Skip to content

Export page to PDF
TSPY_ICEIX.A
Malware type: Spyware
Destructive: No
Platform: Windows 2000, Windows XP, Windows Server 2003
Encrypted: Yes
In the wild: Yes

Overview


This spyware is designed to steal banking information and is known in media reports as the “Ice IX bot”. It is based on Zeus 2.x source code, thus, its behavior is similar to Zeus incorporated with minor changes in its routines. It is capable of monitoring the user's online banking transactions via means of the hooked APIs. It can also obtain personal certificates through the modified PFXImportCertStore API.

To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below.

It intercepts the APIs to perform its malicious routines.

It connects to specific URLs to download its configuration file.

This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It is injected into all running processes to remain memory resident.

Technical Details


File size: 99,840 bytes
File type: EXE
Memory resident: Yes
Initial samples received date: 24 Aug 2011

Arrival Details

This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This spyware drops the following files:

  • %Application Data%\{random2}\{random}.{random}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

  • %Application Data%\{random1}\{random}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It creates the following folders:

  • %Application Data%\{random1}
  • %Application Data%\{random2}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It is injected into all running processes to remain memory resident.

It adds the following mutexes to ensure that only one of its copies runs at any one time:

  • Global\{GUID}
  • Local\{GUID}

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{35D54A61-7071-B7F6-1D93-58D85F80CF3F} = "%Application Data%\{random1}\{random}.exe"

Other System Modifications

This spyware adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
{random}
{random1} = "{hex values}"

HKEY_CURRENT_USER\Software\Microsoft\
{random}
{random2} = "{hex values}"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\0
1609 = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1406 = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1609 = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\2
1609 = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1406 = "0"

(Note: The default value data of the said registry entry is 3.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1609 = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\4
1406 = "0"

(Note: The default value data of the said registry entry is 3.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\4
1609 = "0"

(Note: The default value data of the said registry entry is 1.)

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
C:\WINDOWS\explorer.exe = "C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer"

NOTES:

Information Theft

It intercepts the following APIs to perform its malicious routines. Some of which are used for information theft.

  • ntdll.dll
    • NtCreateThread
    • LdrLoadDll
  • kernel32.dll
    • GetFileAttributesExW
  • USER32.dll
    • ReleaseDC
    • GetDC
    • TranslateMessage
    • GetWindowDC
    • GetMessageW
    • PeekMessageW
    • GetCapture
    • RegisterClassW
    • RegisterClassExW
    • OpenInputDesktop
    • SwitchDesktop
    • DefDlgProcW
    • GetMessageA
    • RegisterClassExA
    • DefWindowProcW
    • BeginPaint
    • EndPaint
    • GetCursorPos
    • GetMessagePos
    • CallWindowProcW
    • PeekMessageA
    • GetUpdateRect
    • CallWindowProcA
    • DefWindowProcA
    • SetCapture
    • ReleaseCapture
    • GetDCEx
    • RegisterClassA
    • GetUpdateRgn
    • DefFrameProcW
    • DefMDIChildProcW
    • GetClipboardData
    • DefDlgProcA
    • DefFrameProcA
    • DefMDIChildProcA
    • SetCursorPos
  • WS2_32.dll
    • closesocket
    • send
    • WSASend
  • CRYPT32.dll
    • PFXImportCertStore
  • WININET.dll
    • InternetCloseHandle
    • HttpSendRequestA
    • HttpQueryInfoA
    • InternetReadFile
    • InternetReadFile
    • HttpSendRequestExW
    • InternetQueryDataAvailable
    • InternetReadFileExA
    • HttpSendRequestW
    • HttpSendRequestExA
  • NSPR4.dll
    • PR_OpenTCPSocket
    • PR_Close
    • PR_Read
    • PR_Write
  • Bot Information:
    • name: ice9
    • version: 1.0.5.0

It connects to the following URL. Once connected, the server replies with a binary attachment which is the malware's configuration file.

  • http://{BLOCKED}utcaffee2.net/photos/zb1/cc/ccc.php

The configuration file contains encrypted information. When decrypted, it reveals the URL where an updated copy of itself can be downloaded:

  • http://{BLOCKED}utcaffee.net/photos/zb1/cc/bot.exe

server:

  • http://{BLOCKED}utcaffee.net/photos/zb1/gate.php

URL where the configuration file can be downloaded:

  • http://{BLOCKED}utcaffee2.net/photos/zb1/cc/ccc.php
Monitored URLs:
  • *.abbeynational.co.uk/*
  • *.barclays.co.uk*
  • *.firstdirect.com/*splash*trusteer*
  • *.firstdirect.com/1/2/*
  • *.hsbc.co.uk/1/2/!ut/*
  • *.mybank.alliance-leicester.co.uk*
  • *.rbsdigital.com*
  • *barclaycard.co.uk*initialLogon*
  • *commissioncontrol.net*
  • *coventrybuildingsociety.co.uk*
  • *halifax-online.co.uk*
  • *halifax-online.co.uk/_mem_bin/*ormslogin.asp*
  • *halifax-online.co.uk/CustomerManage/MyAccounts.aspx*
  • *npbs.co.uk*
  • *nwolb.co*
  • *retail.santander.co.uk*
  • *securebank.cahoot.com*
  • *tuxedomoney.com*
  • http*://*alliance-leicester.co.uk*
  • http*://*cbonline.co.uk*
  • http*://*co-operativebank.co.uk*
  • http*://*smile.co.uk*
  • http*halifax-online.co.uk/**/
  • https://cardservicing.tescofinance.com/RBSG_Consumer/UserLogin.do*
  • https://cardservicing.tescofinance.com/RBSG_Consumer/VerifyLogin.do*
  • https://database.acornmediauk.com/*
  • https://ibank.cahoot.com/*
  • https://my.if.com/_mem_bin/formslogin.asp*
  • https://online.islamic-bank.com/online/aspscripts/secretenter.asp*
  • https://secure.ingdirect.co.uk/InitialINGDirect.html*
  • https://secure.natweststockbrokers.co.uk/nws-secure2/*
  • https://service.oneaccount.com/*/OSV2?event=login&pt=3
  • https://uk.virginmoney.com/virgin/service/credit-card/*
  • https://welcome23.smile.co.uk/SmileWeb/*
  • https://welcome23.smile.co.uk/SmileWeb/passcode.do
  • https://welcome27.co-operativebank.co.uk/CBIBSWeb/*
  • https://welcome27.co-operativebank.co.uk/CBIBSWeb/passcode.do
  • https://www.accessmycardonline.com/RBS_Consumer/*
  • https://www.barclayswealth.com/login/action/logon/unauthenticated/personal/loginDetailsNotStored
  • https://www.barclayswealth.com/login/action/logon/unauthenticated/personal/loginSigning
  • https://www.caterallenonline.co.uk/WebAccess.dll
  • https://www.edirectdebit.com/administration/client/logon.aspx
  • https://www.mybusinessbank.co.uk/cs70_banking/*
  • https://www.mybusinessbank.co.uk/cs70_banking/logon*
  • https://www.mybusinessbank.co.uk/cs70_banking/logon/challenge/submit
  • https://www.mybusinessbank.co.uk/cs70_banking/logon/logon/enrollPassword
  • https://www.mybusinessbank.co.uk/cs70_banking/logon/logon/password
  • https://www.mybusinessbank.co.uk/cs70_banking/logon/logon/pmPassword
  • https://www.mybusinessbank.co.uk/cs70_banking/logon/sbuser/getPassword
  • https://www.nochex.com/*
  • https://www.offshore.hsbc.com/1/2/!ut/p/kcxml/*
  • https://www.offshore.hsbc.com/1/2/idv.Authentication

Targeted Institutions:

  • Acorn Media
  • Alliance & Leicester
  • Banco Santander
  • Barclays
  • Cahoot Bank
  • Cater Allen Online
  • Clydesdale Bank
  • Co-operative Bank
  • E-Direct Debit
  • First Direct
  • Halifax
  • HSBC UK
  • Islamic Bank
  • My Business Bank
  • Natwest
  • Nochex
  • Royal Bank of Scotland
  • Tesco Finance
  • Virgin Money UK

*Note that the contents of the configuration file may change anytime.

By means of the hooked APIs, it is capable of monitoring the user's online banking transactions. It can also obtain personal certificates through the modified PFXImportCertStore API. Grabbed certificates are stored in the following format:

  • certs\{computername}|{username}\grabbed_dd_mm_yyyy.pfx

In addition, it can also obtain email addresses by hooking WSASend and send APIs and by checking the Windows Address Book (WAB) and MS Outlook files.

It may also get stored passwords in the following registry locations:

HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\Active Directory GC

HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\Bigfoot

HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\VeriSign

HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\WhoWhere

All gathered information are then saved and encrypted to the following file, and sent later on to its server:

  • %Application Data%\{random2}\{random}.{random}

Other Details

It checks if the running process is its dropped copy. If not, it will terminate and delete itself by creating and executing a batch file:

  • %User Temp%\tmp{random}.bat

This batch file is also deleted afterwards.

Solution


Minimum scan engine: 8.900
First VSAPI Pattern File: 8.388.05
First VSAPI Pattern Release Date: 29 Aug 2011
VSAPI OPR Pattern Version: 8.389.00
VSAPI OPR Pattern Release Date: 29 Aug 2011

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Scan your computer with your Trend Micro product and note files detected as TSPY_ICEIX.A

Step 3

Restart in Safe Mode

[ Learn more ]

Step 4

Delete this registry value

[ Learn more ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.


  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • {35D54A61-7071-B7F6-1D93-58D85F80CF3F} = "%Application Data%\{random1}\{random}.exe"
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\
    Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    • C:\WINDOWS\explorer.exe = "C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer"

Step 5

Restore this modified registry value

[ Learn more ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\0
    • From: 1609 = "0"
      To: 1609 = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\1
    • From: 1406 = "0"
      To: 1406 = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\1
    • From: 1609 = "0"
      To: 1609 = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\2
    • From: 1609 = "0"
      To: 1609 = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\3
    • From: 1406 = "0"
      To: 1406 = "3"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\3
    • From: 1609 = "0"
      To: 1609 = "1"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\4
    • From: 1406 = "0"
      To: 1406 = "3"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\Zones\4
    • From: 1609 = "0"
      To: 1609 = "1"

Step 6

Search and delete this file

[ Learn more ]
There may be some component files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden files and folders in the search result.
  • %Application Data%\{random2}\{random}.{random}

Step 7

Search and delete these folders

[ Learn more ]
Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.
  • %Application Data%\{random1}
  • %Application Data%\{random2}

Step 8

Restart in normal mode and scan your computer with your Trend Micro product for files detected as TSPY_ICEIX.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.
Analysis By: Roland Marco Dela Paz

Connect with us on