Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-11-2024 05:50
General
-
Target
2024-11-18_d247064077bfa7273fa8ea2d048b9b0e_icedid_xmrig.exe
-
Size
4.3MB
-
MD5
d247064077bfa7273fa8ea2d048b9b0e
-
SHA1
5fb73547e4229cea9b68340b3302609efc1c3c60
-
SHA256
bab5a0af3a8511d017a15702ac1fbc40e84e6e0885b70244f9b0ca10603f34f8
-
SHA512
a3f5eba9c9999e4807be82536761cd71dbb2237975a6b0524137f5567f9188253595542985532a5ae4157bd3a93d14e7bd3b86c82c914667b1c2ed5eb68651f7
-
SSDEEP
98304:dvfapmo1Y4+6Y7SOEfX/SbgR/3ziF3FNpOow:da9+6Y7SOEibgR/DiFVNTw
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
UAC bypass 3 TTPs 1 IoCs
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 17 IoCs
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_d247064077bfa7273fa8ea2d048b9b0e_icedid_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_d247064077bfa7273fa8ea2d048b9b0e_icedid_xmrig.exe"1⤵
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.8MB
MD57278c7bef7448239e3d07d474d961693
SHA10e6b0fd6d5a3160695ce84602cc1897b4920fd3e
SHA256f8e7f7c66153203d1d595f0b4b0a44876b3aba586ab246d4f813fbbca9151b25
SHA512080c1f5267655d39f9cd9a0e0e2ecc4121c2512a6218abe7caf20034cf07805df7e8f6281203571d15560e9c9f2152c4f84f8cee1652a35f07b09c1d26a1a719
-
Filesize
16KB
MD5ed1191da9c4f74a60d695a25686f374e
SHA13a427657c16a716be332587425101653c25221d0
SHA256ab8cafd1958c27d70adc747259495e35592f8a06ae00969964f5f34f72896f3f
SHA51268098c1342f87939b3f57cd3e3a799ff316d2f1eb5c52f8d9c0c9e7c214281bff68a1260a91527b7175ad031798f42125cf9ee2e0d49772eb03b5836b67d9fbf
-
Filesize
6KB
MD5657eb3527d651515f97b960a67d19fda
SHA127404b587183bc2f3b3b6919fbb91892f505b60d
SHA256f301745232a72d84f277980ad53b65d94b02479369e8b73fe0e6717adcf11a35
SHA5121085550a8844de081a216bd864990e56fbe91498fb6186cce435173ab73e29932e7b8182078cd2876039addbdb7e3c9769d7d7923f7ed2a5422e6a2a36321b70
-
Filesize
12KB
MD5cdea5d1cccee27144519c75bcf3015bd
SHA1c36862abb1ada006b3dd4c28adc8b393a92fd325
SHA2561184f2316c36648a2d457b602c713d5d5eb980e86e5e8ed388e94a47f8573dbd
SHA5125d0ea1cef2af7111098c19578c42bfdfd7bb00ec3259fe026df6dd867a24f9a94f3299b035235e3cb87b1c9010f0d1be434a08318dae0412e03ecfdb439edfe9
-
Filesize
9KB
MD5bc3e199345ad8ba54e2fe4acad95433d
SHA1c93cb69c27e1c03069de3c952534a52f391e3fb9
SHA256462c197c83ee3d677b07fe000b2c4e64ac4be4ceaaea80c1c77a5e67d832edd8
SHA512c1941c9106ff0d665dfee1888afcdc3c54e4db8fdb11e3313cd92a147a1084264dba8f1f9cbac5216d3c5ce1f97ff7f8d7d7493826ec3538d5db57a933fe32e4
-
Filesize
14KB
MD559e4add1732aef6b8e228ecfb880c299
SHA131a6380e878f89ec9d2c83716fe42faafdd828db
SHA256089aaccbf4c17d2a0163f13820e926f8ce3122c9ed87e7e040a77439795b8fc4
SHA512461240638f98f92a0df94a6a76470d7ed3a9bf45f845b545ff37355efd4fb3efdbe592e563b6624d2e42374a3bf7682a572c3bfd96c21be87fc96ec3b3bcfbaf
-
Filesize
16KB
MD526986f79440b7a706b65724e509f009f
SHA19d8ff0beef1c19fbecd28e3f632101acf3d02599
SHA256e59b7fa34b947d5ada478ff17543204251955052fdace284e5a285bd2abec5d1
SHA5122c240c4f7b8912bd5049bef22c2507c7c1af15432c860549d0f1ea35f03183270eb7315607fdf35be86703a61ec0ed7801e9e6ea627a026dbf93d98ff11d2ed6
-
Filesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
Filesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
Filesize
80KB
MD56fcd0f9110ecf30f06c201f71d3df957
SHA159cac57386aef1bde071f3c77ee48bd7b8168f15
SHA25631d0be5e16a8dbe35f5450837079f189d2b57db6482b10a2340a20b3d3a15f56
SHA5125bb381068d062722753d6461a0b1f17f30cf27272de3fdeeed06efe904c0271d40161e2b7b199711d02c8af59b9c8d30fb93fc3090bb56256247c3f4270e9190
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
2.1MB