General
-
Target
2024-12-24_67d4b6927f8a7a1ea08c67115cfe2bb5_icedid_xmrig
-
Size
3.0MB
-
Sample
241224-a7ftbswrgx
-
MD5
67d4b6927f8a7a1ea08c67115cfe2bb5
-
SHA1
f8e171c8dceade676d9a35eab8f3539a2eb09b7e
-
SHA256
a06cc6861fd6624c68d79337dd48a90cf2ded28fc8470fc6fcc550da92346a54
-
SHA512
9635b9bddb052c27da4f0395c09c995c86708e6865fb53818c2abca05eba23a953341134a8a35adcc054e1e096fafc15e3982acd5b8a39965f2e017782d3741a
-
SSDEEP
49152:aDsvf45m/Ymo1JEd4ts6Y9NSOE/R+rJ9lgk+HX/SbgRFCaKVsVJ9y9EY6TK3:dvfapmo1Y4+6Y7SOEfX/SbgRzJy9b
Behavioral task
behavioral1
Sample
2024-12-24_67d4b6927f8a7a1ea08c67115cfe2bb5_icedid_xmrig.exe
Resource
win7-20240708-en
Malware Config
Targets
-
-
Target
2024-12-24_67d4b6927f8a7a1ea08c67115cfe2bb5_icedid_xmrig
-
Size
3.0MB
-
MD5
67d4b6927f8a7a1ea08c67115cfe2bb5
-
SHA1
f8e171c8dceade676d9a35eab8f3539a2eb09b7e
-
SHA256
a06cc6861fd6624c68d79337dd48a90cf2ded28fc8470fc6fcc550da92346a54
-
SHA512
9635b9bddb052c27da4f0395c09c995c86708e6865fb53818c2abca05eba23a953341134a8a35adcc054e1e096fafc15e3982acd5b8a39965f2e017782d3741a
-
SSDEEP
49152:aDsvf45m/Ymo1JEd4ts6Y9NSOE/R+rJ9lgk+HX/SbgRFCaKVsVJ9y9EY6TK3:dvfapmo1Y4+6Y7SOEfX/SbgRzJy9b
-
Blackmoon family
-
Detect Blackmoon payload
-
Xmrig family
-
XMRig Miner payload
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1