General
-
Target
2024-12-31_3bb8c7b51a1f6cf6ef303b5b8dc16509_hacktools_icedid_mimikatz
-
Size
8.4MB
-
Sample
241231-3qjg4syjam
-
MD5
3bb8c7b51a1f6cf6ef303b5b8dc16509
-
SHA1
8e05dbf7c12e3bdd6f1f49216a95e7cbb7a33c66
-
SHA256
b3d1f58f43bbdec0f1e4ea3b6e0cde361c861a7ee7761460f9f0d13f0cd1a1ac
-
SHA512
9ff745e43a6b535e54adf0a6e7b97d574130672fe67e3d917e2a5ee47879dc78ea7862bdf784731d3d615474f794f33cdb37b0f8afb54264c64736ee8c10e671
-
SSDEEP
98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
Behavioral task
behavioral1
Sample
2024-12-31_3bb8c7b51a1f6cf6ef303b5b8dc16509_hacktools_icedid_mimikatz.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-12-31_3bb8c7b51a1f6cf6ef303b5b8dc16509_hacktools_icedid_mimikatz.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
2024-12-31_3bb8c7b51a1f6cf6ef303b5b8dc16509_hacktools_icedid_mimikatz
-
Size
8.4MB
-
MD5
3bb8c7b51a1f6cf6ef303b5b8dc16509
-
SHA1
8e05dbf7c12e3bdd6f1f49216a95e7cbb7a33c66
-
SHA256
b3d1f58f43bbdec0f1e4ea3b6e0cde361c861a7ee7761460f9f0d13f0cd1a1ac
-
SHA512
9ff745e43a6b535e54adf0a6e7b97d574130672fe67e3d917e2a5ee47879dc78ea7862bdf784731d3d615474f794f33cdb37b0f8afb54264c64736ee8c10e671
-
SSDEEP
98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
-
Mimikatz family
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Xmrig family
-
Contacts a large (23893) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
XMRig Miner payload
-
mimikatz is an open source tool to dump credentials on Windows
-
Drops file in Drivers directory
-
Event Triggered Execution: Image File Execution Options Injection
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Creates a Windows Service
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Discovery
Network Service Discovery
2Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1