General
-
Target
2024-10-26_b8c9c2ad4604ab6f3d53e4a879a81e25_hijackloader_icedid_xmrig
-
Size
10.1MB
-
Sample
241026-dqg7lszfkp
-
MD5
b8c9c2ad4604ab6f3d53e4a879a81e25
-
SHA1
a115f993a38e395100501faa8b68d6551dc6d2b5
-
SHA256
158dcdd9a3cf63e115a1e0855a422f7f526b62774636c55b5ce77589564ed247
-
SHA512
ac6f873766cc1e43c04bc845548610bdd06e91c140bc86de66f1c00c7a11b148718b8cd3d4785842cbc4520e02b6d9f54ca25bd4feff6f721e190c5dde023375
-
SSDEEP
196608:da9+6Y7SOEibgR/DiFVNi+rKmd0TcIUDXn:dFgR7ijNi+GqB9X
Behavioral task
behavioral1
Sample
2024-10-26_b8c9c2ad4604ab6f3d53e4a879a81e25_hijackloader_icedid_xmrig.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
2024-10-26_b8c9c2ad4604ab6f3d53e4a879a81e25_hijackloader_icedid_xmrig
-
Size
10.1MB
-
MD5
b8c9c2ad4604ab6f3d53e4a879a81e25
-
SHA1
a115f993a38e395100501faa8b68d6551dc6d2b5
-
SHA256
158dcdd9a3cf63e115a1e0855a422f7f526b62774636c55b5ce77589564ed247
-
SHA512
ac6f873766cc1e43c04bc845548610bdd06e91c140bc86de66f1c00c7a11b148718b8cd3d4785842cbc4520e02b6d9f54ca25bd4feff6f721e190c5dde023375
-
SSDEEP
196608:da9+6Y7SOEibgR/DiFVNi+rKmd0TcIUDXn:dFgR7ijNi+GqB9X
-
Blackmoon family
-
Detect Blackmoon payload
-
Xmrig family
-
XMRig Miner payload
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1