Analysis
-
max time kernel
122s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-11-2024 05:50
General
-
Target
2024-11-18_d247064077bfa7273fa8ea2d048b9b0e_icedid_xmrig.exe
-
Size
4.3MB
-
MD5
d247064077bfa7273fa8ea2d048b9b0e
-
SHA1
5fb73547e4229cea9b68340b3302609efc1c3c60
-
SHA256
bab5a0af3a8511d017a15702ac1fbc40e84e6e0885b70244f9b0ca10603f34f8
-
SHA512
a3f5eba9c9999e4807be82536761cd71dbb2237975a6b0524137f5567f9188253595542985532a5ae4157bd3a93d14e7bd3b86c82c914667b1c2ed5eb68651f7
-
SSDEEP
98304:dvfapmo1Y4+6Y7SOEfX/SbgR/3ziF3FNpOow:da9+6Y7SOEibgR/DiFVNTw
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
UAC bypass 3 TTPs 1 IoCs
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 17 IoCs
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_d247064077bfa7273fa8ea2d048b9b0e_icedid_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_d247064077bfa7273fa8ea2d048b9b0e_icedid_xmrig.exe"1⤵
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
MD5ecd3b26a6369f88fdaad96f77d166d8d
SHA119c7fbeade340e84a993b9e9cbf7b2b7f5c3b7e8
SHA256ec00844890fc3059d2b4c7cb6486189bbc5f129b8e0c9e5c2eea3dde7937b1d2
SHA5125a69f94cd4cfa5118442acdbb4c9366f4d984f7eb6742c5d9acdd090d6a7d43b1bab212a500dca3ecfb1d44c0dc0b89b1506bd7e2605f05bc82ba7a4ee8852b7
-
Filesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
Filesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
Filesize
81KB
MD5994ccf1b213aa060fbf3c67fb043829f
SHA1d385ef9fbbbbc7fd6c793cd4e8092b078dbf0e7d
SHA25610253a195c0e1016e7c871132d148f705e3f8e958872903ebf3719fed204d3cf
SHA51214989ec201c5a7890c1a0cdefc2542b1c3426406689ecb3f77453d9bd48ba7ebc812041452e6b1030be7df113b3cd903e07b77b2e78ff5c4bdee463cd0def576
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
2.1MB