Analysis
-
max time kernel
143s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2024, 01:28
Behavioral task
behavioral1
Sample
2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe
Resource
win7-20240221-en
General
-
Target
2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe
-
Size
2.5MB
-
MD5
b17f007b29bec3489eab9dd1f9b7fd6a
-
SHA1
e132a7f550fb314bc9e1eaeda7d781ee9c1752bc
-
SHA256
4688ce4c9472819a7624da8903385b504fb85661b520b7bd5ff4b65a34321d7a
-
SHA512
0d2e9f834363dd5e47e41a04168317ac324dca264553cbf84a203f64f442f4c1055976d845b621e604cd63fe4cd5e488aaae3a8719516dbd6c5e1bb2320cb8c6
-
SSDEEP
49152:7bIqnzcErNNQJ1uvFYgjI45TMwwapIgThpYq:4bBLapIK6
Malware Config
Signatures
-
Detect Blackmoon payload 6 IoCs
resource yara_rule behavioral2/memory/2660-0-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/2660-1-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/files/0x0007000000023421-6.dat family_blackmoon behavioral2/memory/2660-13-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/3216-354-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/3216-493-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe -
Executes dropped EXE 1 IoCs
pid Process 3216 ZhuDongFangYu.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf ZhuDongFangYu.exe File opened for modification C:\autorun.inf ZhuDongFangYu.exe File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe File created F:\autorun.inf ZhuDongFangYu.exe File opened for modification F:\autorun.inf ZhuDongFangYu.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\stordiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wevtutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\curl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\provlaunch.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\setx.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cttune.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\msra.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\systray.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TRACERT.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\pcaui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sdchange.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\waitfor.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\winver.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ARP.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dxdiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\finger.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\gpresult.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TSTheme.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ttdinject.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wiaacmgr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmmon32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fsquirt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\odbcad32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\prevhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\replace.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cscript.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\eventcreate.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\instnm.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cacls.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\setup16.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\winrs.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\runas.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sethc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\svchost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\bthudtask.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dtdump.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fsutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\gpupdate.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\schtasks.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sort.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\iscsicpl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\msiexec.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Robocopy.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\at.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\find.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\subst.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wsmprovhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fltMC.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe ZhuDongFangYu.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseHostPage.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html ZhuDongFangYu.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe ZhuDongFangYu.exe File created C:\Program Files\Internet Explorer\iexplore.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\WebviewOffline.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{F3190C87-06A4-407A-A58A-3F71181B4541}\chrome_installer.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\notificationCenter.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE ZhuDongFangYu.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_eventviewersettings_31bf3856ad364e35_10.0.19041.1_none_b53d8fdcd7716c78\eventvwr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.264_none_be8a8ad4892e651d\f\printui.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\500-15.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\CloudExperienceHostBroker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\msinfo32.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.1266_none_e6ebbe2a02425392\autopilotwhitegloveresult-main.html ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\network\network.html ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1288_none_f26bd0dcdf662cc9\f\AgentService.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_63b0fc68ee30f2cb\IMESEARCH.EXE ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.19041.746_none_11e04cec24452336\r\dwm.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_72c6a00123f43c47\r\quickassist.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.1_none_6bac6724a4ab4460\svchost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_f3a9dc0fe254a157\wmpconfig.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\403-2.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\404-3.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\winload.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.867_none_099246ae3a45708c\f\printfilterpipelinesvc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.19041.746_none_b7a67ddd8bcc7470\ApplicationFrameHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_d93ee361fbbc8f0a\f\XGpuEjectDialog.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.746_none_eda92e20fee7d318\r\PhotoScreensaver.scr ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\common-listview-template.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\403-5.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.19041.1_none_19c9b562d4b65581\IMTCPROP.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.746_none_58702f801199ce06\NetCfgNotifyObjectHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\403-2.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.19041.1202_none_c26e06f4b82585b5\f\dmclient.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.19041.746_none_9043799a93dba365\f\LicenseManagerShellext.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1_none_eae66734659b60d0\wowreg32.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\r\EaseOfAccessDialog.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\http_500.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc\WinMgmt.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\wmpshare.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\forbidframingedge.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\403-14.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.1165_none_a82485b8f343811f\r\WaaSMedicAgent.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.1_none_2a38e2996ee84e57\TapiUnattend.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\unifiedEnrollmentProgress.html ZhuDongFangYu.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\ByteCodeGenerator.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\winresume.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-getmac_31bf3856ad364e35_10.0.19041.1_none_c1efa43e415898e4\getmac.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..pdate-oob-component_31bf3856ad364e35_10.0.19041.84_none_e539abe3d27f675f\f\rdvgm.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.264_none_31474dbf12ce5adc\r\XblGameSaveTask.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\unifiedEnrollment\views\unifiedEnrollmentProgress.html ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.1151_none_b46b739f71bbb8b7\bash.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.1266_none_8f272afdd624490f\sppsvc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.264_none_6ea6dfb6393e5f06\DataStoreCacheDumpTool.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1_none_a068a30a6853aaec\ByteCodeGenerator.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1_none_595f2a7acaf53bba\WpcUapApp.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_6e05a6bb2291b4c6\IMESEARCH.EXE ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_e43cebe9807e08e3\r\setupugc.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\servbusy.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\defaultbrowser.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.19041.1_none_c9157ddc38b83b1b\aspnet_regsql.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_f15a0c837b51c5fc\gpresult.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\usocoreworker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_9fcce199936290f4\f\upnpcont.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_fbaeb6d5afb287f7\gpupdate.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.19041.1_none_a4a8dfd6e5f1aab8\dsmgmt.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\wslconfig.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\r\wscadminui.exe ZhuDongFangYu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2660 2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe Token: SeDebugPrivilege 3216 ZhuDongFangYu.exe Token: 33 3216 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 3216 ZhuDongFangYu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2660 2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe 3216 ZhuDongFangYu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2660 wrote to memory of 3216 2660 2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe 83 PID 2660 wrote to memory of 3216 2660 2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe 83 PID 2660 wrote to memory of 3216 2660 2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe 83 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3216
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5b17f007b29bec3489eab9dd1f9b7fd6a
SHA1e132a7f550fb314bc9e1eaeda7d781ee9c1752bc
SHA2564688ce4c9472819a7624da8903385b504fb85661b520b7bd5ff4b65a34321d7a
SHA5120d2e9f834363dd5e47e41a04168317ac324dca264553cbf84a203f64f442f4c1055976d845b621e604cd63fe4cd5e488aaae3a8719516dbd6c5e1bb2320cb8c6
-
Filesize
82KB
MD581c35fe848c0383ffea47697999d08b5
SHA1f8fbda7a7e4c1b5c6857cd7bacee2c6ac6e1431d
SHA2564fde901666cd1657b931d5f3e6b28cfc668544c8c7a759bd5729733bb0c79147
SHA512b067b7664a297e11ec94e0776a889d34f47057662a470e7a3d907e7158fa2d0ab476e4dd21c390fadd22efc27be9add81441deddb596e4005e809ca8514ab913