General

  • Target

    2024-12-22_6b53b3258de8c5b23fe72c34206b29f3_icedid_xiaobaminer

  • Size

    2.9MB

  • Sample

    241222-n4fk2sxnbn

  • MD5

    6b53b3258de8c5b23fe72c34206b29f3

  • SHA1

    3dc30246c25da27716d1bce0f247aba3465281b8

  • SHA256

    f77dd9bc7fda9f82182730b0eb31dfdb5bd7df811cad1369f563ec94cc80a69c

  • SHA512

    b85eba67e7a052201a7b46d946f876040545cdf953170a3eeb97b9574c6442d5b1b7f0581debc7512f398019bb162c0a255d962fdc57eda76ee0e8efb093dcc6

  • SSDEEP

    49152:9bYwIkppisrPa0PsK+JLrZaZ2hTBgwzYKmMrm1RF4cNoph7GBfW07:yciKsK+JLVakmMrm1RF4j77GBfWM

Malware Config

Targets

    • Target

      2024-12-22_6b53b3258de8c5b23fe72c34206b29f3_icedid_xiaobaminer

    • Size

      2.9MB

    • MD5

      6b53b3258de8c5b23fe72c34206b29f3

    • SHA1

      3dc30246c25da27716d1bce0f247aba3465281b8

    • SHA256

      f77dd9bc7fda9f82182730b0eb31dfdb5bd7df811cad1369f563ec94cc80a69c

    • SHA512

      b85eba67e7a052201a7b46d946f876040545cdf953170a3eeb97b9574c6442d5b1b7f0581debc7512f398019bb162c0a255d962fdc57eda76ee0e8efb093dcc6

    • SSDEEP

      49152:9bYwIkppisrPa0PsK+JLrZaZ2hTBgwzYKmMrm1RF4cNoph7GBfW07:yciKsK+JLVakmMrm1RF4j77GBfWM

    • Blackmoon family

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • UAC bypass

    • Adds policy Run key to start application

    • Disables RegEdit via registry modification

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks