Analysis
-
max time kernel
133s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
01/08/2023, 18:03
Behavioral task
behavioral1
Sample
3688a31bd6273724217ed4de651162ce_icedid_xiaobaminer_JC.exe
Resource
win7-20230712-en
windows7-x64
19 signatures
150 seconds
General
-
Target
3688a31bd6273724217ed4de651162ce_icedid_xiaobaminer_JC.exe
-
Size
2.6MB
-
MD5
3688a31bd6273724217ed4de651162ce
-
SHA1
74d561751fb834179d2b2e5f5620783725cb63e5
-
SHA256
cdf31b82d2dc519aa3af5a47b0791fd33751792717674e7579f3d0cf9411b21c
-
SHA512
3a33029d73fc07f94fd4bd73c4919beb25a6f4b8203e46830df2418cb477868bb87a86693942e85fe08a3487ce728da6118524547a91e6a623e1b6e5034ae80d
-
SSDEEP
49152:9bYwIICRaYSDA+ouZ/K0tDmNhJXLkZRJ+0Y8TCXXJdWdYw6VdNRIky/Cr70QiB:yCCRUZ/K0tKNhJXKsdXXJdWGw6VdIkyl
Malware Config
Signatures
-
Detect Blackmoon payload 6 IoCs
resource yara_rule behavioral1/memory/2236-54-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/files/0x000600000001932d-60.dat family_blackmoon behavioral1/files/0x000600000001932d-57.dat family_blackmoon behavioral1/memory/2572-61-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/files/0x000600000001932d-62.dat family_blackmoon behavioral1/files/0x000700000001953b-65.dat family_blackmoon -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe -
Executes dropped EXE 1 IoCs
pid Process 2572 ZhuDongFangYu.exe -
Loads dropped DLL 1 IoCs
pid Process 2236 3688a31bd6273724217ed4de651162ce_icedid_xiaobaminer_JC.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf ZhuDongFangYu.exe File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe File created F:\autorun.inf ZhuDongFangYu.exe File opened for modification F:\autorun.inf ZhuDongFangYu.exe File created C:\autorun.inf ZhuDongFangYu.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\eventcreate.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\find.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mtstocom.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\format.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\DWWIN.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\whoami.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dcomcnfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\nslookup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\setupSNK.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\taskmgr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\unregmp2.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cleanmgr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\isoburn.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\OptionalFeatures.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\regini.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\more.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Mystify.scr ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr ZhuDongFangYu.exe File created C:\Windows\SysWOW64\DpiScaling.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rasphone.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\runonce.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\hdwwiz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmstp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\convert.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fontview.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wininit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\certreq.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\msiexec.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wextract.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dllhst3g.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\gpresult.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ktmutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\raserver.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\reg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMESC5\IMSCPROP.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\colorcpl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ntoskrnl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\userinit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\diskperf.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dxdiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ftp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sort.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\winver.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wsmprovhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\diskpart.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mobsync.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\osk.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WerFault.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ddodiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\perfmon.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rrinstaller.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe ZhuDongFangYu.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE ZhuDongFangYu.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Mail\WinMail.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE ZhuDongFangYu.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\7-Zip\7zG.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe ZhuDongFangYu.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe ZhuDongFangYu.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmprph.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe ZhuDongFangYu.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE ZhuDongFangYu.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\iissetup.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_6.1.7600.16385_none_b6cb9ed71c8b43d5\SystemPropertiesPerformance.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7600.16385_none_ce6f64032560fa6b\user.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_6.1.7600.16385_none_fe75fb7856d846d5\DWWIN.EXE ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-installer-executable_31bf3856ad364e35_6.1.7601.17514_none_4b88deb7e45bfbb0\msiexec.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-optionalfeatures_31bf3856ad364e35_6.1.7600.16385_none_663d506d4f028574\OptionalFeatures.exe ZhuDongFangYu.exe File created C:\Windows\ehome\ehexthost.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_6.1.7600.16385_none_626b9352dcfa715c\ComputerDefaults.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-rasclienttools_31bf3856ad364e35_6.1.7600.16385_none_6f1d25ec0a04d811\rasphone.exe ZhuDongFangYu.exe File created C:\Windows\twunk_16.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_6.1.7601.17514_none_f8852afc12f84e8e\nltest.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-grpconv_31bf3856ad364e35_6.1.7600.16385_none_fe7d1685575edfa6\grpconv.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-notepad_31bf3856ad364e35_6.1.7600.16385_none_cb0f7f2289b0c21a\notepad.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-taskmgr_31bf3856ad364e35_6.1.7601.17514_none_7288349cbfd37b08\taskmgr.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-takeown_31bf3856ad364e35_6.1.7601.17514_none_fbf2cfb573e03306\takeown.exe ZhuDongFangYu.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\SMSvcHost.ni.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_cb604f1aa758e6b6\IMJPMGR.EXE ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-fax-service_31bf3856ad364e35_6.1.7601.17514_none_0b499f2c96e8f6b2\FXSSVC.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\doskey.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_aspnet_regsql_b03f5f7f11d50a3a_6.1.7600.16385_none_2461659e78807255\aspnet_regsql.exe ZhuDongFangYu.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-certutil_31bf3856ad364e35_6.1.7600.16385_none_1179f9944d0d9973\certutil.exe ZhuDongFangYu.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_009cfaa696afe78b\comp.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\poqexec.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_f47d7472a4c4e67e\mscorsvw.exe ZhuDongFangYu.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\Narrator\4cc02fad33053737088d4c18267ca0a0\Narrator.ni.exe ZhuDongFangYu.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-taskhost_31bf3856ad364e35_6.1.7601.17514_none_8664adc870f5633a\taskhost.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_6.1.7600.16385_none_b45109ec45a678fc\WFServicesReg.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eudc-settings_31bf3856ad364e35_6.1.7601.17514_none_b84dc938eed78546\eudcsettings.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\rwinsta.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-diskraid_31bf3856ad364e35_6.1.7601.17514_none_67910dfbf63c4aae\diskraid.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-waitfor_31bf3856ad364e35_6.1.7600.16385_none_b63c0c04dc872e59\waitfor.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_6.1.7600.16385_none_ad5854ca0a23343d\mount.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_6.1.7600.16385_none_9243b833ecd918df\baaupdate.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\mode.com ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..g-xpsdocumentwriter_31bf3856ad364e35_6.1.7601.17514_none_80fea45979a5d3f2\MxdwGc.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_34ce5d95ad203bbe\TCPSVCS.EXE ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_6.1.7600.16385_none_c8897566b5c070a0\InfDefaultInstall.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7601.17514_none_a0cf62efee3228a3\wabmig.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_subsystem-for-unix-based-applications_31bf3856ad364e35_6.1.7601.17514_none_d20e5d35068f261a\psxss.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-credwiz_31bf3856ad364e35_6.1.7600.16385_none_9fb106cecd28b3f9\credwiz.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-tasklist_31bf3856ad364e35_6.1.7600.16385_none_28198854bba53a00\tasklist.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_6.1.7600.16385_none_56e30bcc495bf9ca\LinqWebConfig.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_052696aea98bcefc\TRACERT.EXE ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.7601.17514_none_3eb101caec1acc2c\ie4uinit.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..-mctadmin-component_31bf3856ad364e35_6.1.7600.16385_none_672f52a8b504cbbe\mctadmin.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_6.1.7601.17514_none_cb4d60191a09a7b0\PresentationSettings.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_6.1.7601.17514_none_832fc1bb7d681e0d\sdclt.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_9d700972113e2691_wowreg32.exe_94fc2d06 ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7601.17514_none_44b0c76c35d4b76d\wab.exe ZhuDongFangYu.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\WsatConfig\36ca2928b2191011831ab673861c6ac6\WsatConfig.ni.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-write_31bf3856ad364e35_6.1.7600.16385_none_bb77c3d6f6c8e3f6\write.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.1.7601.17514_none_c910d80f114e267a_vds.exe_cb461c29 ZhuDongFangYu.exe File created C:\Windows\winsxs\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_6.1.7600.16385_none_d03cc6bce93bce83\TapiUnattend.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_21ceb2d66a98ec2f\mofcomp.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.17932_none_d088def7226177d5\instnm.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_6.1.7601.17514_none_e932cc2c30fc13b0\cmd.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.17514_none_c75e9c99a36a285a_winresume.exe_85cd1215 ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_6e8a5c3d2bac37e9\ntoskrnl.exe ZhuDongFangYu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2236 3688a31bd6273724217ed4de651162ce_icedid_xiaobaminer_JC.exe Token: SeDebugPrivilege 2572 ZhuDongFangYu.exe Token: 33 2572 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 2572 ZhuDongFangYu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2236 3688a31bd6273724217ed4de651162ce_icedid_xiaobaminer_JC.exe 2572 ZhuDongFangYu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2572 2236 3688a31bd6273724217ed4de651162ce_icedid_xiaobaminer_JC.exe 28 PID 2236 wrote to memory of 2572 2236 3688a31bd6273724217ed4de651162ce_icedid_xiaobaminer_JC.exe 28 PID 2236 wrote to memory of 2572 2236 3688a31bd6273724217ed4de651162ce_icedid_xiaobaminer_JC.exe 28 PID 2236 wrote to memory of 2572 2236 3688a31bd6273724217ed4de651162ce_icedid_xiaobaminer_JC.exe 28 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3688a31bd6273724217ed4de651162ce_icedid_xiaobaminer_JC.exe"C:\Users\Admin\AppData\Local\Temp\3688a31bd6273724217ed4de651162ce_icedid_xiaobaminer_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2572
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html
Filesize12KB
MD533f73419b8fc156a8a5e0eee311a2639
SHA17ebd3842e080ed34f4675eea740c3e90d8db7bc2
SHA256442c6bfe7c011e24f8c0bb1c0584b96cf804eb7198d4aacffa4c5f6769ff4215
SHA5121f9e3a64bfc78cea57f4d9fce2ff4f9adfbe7526ef10e40eaa7cd9b8109cfa124b306f6d3be5e1a777bb604dc2c497623aa9298f580cd7e9a6e3bb9818e819ad
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html
Filesize8KB
MD5ffbe89b376301d5a5e1602502f3a049e
SHA14fd73b0508a04073411bfb0af9f1e77a2009850a
SHA256fd516ab385f8dabba0da1377f5dfdc0dbdefdd224d823313eff24e8fb00c6217
SHA51225807dacb22621f69dfc9b85464e566a11b6f417632c9d2dac92b5112a8495aacc5edb2938e5515a59843fe79f25b5c65a280b41fb9b0c27bfce2b4da48cfa02
-
Filesize
2.6MB
MD53688a31bd6273724217ed4de651162ce
SHA174d561751fb834179d2b2e5f5620783725cb63e5
SHA256cdf31b82d2dc519aa3af5a47b0791fd33751792717674e7579f3d0cf9411b21c
SHA5123a33029d73fc07f94fd4bd73c4919beb25a6f4b8203e46830df2418cb477868bb87a86693942e85fe08a3487ce728da6118524547a91e6a623e1b6e5034ae80d
-
Filesize
2.6MB
MD53688a31bd6273724217ed4de651162ce
SHA174d561751fb834179d2b2e5f5620783725cb63e5
SHA256cdf31b82d2dc519aa3af5a47b0791fd33751792717674e7579f3d0cf9411b21c
SHA5123a33029d73fc07f94fd4bd73c4919beb25a6f4b8203e46830df2418cb477868bb87a86693942e85fe08a3487ce728da6118524547a91e6a623e1b6e5034ae80d
-
Filesize
2.6MB
MD53688a31bd6273724217ed4de651162ce
SHA174d561751fb834179d2b2e5f5620783725cb63e5
SHA256cdf31b82d2dc519aa3af5a47b0791fd33751792717674e7579f3d0cf9411b21c
SHA5123a33029d73fc07f94fd4bd73c4919beb25a6f4b8203e46830df2418cb477868bb87a86693942e85fe08a3487ce728da6118524547a91e6a623e1b6e5034ae80d
-
Filesize
2.6MB
MD53688a31bd6273724217ed4de651162ce
SHA174d561751fb834179d2b2e5f5620783725cb63e5
SHA256cdf31b82d2dc519aa3af5a47b0791fd33751792717674e7579f3d0cf9411b21c
SHA5123a33029d73fc07f94fd4bd73c4919beb25a6f4b8203e46830df2418cb477868bb87a86693942e85fe08a3487ce728da6118524547a91e6a623e1b6e5034ae80d