Overview

overview

10

Static

static

10

270fd257de...JC.exe

windows7-x64

10

270fd257de...JC.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    270fd257def1780071002c3eb4149286_icedid_xmrig_JC.exe

  • Size

    7.0MB

  • Sample

    230818-qy7tfsaa35

  • MD5

    270fd257def1780071002c3eb4149286

  • SHA1

    e73324343caec5b5808e1b53981006ff0a6a4e73

  • SHA256

    ca6d671bdeef69ecf730789f7fecf38ea132453b515c88aee006ba73e69e04b6

  • SHA512

    93fcb90386a999d14eabf064c5000d83853f688b3c565c1ceadd26c6fbfa8563f62c3b4e4b2226c7e623666b8080938f0648a5991fd3437680dd64e24198fd31

  • SSDEEP

    98304:dvfapmo1Y4+6Y7SOEfX/SbgR/ZPYtWJy9iIua3ziPLAmFIunLq0oAaldmdmnpip:da9+6Y7SOEibgR/8buaDiGujKmd0Ap

Score
10/10
blackmoonxmrigbankerevasionminerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      270fd257def1780071002c3eb4149286_icedid_xmrig_JC.exe

    • Size

      7.0MB

    • MD5

      270fd257def1780071002c3eb4149286

    • SHA1

      e73324343caec5b5808e1b53981006ff0a6a4e73

    • SHA256

      ca6d671bdeef69ecf730789f7fecf38ea132453b515c88aee006ba73e69e04b6

    • SHA512

      93fcb90386a999d14eabf064c5000d83853f688b3c565c1ceadd26c6fbfa8563f62c3b4e4b2226c7e623666b8080938f0648a5991fd3437680dd64e24198fd31

    • SSDEEP

      98304:dvfapmo1Y4+6Y7SOEfX/SbgR/ZPYtWJy9iIua3ziPLAmFIunLq0oAaldmdmnpip:da9+6Y7SOEibgR/8buaDiGujKmd0Ap

    Score
    10/10
    blackmoonxmrigbankerevasionminerpersistencespywarestealertrojan

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • UAC bypass

      evasiontrojan

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks