Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 16:42
Behavioral task
behavioral1
Sample
2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exe
Resource
win7-20240221-en
General
-
Target
2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exe
-
Size
483KB
-
MD5
ce15ea005696baaed4d0da6b7f36934d
-
SHA1
2f2aa8bd0ccfe7868660246ea779107b26179684
-
SHA256
facfff04cbfcbebd3d8ee3ca98745cfd7f1e251d766f5bf1a28b905d36f46268
-
SHA512
b8ce76c16084c87019d517edcbeee2a968fef701b2636e6a3ee7bddd9a806e9be37b59d3eac693a2fc52924250fe0460bc047a4be7e1e1a8bc561f991b26e1c5
-
SSDEEP
6144:7b42+1Mvyr3UGv9JYB1Z3jccvQVCrnOxfPinOxatBCAC9pKI:7b++yrSB1Z3jccvQVCrNHtBCAC9pKI
Malware Config
Signatures
-
Detect Blackmoon payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4972-0-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/4972-1-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe family_blackmoon behavioral2/memory/4972-14-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/2320-259-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe -
Drops file in Drivers directory 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exe -
Executes dropped EXE 1 IoCs
Processes:
ZhuDongFangYu.exepid process 2320 ZhuDongFangYu.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification D:\autorun.inf ZhuDongFangYu.exe File created F:\autorun.inf ZhuDongFangYu.exe File opened for modification F:\autorun.inf ZhuDongFangYu.exe File created C:\autorun.inf ZhuDongFangYu.exe File opened for modification C:\autorun.inf ZhuDongFangYu.exe File created D:\autorun.inf ZhuDongFangYu.exe -
Drops file in System32 directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\SysWOW64\odbcad32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\xwizard.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\MRINFO.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\clip.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dcomcnfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wusa.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\newdev.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RmClient.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\systray.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\tttracer.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WerFault.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\chkntfs.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\edpnotify.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\msinfo32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rekeywiz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\relog.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WWAHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fltMC.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\hh.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mavinject.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TSTheme.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\unregmp2.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wevtutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cacls.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ddodiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wsmprovhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\subst.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\attrib.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Dism.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Robocopy.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wscript.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\AtBroker.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\setx.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SndVol.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\upnpcont.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\driverquery.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\extrac32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\finger.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\powercfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\appidtel.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cliconfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sort.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\svchost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TpmTool.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ctfmon.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\perfhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PresentationHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fsutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\isoburn.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\gpscript.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe ZhuDongFangYu.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdateBroker.exe ZhuDongFangYu.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\msedge_proxy.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\122.0.2365.52\MicrosoftEdge_X64_122.0.2365.52.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\pwahelper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\7-Zip\7z.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\cookie_exporter.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\elevation_service.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdateSetup.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\setup_wm.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_helper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdateOnDemand.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedge_pwa_launcher.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\dotnet\dotnet.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe ZhuDongFangYu.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe ZhuDongFangYu.exe -
Drops file in Windows directory 64 IoCs
Processes:
ZhuDongFangYu.exe2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_76e6fb38a70dbd6d\GameBarPresenceWriter.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_b321f2c2ab7710a2\sdbinst.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.746_none_c291aefd01a5d6d6\f\EoAExperiences.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.423_none_841c30f68571c385\hnsdiag.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_e304dcaa2490f61c\r\SystemUWPLauncher.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1_none_dc058eb644f1f90b\bfsvc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.928_none_85ac1b118ff2a924\f\dxgiadaptercache.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\r\oobeldr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.19041.746_none_45062eb997366a7f\r\RemoteAppLifetimeManager.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.1266_none_c4b179e0b12fe4b9\winload.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_7777dd52093f9dd6\control.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1_none_bf56a5e7532d9c79\licensingdiag.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\f\ChtIME.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\oobeldr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.1_none_43a1294286598aee\IcsEntitlementHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_b321f2c2ab7710a2\r\sdbinst.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..services-core-files_31bf3856ad364e35_10.0.19041.1_none_45dc4032c659ae7c\dsamain.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.19041.746_none_251e769058968366\f\Dxpserver.exe ZhuDongFangYu.exe File opened for modification C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe 2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.1052_none_0bde546bcaf8e34a\f\ClipUp.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.19041.1202_none_fceb29af5a61f7e6\r\bcdedit.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1_none_233543e4fce957ae\cleanmgr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.19041.1_none_4c44763647728882\RuntimeBroker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.19041.1_none_00c77b5a9e4f1bee\dsmgmt.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_abd26b7610cb738e\AddSuggestedFoldersToLibraryDialog.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\Taskmgr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\CallingShellApp.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVDllSurrogate.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.19041.746_none_e540b68b09558f5a\f\LockScreenContentServer.exe ZhuDongFangYu.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.19041.844_none_93c03ca99a47dc8f\f\omadmprc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.1288_none_f92f7256107c0e35\r\nvspinfo.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.1_none_f4db83a870443aa2\CloudExperienceHostBroker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\f\AssignedAccessLockApp.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevTemplateBaselineGenerator.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\CloudExperienceHostBroker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\f\ByteCodeGenerator.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\f\CallingShellApp.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_46ba1386f4ce2b0b\diskpart.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_4.0.15805.0_none_faee98a3c711fae7\AddInProcess32.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.1_none_37f2e74a0020dc93\pcaui.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\f\appidcertstorecheck.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.19041.1_none_f4025a506f9e9f01\bootim.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.19041.1_none_b970f5eb6342eadb\dpnsvr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.19041.1_none_c9157ddc38b83b1b\aspnet_regsql.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\r\hvix64.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\f\hvax64.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\ApplyTrustOffline.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\r\drvinst.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVDllSurrogate.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\ByteCodeGenerator.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.928_none_138fb436497565f4\r\directxdatabaseupdater.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.1288_none_75442af2fe19577c\tcblaunch.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.1_none_126d541494a0ae5b\CCG.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1151_none_ae854961a06058b2\f\dmcertinst.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe ZhuDongFangYu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exeZhuDongFangYu.exedescription pid process Token: SeDebugPrivilege 4972 2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exe Token: SeDebugPrivilege 2320 ZhuDongFangYu.exe Token: 33 2320 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 2320 ZhuDongFangYu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exeZhuDongFangYu.exepid process 4972 2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exe 2320 ZhuDongFangYu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exedescription pid process target process PID 4972 wrote to memory of 2320 4972 2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 4972 wrote to memory of 2320 4972 2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 4972 wrote to memory of 2320 4972 2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exe ZhuDongFangYu.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_ce15ea005696baaed4d0da6b7f36934d_icedid_xiaobaminer.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2320
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵PID:4940
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exeFilesize
483KB
MD5ce15ea005696baaed4d0da6b7f36934d
SHA12f2aa8bd0ccfe7868660246ea779107b26179684
SHA256facfff04cbfcbebd3d8ee3ca98745cfd7f1e251d766f5bf1a28b905d36f46268
SHA512b8ce76c16084c87019d517edcbeee2a968fef701b2636e6a3ee7bddd9a806e9be37b59d3eac693a2fc52924250fe0460bc047a4be7e1e1a8bc561f991b26e1c5
-
memory/2320-259-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4972-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4972-1-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4972-14-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB