- CallWindowProcA
- DefWindowProcA
- SetCapture
- ReleaseCapture
- GetDCEx
- RegisterClassA
- GetUpdateRgn
- DefFrameProcW
- DefMDIChildProcW
- GetClipboardData
- DefDlgProcA
- DefFrameProcA
- DefMDIChildProcA
- SetCursorPos
- WS2_32.dll
- closesocket
- send
- WSASend
- CRYPT32.dll
- PFXImportCertStore
- WININET.dll
- InternetCloseHandle
- HttpSendRequestA
- HttpQueryInfoA
- InternetReadFile
- InternetReadFile
- HttpSendRequestExW
- InternetQueryDataAvailable
- InternetReadFileExA
- HttpSendRequestW
- HttpSendRequestExA
- NSPR4.dll
- PR_OpenTCPSocket
- PR_Close
- PR_Read
- PR_Write
- Bot Information:
- name: ice9
- version: 1.0.5.0
It connects to the following URL. Once connected, the server replies with a binary attachment which is the malware's configuration file.
- http://{BLOCKED}utcaffee2.net/photos/zb1/cc/ccc.php
The configuration file contains encrypted information. When decrypted, it reveals the URL where an updated copy of itself can be downloaded:
- http://{BLOCKED}utcaffee.net/photos/zb1/cc/bot.exe
server:
- http://{BLOCKED}utcaffee.net/photos/zb1/gate.php
URL where the configuration file can be downloaded:
- http://{BLOCKED}utcaffee2.net/photos/zb1/cc/ccc.php
- *.abbeynational.co.uk/*
- *.barclays.co.uk*
- *.firstdirect.com/*splash*trusteer*
- *.firstdirect.com/1/2/*
- *.hsbc.co.uk/1/2/!ut/*
- *.mybank.alliance-leicester.co.uk*
- *.rbsdigital.com*
- *barclaycard.co.uk*initialLogon*
- *commissioncontrol.net*
- *coventrybuildingsociety.co.uk*
- *halifax-online.co.uk*
- *halifax-online.co.uk/_mem_bin/*ormslogin.asp*
- *halifax-online.co.uk/CustomerManage/MyAccounts.aspx*
- *npbs.co.uk*
- *nwolb.co*
- *retail.santander.co.uk*
- *securebank.cahoot.com*
- *tuxedomoney.com*
- http*://*alliance-leicester.co.uk*
- http*://*cbonline.co.uk*
- http*://*co-operativebank.co.uk*
- http*://*smile.co.uk*
- http*halifax-online.co.uk/**/
- https://cardservicing.tescofinance.com/RBSG_Consumer/UserLogin.do*
- https://cardservicing.tescofinance.com/RBSG_Consumer/VerifyLogin.do*
- https://database.acornmediauk.com/*
- https://ibank.cahoot.com/*
- https://my.if.com/_mem_bin/formslogin.asp*
- https://online.islamic-bank.com/online/aspscripts/secretenter.asp*
- https://secure.ingdirect.co.uk/InitialINGDirect.html*
- https://secure.natweststockbrokers.co.uk/nws-secure2/*
- https://service.oneaccount.com/*/OSV2?event=login&pt=3
- https://uk.virginmoney.com/virgin/service/credit-card/*
- https://welcome23.smile.co.uk/SmileWeb/*
- https://welcome23.smile.co.uk/SmileWeb/passcode.do
- https://welcome27.co-operativebank.co.uk/CBIBSWeb/*
- https://welcome27.co-operativebank.co.uk/CBIBSWeb/passcode.do
- https://www.accessmycardonline.com/RBS_Consumer/*
- https://www.barclayswealth.com/login/action/logon/unauthenticated/personal/loginDetailsNotStored
- https://www.barclayswealth.com/login/action/logon/unauthenticated/personal/loginSigning
- https://www.caterallenonline.co.uk/WebAccess.dll
- https://www.edirectdebit.com/administration/client/logon.aspx
- https://www.mybusinessbank.co.uk/cs70_banking/*
- https://www.mybusinessbank.co.uk/cs70_banking/logon*
- https://www.mybusinessbank.co.uk/cs70_banking/logon/challenge/submit
- https://www.mybusinessbank.co.uk/cs70_banking/logon/logon/enrollPassword
- https://www.mybusinessbank.co.uk/cs70_banking/logon/logon/password
- https://www.mybusinessbank.co.uk/cs70_banking/logon/logon/pmPassword
- https://www.mybusinessbank.co.uk/cs70_banking/logon/sbuser/getPassword
- https://www.nochex.com/*
- https://www.offshore.hsbc.com/1/2/!ut/p/kcxml/*
- https://www.offshore.hsbc.com/1/2/idv.Authentication
Targeted Institutions:
- Acorn Media
- Alliance & Leicester
- Banco Santander
- Barclays
- Cahoot Bank
- Cater Allen Online
- Clydesdale Bank
- Co-operative Bank
- E-Direct Debit
- First Direct
- Halifax
- HSBC UK
- Islamic Bank
- My Business Bank
- Natwest
- Nochex
- Royal Bank of Scotland
- Tesco Finance
- Virgin Money UK
*Note that the contents of the configuration file may change anytime.
By means of the hooked APIs, it is capable of monitoring the user's online banking transactions. It can also obtain personal certificates through the modified PFXImportCertStore API. Grabbed certificates are stored in the following format:
- certs\{computername}|{username}\grabbed_dd_mm_yyyy.pfx
In addition, it can also obtain email addresses by hooking WSASend and send APIs and by checking the Windows Address Book (WAB) and MS Outlook files.
It may also get stored passwords in the following registry locations:
HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\Active Directory GC
HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\Bigfoot
HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\VeriSign
HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\WhoWhere
All gathered information are then saved and encrypted to the following file, and sent later on to its server:
- %Application Data%\{random2}\{random}.{random}
Other Details
It checks if the running process is its dropped copy. If not, it will terminate and delete itself by creating and executing a batch file:
- %User Temp%\tmp{random}.bat
This batch file is also deleted afterwards.
SOLUTION
Step 1
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Step 2
Scan your computer with your Trend Micro product and note files detected as TSPY_ICEIX.A
Step 3
Restart in Safe Mode
Step 4
Delete this registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- {35D54A61-7071-B7F6-1D93-58D85F80CF3F} = "%Application Data%\{random1}\{random}.exe"
- {35D54A61-7071-B7F6-1D93-58D85F80CF3F} = "%Application Data%\{random1}\{random}.exe"
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\
Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List- C:\WINDOWS\explorer.exe = "C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer"
- C:\WINDOWS\explorer.exe = "C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer"
Step 5
Restore this modified registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Internet Settings\Zones\0- From: 1609 = "0"
To: 1609 = "1"
- From: 1609 = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Internet Settings\Zones\1- From: 1406 = "0"
To: 1406 = "1"
- From: 1406 = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Internet Settings\Zones\1- From: 1609 = "0"
To: 1609 = "1"
- From: 1609 = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Internet Settings\Zones\2- From: 1609 = "0"
To: 1609 = "1"
- From: 1609 = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Internet Settings\Zones\3- From: 1406 = "0"
To: 1406 = "3"
- From: 1406 = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Internet Settings\Zones\3- From: 1609 = "0"
To: 1609 = "1"
- From: 1609 = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Internet Settings\Zones\4- From: 1406 = "0"
To: 1406 = "3"
- From: 1406 = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Internet Settings\Zones\4- From: 1609 = "0"
To: 1609 = "1"
- From: 1609 = "0"
Step 6
Search and delete this file
- %Application Data%\{random2}\{random}.{random}
Step 7
Search and delete these folders
- %Application Data%\{random1}
- %Application Data%\{random2}
Step 8
Restart in normal mode and scan your computer with your Trend Micro product for files detected as TSPY_ICEIX.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.