Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
01-08-2023 17:27
Behavioral task
behavioral1
Sample
34baf560dfa05d8cf1e6fbde53f05363_icedid_xiaobaminer_JC.exe
Resource
win7-20230712-en
windows7-x64
19 signatures
150 seconds
General
-
Target
34baf560dfa05d8cf1e6fbde53f05363_icedid_xiaobaminer_JC.exe
-
Size
5.0MB
-
MD5
34baf560dfa05d8cf1e6fbde53f05363
-
SHA1
76d650de345ce8463b644b532542ee2d09b4c9ef
-
SHA256
123dcccd2da5b7e658a930bb036ad84073b10969877bfdc557a2e3b6549260d6
-
SHA512
090ac0e4c80b7d74feb92a682859af0d82e0197b13f69a882a2ca5ab180571566a7093d0690bd2a4a390938d2dfd39d3ef79f582f51d405a9ddbfb7316c42631
-
SSDEEP
49152:9bYwIkppisrPa0PdWbYwIkppisrPa0PdU0ThmEf2hvZPzN/xw6n1wRjJm6K4MCc4:yciK9ciKucf2xZPzNsG4086Lwb
Malware Config
Signatures
-
Detect Blackmoon payload 6 IoCs
resource yara_rule behavioral1/memory/2616-53-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/files/0x0008000000016ca2-56.dat family_blackmoon behavioral1/memory/3008-60-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/files/0x0008000000016ca2-59.dat family_blackmoon behavioral1/files/0x0008000000016ca2-61.dat family_blackmoon behavioral1/files/0x0009000000016d06-64.dat family_blackmoon -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe -
Executes dropped EXE 1 IoCs
pid Process 3008 ZhuDongFangYu.exe -
Loads dropped DLL 1 IoCs
pid Process 2616 34baf560dfa05d8cf1e6fbde53f05363_icedid_xiaobaminer_JC.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf ZhuDongFangYu.exe File opened for modification C:\autorun.inf ZhuDongFangYu.exe File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe File created F:\autorun.inf ZhuDongFangYu.exe File opened for modification F:\autorun.inf ZhuDongFangYu.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\AtBroker.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\autoconv.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\hh.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mcbuilder.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\odbcad32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sdchange.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\scrnsave.scr ZhuDongFangYu.exe File created C:\Windows\SysWOW64\AdapterTroubleshooter.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\odbcconf.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rasdial.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rrinstaller.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sdiagnhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SearchIndexer.exe ZhuDongFangYu.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmic.inf_amd64_neutral_b94eb92e8150fa35\vmicsvc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dcomcnfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dvdupgrd.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rasautou.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wimserv.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\isoburn.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\netbtugc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\notepad.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ntprint.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PING.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\poqexec.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\shrpubw.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wlanext.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmd.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ROUTE.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sethc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\choice.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmstp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\nslookup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\setupugc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ipconfig.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\msra.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\MuiUnattend.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\print.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dllhst3g.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\forfiles.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\gpresult.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\newdev.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\pcaui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\perfmon.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mstsc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\openfiles.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\diskpart.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\esentutl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\iexpress.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\setx.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe ZhuDongFangYu.exe File created C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_neutral_e54666f6a3e5af91\fsquirt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPMGR.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\diskcomp.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mountvol.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SndVol.exe ZhuDongFangYu.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmprph.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\sidebar.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe ZhuDongFangYu.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Journal\PDIALOG.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmpenc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\wmpenc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Mail\WinMail.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{CD2DD08A-0275-45E1-8583-141D6573A43E}\chrome_installer.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\7-Zip\7z.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE ZhuDongFangYu.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\WMPDMC.exe ZhuDongFangYu.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Defender\MSASCui.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE ZhuDongFangYu.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE ZhuDongFangYu.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\notepad.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_6.1.7601.17514_none_1229a6f0546e2346\lpq.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..cationnotifications_31bf3856ad364e35_6.1.7600.16385_none_175ab6276b721d6a\LocationNotifications.exe ZhuDongFangYu.exe File opened for modification C:\Windows\Fonts\GlobalSansSerif.CompositeFont ZhuDongFangYu.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\dfsvc\bb4a1994db088e84b9d383271b082250\dfsvc.ni.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-commandlinehelp_31bf3856ad364e35_6.1.7600.16385_none_d4018bc76a8b37d9\help.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-filtermanager-utils_31bf3856ad364e35_6.1.7600.16385_none_1964092586ab4352\fltMC.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_caspol_b03f5f7f11d50a3a_6.1.7601.17514_none_403307e9ac829b13\CasPol.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-forfiles_31bf3856ad364e35_6.1.7600.16385_none_54f9c5c33edc5fbb\forfiles.exe ZhuDongFangYu.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\WsatConfig\9683999d889dc0b8782c782e2fc1aee5\WsatConfig.ni.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_8.0.7600.16385_none_db2b15bfcf64f104\iexpress.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_6.1.7601.17514_none_4c8976380e00631f\WMPDMC.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7601.17514_none_f59e20ddece8f922_certenrollctrl.exe_9495aa75 ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-b..onment-dvd-etfsboot_31bf3856ad364e35_6.1.7600.16385_none_82523ed4cbbd035a\etfsboot.com ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-irftp_31bf3856ad364e35_6.1.7600.16385_none_b2af329397f29f60\irftp.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..lepc-mobilitycenter_31bf3856ad364e35_6.1.7601.17514_none_b8bffa4921e2a435\mblctr.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_netfx-vb_compiler_b03f5f7f11d50a3a_6.1.7601.17514_none_cc9e34fd4e687b15\vbc.exe ZhuDongFangYu.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..inboxgames-checkers_31bf3856ad364e35_6.1.7601.17514_none_d467c138cbce0b24\chkrzm.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_c79aef32ab85d92b\cmdl32.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_6.1.7601.17514_none_f73c142da6e47daa\dfrgui.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-icacls_31bf3856ad364e35_6.1.7600.16385_none_8ea990b7bfab3802\icacls.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_6.1.7601.17514_none_ed7ce39bb395c4e0\DataSvcUtil.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\shrpubw.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_6.1.7601.17514_none_ab379671230b963f\bitsadmin.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_934d08d31b96d4ee\sdchange.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-syskey_31bf3856ad364e35_6.1.7600.16385_none_74578a893f33207c\syskey.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_02aa6dd4294b8d5f\shutdown.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-directshow-dvdupgrd_31bf3856ad364e35_6.1.7600.16385_none_d9bb586ff6564bbc\dvdupgrd.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-write_31bf3856ad364e35_6.1.7600.16385_none_bb77c3d6f6c8e3f6\write.exe ZhuDongFangYu.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_6.1.7600.16385_none_8945930a7d61b9f0\MigRegDB.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_11.2.9600.16428_none_e410f56f6c4ee930\ConfigureIEOptionalComponents.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_73e472e09a1a05d1\wmpconfig.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\wow64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_6.1.7601.17514_none_331c32d99bebbdac\mip.exe ZhuDongFangYu.exe File opened for modification C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe 34baf560dfa05d8cf1e6fbde53f05363_icedid_xiaobaminer_JC.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\SMSvcHost\04d794428d635f6a82ac57dd3d6f3628\SMSvcHost.ni.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7601.17514_none_288b7acec3a75696\wsmprovhost.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\msil_narrator_31bf3856ad364e35_6.1.7601.17514_none_e18f9f5aaa2eda72\Narrator.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.1.7601.17514_none_1c140627131a6df3\mcbuilder.exe ZhuDongFangYu.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\d632b7434f821829827657e23ac98589\ComSvcConfig.ni.exe ZhuDongFangYu.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\chgport.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedt32.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-where_31bf3856ad364e35_6.1.7600.16385_none_b9c82ac6f7db99ae\where.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_6d6b3cfb6a5a1e5a_ndadmin.exe_8e57269f ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_6.1.7601.17514_none_227e1c01642654f4_wermgr.exe_d92a3b6c ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\attrib.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\IMEPADSV.EXE ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehshell_31bf3856ad364e35_6.1.7600.16385_none_95955bd51390781b\ehshell.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_6.1.7600.16385_none_6b683cb78f534561\mmc.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-nslookup_31bf3856ad364e35_6.1.7601.17514_none_cd87dddbc4b4a790\nslookup.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..ccessagent-binaries_31bf3856ad364e35_6.1.7600.16385_none_de06b4fbd5b45f78\BitLockerToGo.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_cd7aeeff1897d018\lodctr.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-restartmanager_31bf3856ad364e35_6.1.7600.16385_none_dc2a59723dcfa2c7\RmClient.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-icacls_31bf3856ad364e35_6.1.7600.16385_none_328af534074dc6cc\icacls.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_052696aea98bcefc\TRACERT.EXE ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-waitfor_31bf3856ad364e35_6.1.7600.16385_none_125aa78894e49f8f\waitfor.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_34ce5d95ad203bbe\HOSTNAME.EXE ZhuDongFangYu.exe File created C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\PostMig.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe ZhuDongFangYu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2616 34baf560dfa05d8cf1e6fbde53f05363_icedid_xiaobaminer_JC.exe Token: SeDebugPrivilege 3008 ZhuDongFangYu.exe Token: 33 3008 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 3008 ZhuDongFangYu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2616 34baf560dfa05d8cf1e6fbde53f05363_icedid_xiaobaminer_JC.exe 3008 ZhuDongFangYu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2616 wrote to memory of 3008 2616 34baf560dfa05d8cf1e6fbde53f05363_icedid_xiaobaminer_JC.exe 28 PID 2616 wrote to memory of 3008 2616 34baf560dfa05d8cf1e6fbde53f05363_icedid_xiaobaminer_JC.exe 28 PID 2616 wrote to memory of 3008 2616 34baf560dfa05d8cf1e6fbde53f05363_icedid_xiaobaminer_JC.exe 28 PID 2616 wrote to memory of 3008 2616 34baf560dfa05d8cf1e6fbde53f05363_icedid_xiaobaminer_JC.exe 28 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\34baf560dfa05d8cf1e6fbde53f05363_icedid_xiaobaminer_JC.exe"C:\Users\Admin\AppData\Local\Temp\34baf560dfa05d8cf1e6fbde53f05363_icedid_xiaobaminer_JC.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3008
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.0MB
MD534baf560dfa05d8cf1e6fbde53f05363
SHA176d650de345ce8463b644b532542ee2d09b4c9ef
SHA256123dcccd2da5b7e658a930bb036ad84073b10969877bfdc557a2e3b6549260d6
SHA512090ac0e4c80b7d74feb92a682859af0d82e0197b13f69a882a2ca5ab180571566a7093d0690bd2a4a390938d2dfd39d3ef79f582f51d405a9ddbfb7316c42631
-
Filesize
5.0MB
MD534baf560dfa05d8cf1e6fbde53f05363
SHA176d650de345ce8463b644b532542ee2d09b4c9ef
SHA256123dcccd2da5b7e658a930bb036ad84073b10969877bfdc557a2e3b6549260d6
SHA512090ac0e4c80b7d74feb92a682859af0d82e0197b13f69a882a2ca5ab180571566a7093d0690bd2a4a390938d2dfd39d3ef79f582f51d405a9ddbfb7316c42631
-
Filesize
5.0MB
MD534baf560dfa05d8cf1e6fbde53f05363
SHA176d650de345ce8463b644b532542ee2d09b4c9ef
SHA256123dcccd2da5b7e658a930bb036ad84073b10969877bfdc557a2e3b6549260d6
SHA512090ac0e4c80b7d74feb92a682859af0d82e0197b13f69a882a2ca5ab180571566a7093d0690bd2a4a390938d2dfd39d3ef79f582f51d405a9ddbfb7316c42631
-
Filesize
5.0MB
MD534baf560dfa05d8cf1e6fbde53f05363
SHA176d650de345ce8463b644b532542ee2d09b4c9ef
SHA256123dcccd2da5b7e658a930bb036ad84073b10969877bfdc557a2e3b6549260d6
SHA512090ac0e4c80b7d74feb92a682859af0d82e0197b13f69a882a2ca5ab180571566a7093d0690bd2a4a390938d2dfd39d3ef79f582f51d405a9ddbfb7316c42631