Analysis
-
max time kernel
83s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 16:40
Behavioral task
behavioral1
Sample
2024-04-28_bdafb85831d69a1abf839160bf038aa2_icedid_xiaobaminer.exe
Resource
win7-20240221-en
General
-
Target
2024-04-28_bdafb85831d69a1abf839160bf038aa2_icedid_xiaobaminer.exe
-
Size
2.4MB
-
MD5
bdafb85831d69a1abf839160bf038aa2
-
SHA1
b668a328869736e985dfabe1b44fc3343d2a59d6
-
SHA256
6531ae3a1b32f5528b3654eefda83824b9f6e7af844ad69f5148611123968211
-
SHA512
2d4c2fb1810c926a3e83c14cc85a984147c93a623f9ebb7c8b0029c0e0a98543d96d35fd4402bcdadd50141fa5b26259c881bd51c2fbcc0a9b5863598eed2d17
-
SSDEEP
49152:7bCknzcErNNQJYT7Qs13XHMRdgLaAbDiPH7PDPVChqq:S6F13XYdgpDiPbPDPVCh1
Malware Config
Signatures
-
Detect Blackmoon payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/876-0-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/876-1-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe family_blackmoon behavioral2/memory/876-11-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/1848-15-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/1848-355-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/1848-487-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe -
Drops file in Drivers directory 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-04-28_bdafb85831d69a1abf839160bf038aa2_icedid_xiaobaminer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 2024-04-28_bdafb85831d69a1abf839160bf038aa2_icedid_xiaobaminer.exe -
Executes dropped EXE 1 IoCs
Processes:
ZhuDongFangYu.exepid process 1848 ZhuDongFangYu.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
ZhuDongFangYu.exedescription ioc process File created F:\autorun.inf ZhuDongFangYu.exe File opened for modification F:\autorun.inf ZhuDongFangYu.exe File created C:\autorun.inf ZhuDongFangYu.exe File opened for modification C:\autorun.inf ZhuDongFangYu.exe File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe -
Drops file in System32 directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\format.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmmon32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\expand.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\printui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\curl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\OposHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mtstocom.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\regini.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\upnpcont.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\F12\IEChooser.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cacls.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\calc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\setup16.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\write.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mavinject.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\recover.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rrinstaller.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\setupugc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dfrgui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\print.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Utilman.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\regedt32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\shutdown.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\hdwwiz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Robocopy.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\colorcpl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cscript.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dcomcnfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wowreg32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fontdrvhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\provlaunch.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mcbuilder.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mountvol.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\msinfo32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RdpSa.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\runonce.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ktmutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\unlodctr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\winrs.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\shrpubw.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\tcmsetup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\autochk.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fontview.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\systeminfo.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\w32tm.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\eudcedit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\label.exe ZhuDongFangYu.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notetagsUI\index.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\pages\wefgalleryonenoteinsertwinrt.htm ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\ThirdPartyNotices\ThirdPartyNotices.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseHostPage.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmplayer.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html ZhuDongFangYu.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\7-Zip\7zG.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html ZhuDongFangYu.exe -
Drops file in Windows directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_f4a55c2c3386ed90\UserAccountBroker.exe ZhuDongFangYu.exe File opened for modification C:\Windows\Fonts\GlobalSansSerif.CompositeFont ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.19041.1_none_a18558d9ae23205d\scrnsave.scr ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\pdferrormfnotfound.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\pdferrorunknownerror.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\403-12.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\403-10.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_7999baeaf356e869\mofcomp.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\RetailDemo\retailDemoSetup.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\403-16.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\r\NarratorQuickStart.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_8a469514405342ff\r\PasswordOnWakeSettingFlyout.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\retailDemoSecurity.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\r\CredentialEnrollmentManager.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.662_none_0070027dab4e4ffe\UtcDecoderHost.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\http_403.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.1_none_b5ee49ccbbfbfddb\ssh.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\dnserror.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\http_403.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.84_none_40bd4149a6d52edb\r\AppVClient.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\n\SenseNdr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1_none_b0493212512a7f1a\ntprint.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\403-1.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_c2a2211ad648e627\mstsc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..tofservice-oposhost_31bf3856ad364e35_10.0.19041.1_none_3d1291badd9e7f22\OposHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\404-6.htm ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\rmttpmvscmgrsvr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\pdferror.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\404-7.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.746_none_79bfc5cb57157e98\r\WindowsActionDialog.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.19041.746_none_7aa85dbabd7172c7\PrintIsolationHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.746_none_a9ff72b1a43fd663\DeviceCredentialDeployment.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.1151_none_0f2f3a9cb1826509\r\nltest.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1_none_d4cc2ddce5811964\rdpinit.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.1_none_295bb689d5f0ebfa\powershell.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_1befc89391e44c23\r\autoconv.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.19041.1237_none_d618a074f3588a53\r\bcdboot.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1_none_639e78e5edb8f409\PickerHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_a4bfcaa32abfcf0e\r\raserver.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.19041.746_none_f47187f881cbaf7d\f\sihost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.19041.1_none_19667e7e60cb0ccd\RdpSaProxy.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_10.0.19041.1_none_00c334ebf83ee740\scrcons.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\mofcomp.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_netfx-dw_b03f5f7f11d50a3a_10.0.19041.1_none_46d7d57b97bd01e0\dw20.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\view\oobe-progress-template.html ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\oobe-toggle-template.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1_none_14f1e9e91239944a\MdmDiagnosticsTool.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-label_31bf3856ad364e35_10.0.19041.1_none_0d20194b69a60627\label.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_10.0.19041.1_none_14bead3522ecffb2\TFTP.EXE ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\r\UpdateNotificationMgr.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobeerror-main.html ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\es-ES\assets\ErrorPages\defaultbrowser.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\405.htm ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.19041.1_none_112f38db81e24102\csvde.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.19041.1_none_cd1cbc8db3875f47\csc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\f\MsSense.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3fe90cdb6667211e\r\wevtutil.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_netfx4-globalmonospacecf_b03f5f7f11d50a3a_4.0.15805.110_none_b875724f83c15432\GlobalMonospace.CompositeFont ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\401-4.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1_none_ef1691668a233417\appidtel.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_a40a1f93665b43eb\f\SndVol.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.746_none_492c8c53f3547077\r\PerceptionSimulationInput.exe ZhuDongFangYu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2024-04-28_bdafb85831d69a1abf839160bf038aa2_icedid_xiaobaminer.exeZhuDongFangYu.exedescription pid process Token: SeDebugPrivilege 876 2024-04-28_bdafb85831d69a1abf839160bf038aa2_icedid_xiaobaminer.exe Token: SeDebugPrivilege 1848 ZhuDongFangYu.exe Token: 33 1848 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 1848 ZhuDongFangYu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-04-28_bdafb85831d69a1abf839160bf038aa2_icedid_xiaobaminer.exeZhuDongFangYu.exepid process 876 2024-04-28_bdafb85831d69a1abf839160bf038aa2_icedid_xiaobaminer.exe 1848 ZhuDongFangYu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-04-28_bdafb85831d69a1abf839160bf038aa2_icedid_xiaobaminer.exedescription pid process target process PID 876 wrote to memory of 1848 876 2024-04-28_bdafb85831d69a1abf839160bf038aa2_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 876 wrote to memory of 1848 876 2024-04-28_bdafb85831d69a1abf839160bf038aa2_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 876 wrote to memory of 1848 876 2024-04-28_bdafb85831d69a1abf839160bf038aa2_icedid_xiaobaminer.exe ZhuDongFangYu.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_bdafb85831d69a1abf839160bf038aa2_icedid_xiaobaminer.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_bdafb85831d69a1abf839160bf038aa2_icedid_xiaobaminer.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exeFilesize
2.4MB
MD5bdafb85831d69a1abf839160bf038aa2
SHA1b668a328869736e985dfabe1b44fc3343d2a59d6
SHA2566531ae3a1b32f5528b3654eefda83824b9f6e7af844ad69f5148611123968211
SHA5122d4c2fb1810c926a3e83c14cc85a984147c93a623f9ebb7c8b0029c0e0a98543d96d35fd4402bcdadd50141fa5b26259c881bd51c2fbcc0a9b5863598eed2d17
-
C:\vcredist2010_x86.log.htmlFilesize
81KB
MD52328ceb58d29206a6cf53f1c365c616d
SHA1ff3060232921dc52d6426b6184ab62cf5101a8e4
SHA25642f79bc879b307a024c44a862300d1e6705121a67ea24b8c49b377e8849c1a49
SHA5120a27557c4b1767f75b8dcc86a1e2de767839b81f52695e0e5e2df904fa8e1c176d3bfa5442bd0fc337b7b499d98184bd4b851df37deeae5b68eafda20b3c9714
-
memory/876-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/876-1-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/876-11-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1848-15-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1848-355-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1848-487-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB