Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2024, 22:42
Behavioral task
behavioral1
Sample
2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe
Resource
win7-20240903-en
General
-
Target
2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe
-
Size
4.2MB
-
MD5
fb1e670df521315c4c7f6875a6bbedd0
-
SHA1
4499c71b57951a7add1649a5ee6031e8a2aacb12
-
SHA256
e384bc77d95c91a446821a738b61c7f2d2c6e9bee219e54acaa6b4121e40d2c0
-
SHA512
ca2f5cf1bae79977b6e2974b844da814097b9e4c83c045997fed05cdfaca81247d873b1f62562636aaee10193eb689aa08149eefade58f046653c3dc7f25bfe9
-
SSDEEP
98304:dvfapmo1Y4+6Y7SOEfX/SbgRlL8IuBK+JL:da9+6Y7SOEibgRHuE+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/2236-0-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon behavioral2/files/0x0002000000022996-66.dat family_blackmoon -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe -
Xmrig family
-
XMRig Miner payload 17 IoCs
resource yara_rule behavioral2/memory/2236-0-0x0000000000400000-0x0000000000613000-memory.dmp xmrig behavioral2/files/0x0007000000023c94-7.dat xmrig behavioral2/files/0x0002000000022996-66.dat xmrig behavioral2/memory/1016-387-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1016-389-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1016-392-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1016-410-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1016-419-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1016-421-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1016-456-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1016-528-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1016-529-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1016-530-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1016-531-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1016-532-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1016-533-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1016-534-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe" 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe" 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe" 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe" 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe" 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe" 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe -
Executes dropped EXE 1 IoCs
pid Process 1016 svchost.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe" 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsutil.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\instnm.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\net.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\RMActivate.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\RpcPing.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\xwizard.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\autochk.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\userinit.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\wscript.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\cmdkey.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\dialer.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\fontview.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\SndVol.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\findstr.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\help.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\typeperf.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\net1.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\secinit.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\TSTheme.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\dtdump.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\fltMC.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\ndadmin.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\chkntfs.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\cmmon32.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\find.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\raserver.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\replace.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\rundll32.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\ktmutil.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\msiexec.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\runonce.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\schtasks.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\stordiag.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\taskkill.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\tracerpt.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\ttdinject.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\cmstp.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\eudcedit.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\nslookup.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\odbcad32.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\RdpSa.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\credwiz.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SysWOW64\dvdplay.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseHostPage.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\WebviewOffline.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_80171\javaws.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\whatsnewsrc\bulletin_board.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\accessibilitychecker\index.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\WebviewOffline.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.19041.1_none_e0dec3877978d84a\mscorsvw.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.19041.746_none_f47187f881cbaf7d\r\sihost.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\r\UNPUXHost.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\r\XblGameSaveTask.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1202_none_fef803c70cc0b37b\f\SettingSyncHost.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\f\LaunchTM.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\pdferrorunknownerror.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\memoryAnalyzer.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\pdferrorofflineaccessdenied.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\f\ChtIME.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\f\FileExplorer.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.19041.746_none_5cc81a54cf095c95\f\EASPolicyManagerBrokerHost.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.19041.844_none_77a5d9aafae08e77\f\MDMAppInstaller.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\servbusy.htm 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\DisableAboutFlag.htm 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.19041.423_none_d8a242bf396f7d4d\r\SpaceAgent.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\404-4.htm 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\defaultbrowser.htm 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3594628932065f23\r\wevtutil.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.19041.1_none_f69c49e870acf520\ddodiag.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.746_none_b60bd945ca2276e4\f\IEChooser.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\404-12.htm 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.19041.1_none_258f6f31a16a0eac\DevicePairingWizard.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.19041.906_none_5f45625010b4cd19\InetMgr6.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15805.0_none_f0aa60ae9c531752\CasPol.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-clip_31bf3856ad364e35_10.0.19041.1_none_682199f2efbfb806\clip.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_5163f0069562aff6\r\powershell.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\RetailDemo\retailDemoSecurityInclusive.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\unknownprotocol.htm 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\404-6.htm 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_092d70d1898e5ff9\f\DismHost.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\TextInputHost.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\f\SgrmBroker.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\needhvsi.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.19041.1_none_4e5e653d48e95632\wextract.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\main.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.264_none_b435e08254cda322\f\printui.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc_winmgmt.exe_8f8eb7b1 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobeoemregistration-main.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\view\common-listview-template.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1_none_14f1e9e91239944a\MdmDiagnosticsTool.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_171488549e32a4d3\diskperf.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_ac2441dbb712f006\msra.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..tofservice-oposhost_31bf3856ad364e35_10.0.19041.1_none_3d1291badd9e7f22\OposHost.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.19041.1_none_6568d39003c9a6d5\TieringEngineService.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.19041.1_none_a6a8b89bc50eae31\cvtres.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobeoutro-main.html 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\BlockSite.htm 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.19041.1_none_075470a68fcfb411\umount.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.19041.746_none_f7c1402f08d2457a\f\mmc.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\x86_microsoft-windows-b..onment-dvd-etfsboot_31bf3856ad364e35_10.0.19041.1_none_dc4e5ab15169832e\etfsboot.com 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.19041.1_none_4c7da197e5837576\dtdump.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\PhishSiteEdge.htm 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\WpcBlockFrame.htm 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\SpeechRuntime.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.264_none_c765d8a6c76ec25f\r\DataExchangeHost.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.19041.1_none_389cd5270341e0a8\regsvr32.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_ccf6cb6d0aa9a822\r\mstsc.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_regasm_b03f5f7f11d50a3a_4.0.15805.0_none_9be7d950c1f8addd\RegAsm.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.19041.1_none_ad39955b83a3f25f\SystemPropertiesAdvanced.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..appserver-licensing_31bf3856ad364e35_10.0.19041.746_none_84af66409a2cad45\tlsbln.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.19041.1_none_5efb81c4b092852b\cvtres.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.19041.1_none_3ce17495646dbeaa\AppHostRegistrationVerifier.exe 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2236 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe Token: 33 2236 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe Token: SeIncBasePriorityPrivilege 2236 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe Token: SeIncBasePriorityPrivilege 1016 svchost.exe Token: SeLockMemoryPrivilege 1016 svchost.exe Token: SeLockMemoryPrivilege 1016 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2236 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1016 2236 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe 84 PID 2236 wrote to memory of 1016 2236 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe 84 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-02_fb1e670df521315c4c7f6875a6bbedd0_cobalt-strike_icedid_xmrig.exe"1⤵
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2236 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1016
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD50f7a8a6ef72805d2501eeb4eb543104f
SHA1291ba17fa02a80a1300c6e983bf2e7d9d0bea62a
SHA25667ff9144b28cf7ba1c18bc0e362ddbb5dab72fdb74874445be6f1001d1a46f60
SHA5120d064bd1f09b80d515aee252d876970a7fd7c2cf8afd55b47a408bd4f7960e9cd9ab433bced33a13c60f53ad6de6419e3457bc9decdc026ec383de72930307d5
-
Filesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
Filesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
Filesize
81KB
MD5fe34ca7c069698caddc76e95d7f3c2a5
SHA1facfeb0b2fd090c323ab8ca5671eb0cddb8eaad9
SHA25691a2f515ffb47ad040ae21c167d408b71f380835419edd9af496c2adc82f6486
SHA512b1f3ae75915309537caa0c52fee3a459f0f9324e0d148fc745d6250fb54ef4d92d65bd61b5698648435c5e7c401adb64eb835cac3c1ad8e8b8fb1db276c6628a