Analysis
-
max time kernel
84s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 06:28
Behavioral task
behavioral1
Sample
2024-04-28_83c164f5b4c5564301de5b48ff7576ca_icedid_xiaobaminer.exe
Resource
win7-20240419-en
General
-
Target
2024-04-28_83c164f5b4c5564301de5b48ff7576ca_icedid_xiaobaminer.exe
-
Size
2.1MB
-
MD5
83c164f5b4c5564301de5b48ff7576ca
-
SHA1
8c8d1d5738315676f717940ec15040f0a538c0d8
-
SHA256
c25bb58cd68d317242ddc18e466031a845b045c2f31b7a21ac281ddac7f26aaf
-
SHA512
d29aac6654c4e36f1524ba1be6f21a0723135fc348fb67361b71bb0c51dc3f75be992f3d12987f5fb77ae1f0e3683efdb56e1291ffd6a9777d0a303a0b913bd5
-
SSDEEP
24576:7bXyk1Z3jc1VCrNHtBCACNXBxgjI45bl9Mbonwap41+zzPTThwv3EJY:7bCknzcErNNQJLxgjI45TMwwapIgTI
Malware Config
Signatures
-
Detect Blackmoon payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4356-0-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/4356-1-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe family_blackmoon behavioral2/memory/4356-11-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/712-354-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/712-489-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe -
Drops file in Drivers directory 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-04-28_83c164f5b4c5564301de5b48ff7576ca_icedid_xiaobaminer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 2024-04-28_83c164f5b4c5564301de5b48ff7576ca_icedid_xiaobaminer.exe -
Executes dropped EXE 1 IoCs
Processes:
ZhuDongFangYu.exepid process 712 ZhuDongFangYu.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\autorun.inf ZhuDongFangYu.exe File opened for modification C:\autorun.inf ZhuDongFangYu.exe File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe File created F:\autorun.inf ZhuDongFangYu.exe File opened for modification F:\autorun.inf ZhuDongFangYu.exe -
Drops file in System32 directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\SysWOW64\at.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dccw.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\netiougc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PkgMgr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\winver.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\regsvr32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\stordiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\systeminfo.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\tar.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cttunesvr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mmgaserver.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\NETSTAT.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\bthudtask.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmdl32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\gpscript.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\printui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\runonce.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Utilman.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wowreg32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WWAHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\edpnotify.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\explorer.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sdbinst.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\extrac32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\hh.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\icacls.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\taskkill.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ftp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ndadmin.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\powercfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\recover.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wscript.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dialer.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mstsc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\regini.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\takeown.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\clip.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\find.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\schtasks.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SyncHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\compact.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\control.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dpapimig.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\newdev.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\raserver.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\tcmsetup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\autofmt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Magnify.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SearchIndexer.exe ZhuDongFangYu.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_pwa_launcher.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\notificationCenter.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM ZhuDongFangYu.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe ZhuDongFangYu.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html ZhuDongFangYu.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Mail\wab.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\whatsnewsrc\bulletin_board.html ZhuDongFangYu.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99062\javaws.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmplayer.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe ZhuDongFangYu.exe -
Drops file in Windows directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\ROUTE.EXE ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.153_none_42505a6de732f7ca\f\MusNotification.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.19041.1_none_0e98e5367a9d834f\mighost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.19041.1202_none_5f774093e49b3593\r\refsutil.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_9fcce199936290f4\f\upnpcont.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobe-progress-template.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\404-3.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\f\SpatialAudioLicenseSrv.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\f\ImeBroker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\mavinject.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.19041.1_none_687f28352b92068b\attrib.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.19041.746_none_8443a7febb9ab03d\r\consent.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\f\fltMC.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\403-19.htm ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_jsc_b03f5f7f11d50a3a_4.0.15805.0_none_02d98290c2a0aa6b\jsc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.572_none_90e9bab3cbbfd71a\r\djoin.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\IMEPADSV.EXE ZhuDongFangYu.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_4.0.15805.0_none_429bcf7adb8e23ed\AddInProcess32.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\pdferrordisabledforregion.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\403.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.84_none_42927ae06bc1dce9\r\WpcMon.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.19041.746_none_18cbe45e21fb4fcb\f\sessionmsg.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.19041.662_none_746c3bfaa509091f\r\dtdump.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\403.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.1266_none_e8d910c7c702b558\r\MusNotificationUx.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\f\vdsldr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\403-7.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\http_gen.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\CustomInstallExec.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\500-15.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_ccf6cb6d0aa9a822\r\mstsc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\r\SpatialAudioLicenseSrv.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timezone-sync_31bf3856ad364e35_10.0.19041.1_none_4521fd67bfb25b6a\tzsync.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\f\icsunattend.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\msil_servicemodelreg_b03f5f7f11d50a3a_10.0.19041.1_none_0bb55a3e8d066c16\ServiceModelReg.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.19041.1_none_95a8887a13522472\eventcreate.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\r\sdchange.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\http_400.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.264_none_0f23d07ed2574292\DiagnosticsHub.StandardCollector.Service.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\rmttpmvscmgrsvr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1151_none_4e193eb76ed5f8cb\f\wiaacmgr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobe-footer-template.html ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\navcancl.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\500-16.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\r\tpmvscmgrsvr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\wmpconfig.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\r\vmwp.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\logoff.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\f\usocoreworker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.19041.1_none_c8306252df9627cb\rekeywiz.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\needhvsi.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\404-6.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\401-2.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.19041.1288_none_1d22271c8cc35d4b\r\IESettingSync.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.153_none_dbdeec75cdd2a4d1\f\DataUsageLiveTileTask.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\acr_error.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recover_31bf3856ad364e35_10.0.19041.1_none_3c045b5253f885ed\recover.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\cscript.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\needie.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\pdferrorneedcredentials.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\r\ShellLauncherConfig.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..pdate-oob-component_31bf3856ad364e35_10.0.19041.84_none_e539abe3d27f675f\f\rdvgm.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.906_none_686405dc140529cf\f\schtasks.exe ZhuDongFangYu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2024-04-28_83c164f5b4c5564301de5b48ff7576ca_icedid_xiaobaminer.exeZhuDongFangYu.exedescription pid process Token: SeDebugPrivilege 4356 2024-04-28_83c164f5b4c5564301de5b48ff7576ca_icedid_xiaobaminer.exe Token: SeDebugPrivilege 712 ZhuDongFangYu.exe Token: 33 712 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 712 ZhuDongFangYu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-04-28_83c164f5b4c5564301de5b48ff7576ca_icedid_xiaobaminer.exeZhuDongFangYu.exepid process 4356 2024-04-28_83c164f5b4c5564301de5b48ff7576ca_icedid_xiaobaminer.exe 712 ZhuDongFangYu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-04-28_83c164f5b4c5564301de5b48ff7576ca_icedid_xiaobaminer.exedescription pid process target process PID 4356 wrote to memory of 712 4356 2024-04-28_83c164f5b4c5564301de5b48ff7576ca_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 4356 wrote to memory of 712 4356 2024-04-28_83c164f5b4c5564301de5b48ff7576ca_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 4356 wrote to memory of 712 4356 2024-04-28_83c164f5b4c5564301de5b48ff7576ca_icedid_xiaobaminer.exe ZhuDongFangYu.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_83c164f5b4c5564301de5b48ff7576ca_icedid_xiaobaminer.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_83c164f5b4c5564301de5b48ff7576ca_icedid_xiaobaminer.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exeFilesize
2.1MB
MD583c164f5b4c5564301de5b48ff7576ca
SHA18c8d1d5738315676f717940ec15040f0a538c0d8
SHA256c25bb58cd68d317242ddc18e466031a845b045c2f31b7a21ac281ddac7f26aaf
SHA512d29aac6654c4e36f1524ba1be6f21a0723135fc348fb67361b71bb0c51dc3f75be992f3d12987f5fb77ae1f0e3683efdb56e1291ffd6a9777d0a303a0b913bd5
-
C:\vcredist2010_x86.log.htmlFilesize
81KB
MD52328ceb58d29206a6cf53f1c365c616d
SHA1ff3060232921dc52d6426b6184ab62cf5101a8e4
SHA25642f79bc879b307a024c44a862300d1e6705121a67ea24b8c49b377e8849c1a49
SHA5120a27557c4b1767f75b8dcc86a1e2de767839b81f52695e0e5e2df904fa8e1c176d3bfa5442bd0fc337b7b499d98184bd4b851df37deeae5b68eafda20b3c9714
-
memory/712-354-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/712-489-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4356-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4356-1-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4356-11-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB