General

  • Target

    2024-11-10_fd49dd90e48679be4135c430d2df640c_icedid_xmrig

  • Size

    5.3MB

  • Sample

    241110-hp816ascla

  • MD5

    fd49dd90e48679be4135c430d2df640c

  • SHA1

    acd817074fb611980bdedff8bd63b1e848eb23e3

  • SHA256

    fea27685cd509dbe6b66d384842d6a37e1b83e57bed0b46010c30707dc64abc0

  • SHA512

    54ae84eddb1be066c2d487b50b27173b715d8a21c71e53104a1caaa95d70804e05e930dbe8d99aee94a170d82cbcd676cc732936f6589e8f1fb49c7a07ab9f66

  • SSDEEP

    98304:dvfapmo1Y4+6Y7SOEfX/SbgRdLgV8ZmmxJWIfzjTpC5VI:da9+6Y7SOEibgRRqyzPpCLI

Malware Config

Targets

    • Target

      2024-11-10_fd49dd90e48679be4135c430d2df640c_icedid_xmrig

    • Size

      5.3MB

    • MD5

      fd49dd90e48679be4135c430d2df640c

    • SHA1

      acd817074fb611980bdedff8bd63b1e848eb23e3

    • SHA256

      fea27685cd509dbe6b66d384842d6a37e1b83e57bed0b46010c30707dc64abc0

    • SHA512

      54ae84eddb1be066c2d487b50b27173b715d8a21c71e53104a1caaa95d70804e05e930dbe8d99aee94a170d82cbcd676cc732936f6589e8f1fb49c7a07ab9f66

    • SSDEEP

      98304:dvfapmo1Y4+6Y7SOEfX/SbgRdLgV8ZmmxJWIfzjTpC5VI:da9+6Y7SOEibgRRqyzPpCLI

    • Blackmoon family

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • UAC bypass

    • Xmrig family

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Event Triggered Execution: Image File Execution Options Injection

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks