General
-
Target
2024-10-30_06b67cc52aac9760dd6c080cb5cb66a1_icedid_xmrig
-
Size
28.4MB
-
Sample
241030-2d2x9a1mbt
-
MD5
06b67cc52aac9760dd6c080cb5cb66a1
-
SHA1
c18bd2341c3cc71cf553fe07f5ade591e5d4b9f2
-
SHA256
02003aaf5590a8ddc8245b201325af5355f88cc64a5b29e5522a79bcf5fa5275
-
SHA512
35e13d7a3846719d427cbece9836627d9ca7e6f10d81a67999bac90d0517b69f5da5c27146e98921ee5819f997853665d956d837b194be4a3b8c24fe885dfaea
-
SSDEEP
393216:dFgR7ijN75MiBcFgR7ijN75MiBwR6ozb1ZbMrB8LwL4Pkq6EmeyDv9f:giB75MqxiB75Mqw8+n88LwLDqDm7Dv
Behavioral task
behavioral1
Sample
2024-10-30_06b67cc52aac9760dd6c080cb5cb66a1_icedid_xmrig.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
2024-10-30_06b67cc52aac9760dd6c080cb5cb66a1_icedid_xmrig
-
Size
28.4MB
-
MD5
06b67cc52aac9760dd6c080cb5cb66a1
-
SHA1
c18bd2341c3cc71cf553fe07f5ade591e5d4b9f2
-
SHA256
02003aaf5590a8ddc8245b201325af5355f88cc64a5b29e5522a79bcf5fa5275
-
SHA512
35e13d7a3846719d427cbece9836627d9ca7e6f10d81a67999bac90d0517b69f5da5c27146e98921ee5819f997853665d956d837b194be4a3b8c24fe885dfaea
-
SSDEEP
393216:dFgR7ijN75MiBcFgR7ijN75MiBwR6ozb1ZbMrB8LwL4Pkq6EmeyDv9f:giB75MqxiB75Mqw8+n88LwLDqDm7Dv
-
Blackmoon family
-
Detect Blackmoon payload
-
Xmrig family
-
XMRig Miner payload
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1