Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 00:50
Behavioral task
behavioral1
Sample
2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe
Resource
win7-20241010-en
General
-
Target
2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe
-
Size
3.3MB
-
MD5
60d12470541f91c468f0c74760267b1e
-
SHA1
e74956caba23f9e7d171a421cdc035da218618df
-
SHA256
fd9bbab162ab8e16c4101ed24d2a53060aa44d71d02f97f0e7a40de6d78c79ae
-
SHA512
cbb34d5804bff8102a7154058246d078d502b1d9ee48220865398d4ba31ff8d9303610df36b9b9e8ff20849b357104d68d63004037e5b340a9a43d9f0b37c43f
-
SSDEEP
98304:dvfapmo1Y4+6Y7SOEfX/SbgRya1ZPYtVWClcIuj:da9+6Y7SOEibgR/auj
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral1/memory/2568-0-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon behavioral1/files/0x0001000000011c9e-13.dat family_blackmoon -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe -
Xmrig family
-
XMRig Miner payload 17 IoCs
resource yara_rule behavioral1/memory/2568-0-0x0000000000400000-0x0000000000613000-memory.dmp xmrig behavioral1/files/0x000700000001938e-6.dat xmrig behavioral1/files/0x0001000000011c9e-13.dat xmrig behavioral1/memory/2560-339-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2560-362-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2560-383-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2560-384-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2560-385-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2560-495-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2560-745-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2560-746-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2560-747-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2560-748-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2560-749-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2560-750-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2560-751-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2560-752-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe" 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe" 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe" 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe" 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe" 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe" 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe -
Executes dropped EXE 1 IoCs
pid Process 2560 svchost.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe" 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\gpupdate.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\regsvr32.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\svchost.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\wimserv.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\xcopy.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\autofmt.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\bootcfg.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\DeviceProperties.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\dpapimig.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\w32tm.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\wuapp.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\msdt.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\newdev.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\resmon.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\Robocopy.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\ssText3d.scr 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\eudcedit.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\fontview.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\sbunattend.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\whoami.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\diskcomp.com 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\autoconv.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\cacls.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\perfmon.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\AtBroker.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\instnm.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_neutral_e54666f6a3e5af91\fsquirt.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\winver.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\chkntfs.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\clip.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\diskperf.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\gpresult.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\rasdial.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\winrshost.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\dialer.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\dllhost.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\msinfo32.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\systeminfo.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\wextract.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\attrib.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\takeown.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\wevtutil.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDADM.EXE 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDSVR.EXE 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\dfrgui.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\nslookup.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\sc.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\waitfor.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\SysWOW64\wlanext.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPrintTemplate.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\weather.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\settings.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\README.HTM 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPrintTemplate.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplateRTL.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\cpu.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\RSSFeeds.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsColorChart.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files\Windows Defender\MSASCui.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files\Windows Journal\Journal.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\settings.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\weather.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePage.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBlankPage.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewTemplate.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\settings.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\slideShow.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Hand Prints.htm 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\flyout.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Mail\WinMail.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\loadmxf.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_6.1.7601.17514_none_fb3795fb0be32033\WUDFHost.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_6.1.7601.17514_none_71c62979c253e895\RMActivate_ssp.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-17.htm 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_6.1.7600.16385_none_e3aea9874278550c\cofire.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-format_31bf3856ad364e35_6.1.7600.16385_none_827dd459a3aa9980\format.com 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_29b7ce69634b90ae\settings.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_59e6a839753b16d1\RSSFeeds.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4d6aa30008b38d10\cpu.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winver_31bf3856ad364e35_6.1.7600.16385_none_12466fe3b629e036\winver.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\shrpubw.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-13.htm 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-19.htm 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\appcmd.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-soundrecorder_31bf3856ad364e35_6.1.7601.17514_none_fd2f4b124982e400\SoundRecorder.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_6.1.7600.16385_none_a6c7190f7292676c\scrcons.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-international-core_31bf3856ad364e35_6.1.7600.16385_none_459f562ff37206dd_muiunattend.exe_1e11bb40 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\wow64_microsoft-windows-tcpip_31bf3856ad364e35_6.1.7601.17514_none_ca00459dda59f6f4\netiougc.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_6.1.7600.16385_none_2b1523604c99c736\sfc.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_wpf-xamlviewer_31bf3856ad364e35_6.1.7600.16385_none_55e4a2a4de407800\XamlViewer_v0300.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_729fe3c3da2c920c\web.config.comments 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-certutil_31bf3856ad364e35_6.1.7600.16385_none_1179f9944d0d9973\certutil.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.17932_none_d26a33ec18cb49c4\conhost.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-dpapi-keys_31bf3856ad364e35_6.1.7600.16385_none_7da9291f2ec46948\dpapimig.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-netsh_31bf3856ad364e35_6.1.7600.16385_none_5f774c61592c67c3\netsh.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_6.1.7601.17514_none_f06adab455a2f1e9\WMPDMC.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_en-us_92dafd34e62c3942\settings.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\403-18.htm 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\403.htm 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_6.1.7601.17514_none_d71fb1d63f05ef22\WFS.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-optionalfeatures_31bf3856ad364e35_6.1.7600.16385_none_663d506d4f028574\OptionalFeatures.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9c4da920e2047ffc\settings.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad_unlodctr.exe_69df45bb 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_6.1.7600.16385_none_77536d124094b997\TpmInit.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d93f349420c7d013\weather.html 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_6.1.7601.17514_none_1457169844ae9574\msinfo32.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_6.1.7601.17514_none_b656fd566c17dc3a\mstsc.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\wow64_microsoft-windows-tapicore_31bf3856ad364e35_6.1.7600.16385_none_4a83748394a862f9\dialer.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\diskperf.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-runonce_31bf3856ad364e35_6.1.7601.17514_none_17c23e881d4a0b0b\runonce.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-4.htm 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_9da1b3254ff796e9\msra.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-isoburn_31bf3856ad364e35_6.1.7601.17514_none_e83a110af77d5aa7\isoburn.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\404-11.htm 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\ehExtHost\ad37b6e3a1cb1081592f1c5797ae9dad\ehExtHost.ni.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-services-ehrecvr_31bf3856ad364e35_6.1.7601.17514_none_1b8f8373383de46a\ehrecvr.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_6.1.7600.16385_none_7861b83567d966e6\ksetup.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_c8df7823424473a1_netbtugc.exe_825f4f74 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_6.1.7601.17514_none_f1fca1ab90570e8a\MdSched.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.1.7601.17514_none_c910d80f114e267a\vds.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\NETSTAT.EXE 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_6.1.7601.17514_none_eb5947ea4debcf36\RMActivate_isv.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_21ceb2d66a98ec2f\mofcomp.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_6.1.7600.16385_none_3020274b22e8a90f\help.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-osk_31bf3856ad364e35_6.1.7600.16385_none_06b1c513739fb828\osk.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_6.1.7601.17514_none_4777e36e0649406c\RMActivate_isv.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_6.1.7601.17514_none_d9bafd47cdf9833b\WinSAT.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17514_none_b94cbfa183466a89_winresume.exe_85cd1215 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_6.1.7600.16385_none_9cef76e6ecab612f\SystemPropertiesHardware.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_2e9f92abd2ce43b6\hh.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\x86_microsoft-windows-ddodiag_31bf3856ad364e35_6.1.7600.16385_none_362ce835fe42421b\ddodiag.exe 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\500-19.htm 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2568 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe Token: 33 2568 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe Token: SeIncBasePriorityPrivilege 2568 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe Token: SeIncBasePriorityPrivilege 2560 svchost.exe Token: SeLockMemoryPrivilege 2560 svchost.exe Token: SeLockMemoryPrivilege 2560 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2568 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2560 2568 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe 30 PID 2568 wrote to memory of 2560 2568 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe 30 PID 2568 wrote to memory of 2560 2568 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe 30 PID 2568 wrote to memory of 2560 2568 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe 30 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-24_60d12470541f91c468f0c74760267b1e_icedid_xmrig.exe"1⤵
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2568 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
MD50c5d6ef0ab6c7438f1d7e997d771768a
SHA1568772791f12317845541d9a95d8378295e98793
SHA2567f5ace8335c9af550a75339860abb18022b1c90b57d354878709783370afe080
SHA512875f9ae83964fa4bf00cf2a433fe4a4243600f059666b0b63f3aa91e99f2cdb21bf03e26f0faa5a4521cda6108784db28fbd3ca2cfb8e32d0b7c50d6ef2440b3
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html
Filesize16KB
MD5ed1191da9c4f74a60d695a25686f374e
SHA13a427657c16a716be332587425101653c25221d0
SHA256ab8cafd1958c27d70adc747259495e35592f8a06ae00969964f5f34f72896f3f
SHA51268098c1342f87939b3f57cd3e3a799ff316d2f1eb5c52f8d9c0c9e7c214281bff68a1260a91527b7175ad031798f42125cf9ee2e0d49772eb03b5836b67d9fbf
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html
Filesize6KB
MD5657eb3527d651515f97b960a67d19fda
SHA127404b587183bc2f3b3b6919fbb91892f505b60d
SHA256f301745232a72d84f277980ad53b65d94b02479369e8b73fe0e6717adcf11a35
SHA5121085550a8844de081a216bd864990e56fbe91498fb6186cce435173ab73e29932e7b8182078cd2876039addbdb7e3c9769d7d7923f7ed2a5422e6a2a36321b70
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html
Filesize12KB
MD5cdea5d1cccee27144519c75bcf3015bd
SHA1c36862abb1ada006b3dd4c28adc8b393a92fd325
SHA2561184f2316c36648a2d457b602c713d5d5eb980e86e5e8ed388e94a47f8573dbd
SHA5125d0ea1cef2af7111098c19578c42bfdfd7bb00ec3259fe026df6dd867a24f9a94f3299b035235e3cb87b1c9010f0d1be434a08318dae0412e03ecfdb439edfe9
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html
Filesize9KB
MD5bc3e199345ad8ba54e2fe4acad95433d
SHA1c93cb69c27e1c03069de3c952534a52f391e3fb9
SHA256462c197c83ee3d677b07fe000b2c4e64ac4be4ceaaea80c1c77a5e67d832edd8
SHA512c1941c9106ff0d665dfee1888afcdc3c54e4db8fdb11e3313cd92a147a1084264dba8f1f9cbac5216d3c5ce1f97ff7f8d7d7493826ec3538d5db57a933fe32e4
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html
Filesize14KB
MD559e4add1732aef6b8e228ecfb880c299
SHA131a6380e878f89ec9d2c83716fe42faafdd828db
SHA256089aaccbf4c17d2a0163f13820e926f8ce3122c9ed87e7e040a77439795b8fc4
SHA512461240638f98f92a0df94a6a76470d7ed3a9bf45f845b545ff37355efd4fb3efdbe592e563b6624d2e42374a3bf7682a572c3bfd96c21be87fc96ec3b3bcfbaf
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html
Filesize16KB
MD526986f79440b7a706b65724e509f009f
SHA19d8ff0beef1c19fbecd28e3f632101acf3d02599
SHA256e59b7fa34b947d5ada478ff17543204251955052fdace284e5a285bd2abec5d1
SHA5122c240c4f7b8912bd5049bef22c2507c7c1af15432c860549d0f1ea35f03183270eb7315607fdf35be86703a61ec0ed7801e9e6ea627a026dbf93d98ff11d2ed6
-
Filesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
Filesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
Filesize
82KB
MD5dd647159633a47107f56e22baa839088
SHA1d68351acf39307e39a74e9d5d4c2ad4a5aa15d16
SHA2568c5f9b5496d7da27b7ccbda06276a50946b398747755f2cb03ad8e2d51ca2812
SHA512f345c310e76d4fa7b41d18df49860d9dcf25afa1541396baf2a8847864a54b8c4192817f16ca2fa6b8a9121afc8495fa11b0263824e89749b001dd2bf7152deb