TrojanSpy.Win64.ICEDID.THCBBCDO

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

• %Application Data%\{{Random 8 characters}-{Random 4 characters}-{Random 4 characters}-{Random 4 characters}-{Random 8 characters}}\{{Random 8 characters}-{Random 4 characters}-{Random 4 characters}-{Random 4 characters}-{Random 8 characters}}\{Random letters}.dll - Slightly modified version of the sample

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %Application Data%\{{Random 8 characters}-{Random 4 characters}-{Random 4 characters}-{Random 4 characters}-{Random 8 characters}}
• %Application Data%\{{Random 8 characters}-{Random 4 characters}-{Random 4 characters}-{Random 4 characters}-{Random 8 characters}}\{{Random 8 characters}-{Random 4 characters}-{Random 4 characters}-{Random 4 characters}-{Random 8 characters}}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {Generated String}

It injects codes into the following process(es):

• chrome.exe
• firefox.exe
• iexplore.exe
• microsoftedgecp.exe

Backdoor Routine

This Trojan Spy executes the following commands from a remote malicious user:

• Update config
• Reboot system
• Execute arbitrary commands
• Inject shellcode in spawned cmd.exe process
• Execute powershell script
• Execute .exe files from pipe response
• Enumerates the bot’s code page
• Steal cookies
• Steal login information
• Obtain browser passwords
• Obtain autofill data (passwords, user number, card information)
• Obtain Outlook profiles

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• https://{BLOCKED}best.top
• https://{BLOCKED}lo.website
• https://{BLOCKED}dlim.top
• https://{BLOCKED}ipfo.top
• https://{BLOCKED}ilin.top
• https://{BLOCKED}ntlim.top

Download Routine

This Trojan Spy connects to the following URL(s) to download its configuration file:

• https://{BLOCKED}best.top/news/
• https://derrillo.{BLOCKED}e/news/
• https://{BLOCKED}dlim.top/news/
• https://{BLOCKED}ipfo.top/news/
• https://{BLOCKED}tilin.top/news/
• https://{BLOCKED}ntlim.top/news/

As of this writing, the said sites are inaccessible.

Information Theft

This Trojan Spy gathers the following data:

• Computer name
• Account name
• User Name
• SID
• Product information
• Native system information
• Network Join information
• Adapters information
• Workstation information

Other Details

This Trojan Spy requires the following additional components to properly run:

• %Application Data%\license.dat - encrypted module, detected as TrojanSpy.Win64.ICEDID.THCBBCDO.enc

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It does the following:

• It generates its own SSL Certificates and saves it as:
  • %User Temp%\{random characters}.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following scheduled tasks:

• Task Name:{{Random 8 characters}-{Random 4 characters}-{Random 4 characters}-{Random 4 characters}-{Random 8 characters}}
  Task to be run:rundll32.exe %Application Data%\{{Random 8 characters}-{Random 4 characters}-{Random 4 characters}-{Random 4 characters}-{Random 8 characters}}\{{Random 8 characters}-{Random 4 characters}-{Random 4 characters}-{Random 4 characters}-{Random 8 characters}}\{Random letters}.dll, update /i:"license.dat"

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)