General

  • Target

    2024-12-23_1f889137382db07ddc6e2520e94cb01d_icedid_xiaobaminer

  • Size

    4.1MB

  • Sample

    241223-1lnvxsslev

  • MD5

    1f889137382db07ddc6e2520e94cb01d

  • SHA1

    3d90501bf2a830d1b696ada9ebfecaabc4892b0b

  • SHA256

    a68b73ff008ec7e91a5e675d8315cb1126b263cb4549c9d5304ea205327ec8fd

  • SHA512

    5f3b502996c4f09f4d745a6f9d9c6de8c943e5e9602482e7300ea86efbfcdaabeec96b8a471f4e958c684c8d8af05e5c5cbf45a47db591afb4e925669fccfd3c

  • SSDEEP

    49152:9bYwIkppisrPa0PsK+JLrZaZ2hTB3liEf2hvZPzN/xw6n1wRjJm6K4MCcUxifU0N:yciKsK+JLVaIf2xZPzNsG408w

Malware Config

Targets

    • Target

      2024-12-23_1f889137382db07ddc6e2520e94cb01d_icedid_xiaobaminer

    • Size

      4.1MB

    • MD5

      1f889137382db07ddc6e2520e94cb01d

    • SHA1

      3d90501bf2a830d1b696ada9ebfecaabc4892b0b

    • SHA256

      a68b73ff008ec7e91a5e675d8315cb1126b263cb4549c9d5304ea205327ec8fd

    • SHA512

      5f3b502996c4f09f4d745a6f9d9c6de8c943e5e9602482e7300ea86efbfcdaabeec96b8a471f4e958c684c8d8af05e5c5cbf45a47db591afb4e925669fccfd3c

    • SSDEEP

      49152:9bYwIkppisrPa0PsK+JLrZaZ2hTB3liEf2hvZPzN/xw6n1wRjJm6K4MCcUxifU0N:yciKsK+JLVaIf2xZPzNsG408w

    • Blackmoon family

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    • Detect Blackmoon payload

    • UAC bypass

    • Adds policy Run key to start application

    • Disables RegEdit via registry modification

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks