Analysis
- max time kernel
119s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
03/08/2023, 16:13
Behavioral task
behavioral1
Sample
4ba339919ff392d0353c074987afe19d_icedid_xiaobaminer_JC.exe
Resource
win7-20230712-en
windows7-x64
19 signatures
150 seconds
General
- Target 4ba339919ff392d0353c074987afe19d_icedid_xiaobaminer_JC.exe
- Size 575KB
- Sample230803-tpggpaec33
- SHA256 4aec0076cfba0d3df24da2de6f0aec84f1d3b6442e29faf665ee1166d55094d5
- MD5 4ba339919ff392d0353c074987afe19d
- SHA1 59c272f232cd093ba05ce99ff15e46fbf5af1b2e
- SHA512 9c10b6d937a4451e3ec2e29d056995d5a997a621f74754f82aac070bc8c22923b7891737c7f6cfd313df9a936bf217503337fcbbd9fe57c883d088a8d40ecfe2
- SSDEEP 6144:9b4S+1Mvyr3UGv9JYT7E0CQPc8I6NfC8zAVQiI+WjFDfoY9+6s6Be/ODsTnJzQlN:9bu+yrST7EJicgNfzcQiHmNJLBIuntH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 4 IoCs
resource yara_rule behavioral2/memory/5072-133-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/files/0x0007000000023217-138.dat family_blackmoon behavioral2/files/0x0007000000023217-143.dat family_blackmoon behavioral2/files/0x0007000000023217-144.dat family_blackmoon -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe - Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe - Executes dropped EXE 1 IoCs
pid Process 3656 ZhuDongFangYu.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe - Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf ZhuDongFangYu.exe File created C:\autorun.inf ZhuDongFangYu.exe File opened for modification C:\autorun.inf ZhuDongFangYu.exe File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe File created F:\autorun.inf ZhuDongFangYu.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ByteCodeGenerator.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\compact.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\driverquery.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\msra.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PickerHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\printui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\at.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\schtasks.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WWAHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\iscsicpl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\logman.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\subst.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Taskmgr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\DWWIN.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\curl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\secinit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wecutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wermgr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wscadminui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\xcopy.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\systeminfo.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WerFault.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\chkdsk.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\attrib.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\grpconv.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mavinject.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ttdinject.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\AtBroker.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\regedt32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\relog.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sdbinst.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cttunesvr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\newdev.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\nslookup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\netsh.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\extrac32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rasdial.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\comp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\format.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\poqexec.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\eudcedit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fontview.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mstsc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PATHPING.EXE ZhuDongFangYu.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe ZhuDongFangYu.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.175.29\MicrosoftEdgeUpdateCore.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Mail\wabmig.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe ZhuDongFangYu.exe File created C:\Program Files\Internet Explorer\ielowutil.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.175.29\MicrosoftEdgeUpdateOnDemand.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{9738341D-7792-4FE1-AC11-5AFF6DBFD418}\chrome_installer.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe ZhuDongFangYu.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1237_none_9ad73d125ac89655\r\bfsvc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_119b1e415d838a28\r\autoconv.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.746_none_72f50b15ab3c2aeb\f\ProximityUxHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\f\immersivetpmvscmgrsvr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.19041.1_none_0e40322ba49953c6\cacls.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.19041.1_none_58ba966f5b8ade0b\dpnsvr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_5940d1a4fc4ad8f3\r\backgroundTaskHost.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.1266_none_18784aba5fcd68cc\TokenBrokerCookies.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.1266_none_22ccf50c942e2ac7\f\TokenBrokerCookies.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1266_none_82441dbab862ff6a\msoobe.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.746_none_dbfd31e3890afb72\f\SensorDataService.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\msil_edmgen_b77a5c561934e089_10.0.19041.1_none_25aa820b9acb3357\EdmGen.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.19041.1_none_3ea5f185c75971c2\Ribbons.scr ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-diagnostic-results_31bf3856ad364e35_10.0.19041.1_none_ded7404f8608d19f\MdRes.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\SecureAssessmentBrowser.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\f\wmpshare.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.1_none_24a9c1e1e1b0f793\ttdinject.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2b8b5a41940eac9f\prevhost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.19041.1_none_61ef8d34a0953a91\WMIC.exe ZhuDongFangYu.exe File created C:\Windows\write.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\f\appidcertstorecheck.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.746_none_dbecc8a3cdc7c3cf\f\DataUsageLiveTileTask.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\Backup\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_b40cbfe2afd2c015_wowreg32.exe_94fc2d06 ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systray_31bf3856ad364e35_10.0.19041.1_none_b39734a8c9c85bd3\systray.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\Taskmgr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_737d8b2eaaa38234\DWWIN.EXE ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.19041.423_none_0b0196a3d38fda4e\f\OOBENetworkConnectionFlow.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.19041.1_none_75cabfc3071adb42\certutil.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_f57e58b71b913c6b\r\auditpol.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_b93dce693a9c6db9\r\WinRTNetMUAHostServer.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.1266_none_c4b179e0b12fe4b9\winload.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.117_none_9be21f0ef860b570\r\wslhost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.19041.1_none_3f67a7384812df13\ComSvcConfig.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\r\CustomInstallExec.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_c939d70420d81ce4\logagent.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.1_none_8df65f134a48195f\rundll32.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.746_none_48b2bd808a742e25\f\netbtugc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.19041.423_none_12ca604b48f8d3fb\f\CapturePicker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.19041.746_none_e5e33ba764e4ddec_bridgeunattend.exe_60b7e340 ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_10.0.19041.1_none_f4b2fffd9da4c90a\InstallUtil.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVNice.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.19041.746_none_a5986eca8fd4063b\f\CastSrv.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.19041.746_none_a5ade2e84580e250\r\DmNotificationBroker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.19041.1202_none_fceb29af5a61f7e6\f\bcdedit.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\f\ImeBroker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.19041.1_none_4e5e653d48e95632\iexpress.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1_none_20dbe0239a0c22b4\vdsldr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.264_none_223a5768a6257099\f\CustomShellHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.19041.1_none_a47f90601a54e2cd\dialer.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_aa284d65c7bee591\f\upnpcont.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\notepad.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1052_none_b39097e5dc722fb4\f\GamePanel.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.19041.1_none_0e4d25c8cb52f8d0\WFServicesReg.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\ReAgentc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\f\LaunchTM.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.19041.1_none_67494c7cd91d4b47\odbcconf.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1_none_b817dbd29134ec4d\GameBarPresenceWriter.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.19041.1_none_62d38a38e1f19c9f\nfsclnt.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.867_none_099246ae3a45708c\r\printfilterpipelinesvc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_adf98e02f565c8fe\unlodctr.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\f\BitLockerWizardElev.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_2e15548db03a22c8\CheckNetIsolation.exe ZhuDongFangYu.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5072 4ba339919ff392d0353c074987afe19d_icedid_xiaobaminer_JC.exe Token: SeDebugPrivilege 3656 ZhuDongFangYu.exe Token: 33 3656 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 3656 ZhuDongFangYu.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5072 4ba339919ff392d0353c074987afe19d_icedid_xiaobaminer_JC.exe 3656 ZhuDongFangYu.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5072 wrote to memory of 3656 5072 4ba339919ff392d0353c074987afe19d_icedid_xiaobaminer_JC.exe 86 PID 5072 wrote to memory of 3656 5072 4ba339919ff392d0353c074987afe19d_icedid_xiaobaminer_JC.exe 86 PID 5072 wrote to memory of 3656 5072 4ba339919ff392d0353c074987afe19d_icedid_xiaobaminer_JC.exe 86 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ba339919ff392d0353c074987afe19d_icedid_xiaobaminer_JC.exe"C:\Users\Admin\AppData\Local\Temp\4ba339919ff392d0353c074987afe19d_icedid_xiaobaminer_JC.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3656
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html
- Size 12KB
- SHA256 442c6bfe7c011e24f8c0bb1c0584b96cf804eb7198d4aacffa4c5f6769ff4215
- MD5 33f73419b8fc156a8a5e0eee311a2639
- SHA1 7ebd3842e080ed34f4675eea740c3e90d8db7bc2
- SHA512 1f9e3a64bfc78cea57f4d9fce2ff4f9adfbe7526ef10e40eaa7cd9b8109cfa124b306f6d3be5e1a777bb604dc2c497623aa9298f580cd7e9a6e3bb9818e819ad
- SSDEEP 192:zMd9c90b89tOcOHdTaxtYz/Nf41E1HlxgNc9cu5HfabuFPWu0:gd9o049YTaoz/t41EcR8/aCFPWu0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html
- Size 8KB
- SHA256 fd516ab385f8dabba0da1377f5dfdc0dbdefdd224d823313eff24e8fb00c6217
- MD5 ffbe89b376301d5a5e1602502f3a049e
- SHA1 4fd73b0508a04073411bfb0af9f1e77a2009850a
- SHA512 25807dacb22621f69dfc9b85464e566a11b6f417632c9d2dac92b5112a8495aacc5edb2938e5515a59843fe79f25b5c65a280b41fb9b0c27bfce2b4da48cfa02
- SSDEEP 192:BKd0PKSgaKbWKG7Mh2NdbqXu60oCNKzsYck5DWMbr+y6dmrM0ZqkPWu0:BKd1aKSKYMhgKIYf4I+y6d0vZrPWu0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
- Size 575KB
- SHA256 4aec0076cfba0d3df24da2de6f0aec84f1d3b6442e29faf665ee1166d55094d5
- MD5 4ba339919ff392d0353c074987afe19d
- SHA1 59c272f232cd093ba05ce99ff15e46fbf5af1b2e
- SHA512 9c10b6d937a4451e3ec2e29d056995d5a997a621f74754f82aac070bc8c22923b7891737c7f6cfd313df9a936bf217503337fcbbd9fe57c883d088a8d40ecfe2
- SSDEEP 6144:9b4S+1Mvyr3UGv9JYT7E0CQPc8I6NfC8zAVQiI+WjFDfoY9+6s6Be/ODsTnJzQlN:9bu+yrST7EJicgNfzcQiHmNJLBIuntH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
- Size 575KB
- SHA256 4aec0076cfba0d3df24da2de6f0aec84f1d3b6442e29faf665ee1166d55094d5
- MD5 4ba339919ff392d0353c074987afe19d
- SHA1 59c272f232cd093ba05ce99ff15e46fbf5af1b2e
- SHA512 9c10b6d937a4451e3ec2e29d056995d5a997a621f74754f82aac070bc8c22923b7891737c7f6cfd313df9a936bf217503337fcbbd9fe57c883d088a8d40ecfe2
- SSDEEP 6144:9b4S+1Mvyr3UGv9JYT7E0CQPc8I6NfC8zAVQiI+WjFDfoY9+6s6Be/ODsTnJzQlN:9bu+yrST7EJicgNfzcQiHmNJLBIuntH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
- Size 575KB
- SHA256 4aec0076cfba0d3df24da2de6f0aec84f1d3b6442e29faf665ee1166d55094d5
- MD5 4ba339919ff392d0353c074987afe19d
- SHA1 59c272f232cd093ba05ce99ff15e46fbf5af1b2e
- SHA512 9c10b6d937a4451e3ec2e29d056995d5a997a621f74754f82aac070bc8c22923b7891737c7f6cfd313df9a936bf217503337fcbbd9fe57c883d088a8d40ecfe2
- SSDEEP 6144:9b4S+1Mvyr3UGv9JYT7E0CQPc8I6NfC8zAVQiI+WjFDfoY9+6s6Be/ODsTnJzQlN:9bu+yrST7EJicgNfzcQiHmNJLBIuntH
- MD5 SHA1 SHA512 SSDEEP