General
-
Target
2024-11-09_a9c0a80e6d5673ed01e724e8e7d54cd6_icedid_xmrig
-
Size
6.5MB
-
Sample
241109-f667saxqfw
-
MD5
a9c0a80e6d5673ed01e724e8e7d54cd6
-
SHA1
2a1b2319721796dba270daf077a0ec1503ca8eca
-
SHA256
5ad9e4b8ac46fb6df35a4d12ab1a5f13db8657a68e4615b70c4b8b6c40a96e3a
-
SHA512
13e25f216e05aa2d092589a49606ab1b49f874da336208008008a1eb4054f615473070740e3806e29679ef921d66a3ebd9e5699250611b51cf1cce375772050c
-
SSDEEP
98304:dvfapmo1Y4+6Y7SOEfX/SbgR/aEK+JLl7CCF/zWqjbdxMMgMMTGgh0Jg1QOeR:da9+6Y7SOEibgR8+T3b7gh8
Behavioral task
behavioral1
Sample
2024-11-09_a9c0a80e6d5673ed01e724e8e7d54cd6_icedid_xmrig.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
2024-11-09_a9c0a80e6d5673ed01e724e8e7d54cd6_icedid_xmrig
-
Size
6.5MB
-
MD5
a9c0a80e6d5673ed01e724e8e7d54cd6
-
SHA1
2a1b2319721796dba270daf077a0ec1503ca8eca
-
SHA256
5ad9e4b8ac46fb6df35a4d12ab1a5f13db8657a68e4615b70c4b8b6c40a96e3a
-
SHA512
13e25f216e05aa2d092589a49606ab1b49f874da336208008008a1eb4054f615473070740e3806e29679ef921d66a3ebd9e5699250611b51cf1cce375772050c
-
SSDEEP
98304:dvfapmo1Y4+6Y7SOEfX/SbgR/aEK+JLl7CCF/zWqjbdxMMgMMTGgh0Jg1QOeR:da9+6Y7SOEibgR8+T3b7gh8
-
Blackmoon family
-
Detect Blackmoon payload
-
Xmrig family
-
XMRig Miner payload
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1