Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28-01-2024 19:48
Behavioral task
behavioral1
Sample
2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe
Resource
win7-20231215-en
windows7-x64
18 signatures
150 seconds
General
-
Target
2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe
-
Size
31.1MB
-
MD5
6f474b7399d12f4b728d53fddd9c8998
-
SHA1
fa1b4848320652cb35bdf00e13e93ffca463821e
-
SHA256
c44c590e1ffd7ee93d2c08c4a39981ba311a9949fb652f24d09dccc8a0d2ca16
-
SHA512
9777a9b390131189d8e6de38a2d87f49ee98a3e70a7fbd71d92c940ba110f1458cfabd3ba6cedd184e4dd01c52f3caf44463e07f1b4bebbba2d0e5707a28235c
-
SSDEEP
393216:dFgRavDllryzuhiQfKWiGo0PqbsBDT6t7:zvDllry2Lz56h
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral1/memory/1836-0-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon behavioral1/files/0x0001000000011cac-13.dat family_blackmoon -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
XMRig Miner payload 17 IoCs
resource yara_rule behavioral1/memory/1836-0-0x0000000000400000-0x0000000000613000-memory.dmp xmrig behavioral1/files/0x000900000001225c-7.dat xmrig behavioral1/files/0x0001000000011cac-13.dat xmrig behavioral1/memory/2788-47-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2788-92-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2788-127-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2788-170-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2788-203-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2788-241-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2788-275-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2788-293-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2788-341-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2788-351-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2788-352-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2788-353-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2788-354-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2788-355-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
Executes dropped EXE 1 IoCs
pid Process 2788 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fixmapi.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\net.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\typeperf.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\unregmp2.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\svchost.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\compact.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\msiexec.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\setupSNK.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\SndVol.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\poqexec.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\psr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\sdbinst.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\taskmgr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\WerFault.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\wevtutil.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\esentutl.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\eventvwr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\netsh.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\print.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\regsvr32.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\secinit.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\sxstrace.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\certutil.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\label.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\tracerpt.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\winrs.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\bootcfg.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\dvdplay.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\timeout.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcmf.inf_amd64_neutral_67b5984f8e8ff717\BrmfRsmg.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\BrmfRsmg.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\ipconfig.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\mfpmp.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\powercfg.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\systeminfo.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\eudcedit.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\gpupdate.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\OptionalFeatures.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\convert.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\drvinst.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\xlog.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\rundll32.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\runonce.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\wusa.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDADM.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\cttune.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\forfiles.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\mstsc.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\migwiz\mighost.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\extrac32.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\hh.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\iexpress.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\wermgr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Media Player\WMPDMC.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\Windows Mail\wab.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\Windows Media Player\WMPSideShowGadget.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ehome\Mcx2Prov.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.17514_none_c75e9c99a36a285a\winload.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-getmac_31bf3856ad364e35_6.1.7600.16385_none_67f38861bbac1910\getmac.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_6.1.7600.16385_none_94861149bb66249c\powershell_ise.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_11.2.9600.16428_none_e410f56f6c4ee930\ConfigureIEOptionalComponents.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_6.1.7600.16385_none_b65cdbcf116dd7c5\WMSvc.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-irftp_31bf3856ad364e35_6.1.7600.16385_none_b2af329397f29f60\irftp.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_6.1.7600.16385_none_1cc9274696810e2f\wevtutil.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..cationnotifications_31bf3856ad364e35_6.1.7600.16385_none_737951ab23cf8ea0\LocationNotifications.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_aspnet_compiler_b03f5f7f11d50a3a_6.1.7600.16385_none_a5a135380060b978\aspnet_compiler.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-devices-mcx2prov_31bf3856ad364e35_6.1.7600.16385_none_3482237b32c1daff\Mcx2Prov.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_244ae8599e6d81bb\hh.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\MSBuild\b93c627ec2e15c2675bcc81edafb10be\MSBuild.ni.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_infocard_b77a5c561934e089_6.1.7601.17514_none_583a8c60c0b305a1\infocard.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\Speech\Common\sapisvr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_6.1.7601.17514_none_0a026c46104dd379\msinfo32.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..e-managed-regmceapp_31bf3856ad364e35_6.1.7600.16385_none_b13a0967547ecab4\RegisterMCEApp.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..lepc-mobilitycenter_31bf3856ad364e35_6.1.7601.17514_none_b8bffa4921e2a435\mblctr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\ehome\ehrec.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gettingstarted_31bf3856ad364e35_6.1.7600.16385_none_dc7256ed0ded6c12\GettingStarted.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_6.1.7600.16385_none_8945930a7d61b9f0\MigRegDB.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_6.1.7600.16385_none_d63cc4dd74a11d0b\DpiScaling.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.17514_none_b57215bac8c6d647\appidpolicyconverter.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_6.1.7600.16385_none_5da314d233bb2676\dvdplay.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_6.1.7600.16385_none_9db1ae483049e160\EhStorAuthn.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-client_31bf3856ad364e35_6.1.7600.16385_none_c80d81c947c7b794\HelpPane.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\SMSvcHost\04d794428d635f6a82ac57dd3d6f3628\SMSvcHost.ni.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-cipher_31bf3856ad364e35_6.1.7600.16385_none_090b7101bec9a9e2\cipher.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\ComSvcConfig\9a69a26417a09c2d9d7f67bf7592bd74\ComSvcConfig.ni.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\Boot\PCAT\memtest.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Windows\config.json 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\twunk_32.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bth-user_31bf3856ad364e35_6.1.7601.17514_none_c33f455aebcd9dbb\bthudtask.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-directx-directplay8_31bf3856ad364e35_6.1.7601.17514_none_d6fc8d83d55eb77c\dpnsvr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_8.0.7600.16385_none_7d25450501edb94f\ielowutil.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_6.1.7601.17514_none_d4c5c995fb3f4a1b\audiodg.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..pwindowmanager-core_31bf3856ad364e35_6.1.7601.17514_none_ebc99983d3d18578\dwm.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\migwiz.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_6.1.7601.17514_none_e46b048a01806891\msinfo32.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\dfsvc.ni.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\cagicon.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_8.0.7600.16385_none_d009281f9a108e04\mshta.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-isoburn_31bf3856ad364e35_6.1.7601.17514_none_4458ac8eafdacbdd\isoburn.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_divacx64.inf_31bf3856ad364e35_6.1.7600.16385_none_cf37cc4c5bc25dc7\xlog.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_6.1.7601.17514_none_c3b917fd89d834f3\LogonUI.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_6.1.7601.17514_none_7920b60d569a4a1e\wmlaunch.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1836 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Token: 33 1836 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Token: SeIncBasePriorityPrivilege 1836 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Token: SeIncBasePriorityPrivilege 2788 svchost.exe Token: SeLockMemoryPrivilege 2788 svchost.exe Token: SeLockMemoryPrivilege 2788 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1836 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1836 wrote to memory of 2788 1836 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe 28 PID 1836 wrote to memory of 2788 1836 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe 28 PID 1836 wrote to memory of 2788 1836 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe 28 PID 1836 wrote to memory of 2788 1836 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe 28 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1836 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31.7MB
MD59fe06fca72c9564112690276da8103ef
SHA1a4b0e56c5b8b3d26652498c47fd99b779d486ee2
SHA2567d68989eace1b80f5213f7afd47f136487c661dbd42ba0f0a07325665bf96c5b
SHA51253e88745425320bd737b7122ea0ab60dff4daf21634862b1fff970edf780927676b60599614c2c6aa67d2a65a43013dd0e9edc8e5bc1dbdfc0e53fb41aa70655
-
Filesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
Filesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594