Blue Mockingbird - G0108

Created: 2020-05-26T20:09:39.139Z

Modified: 2021-10-12T21:46:13.007Z

Contributors: Tony Lambert, Red Canary

Aliases

Blue Mockingbird

Description

Blue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.(Citation: RedCanary Mockingbird May 2020)

Techniques Used

Blue Mockingbird has obtained and used tools such as

Mimikatz.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.012|COR_PROFILER|

Blue Mockingbird has used wmic.exe and Windows Registry modifications to set the COR_PROFILER environment variable to execute a malicious DLL whenever a process loads the .NET CLR.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Blue Mockingbird has obfuscated the wallet address in the payload binary.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Blue Mockingbird has used wmic.exe to set environment variables.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

Blue Mockingbird has used Windows Registry modifications to specify a DLL payload.(Citation: RedCanary Mockingbird May 2020) |
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Blue Mockingbird has collected hardware details for the victim's system, including CPU and memory information.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|