Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 06:02
Behavioral task
behavioral1
Sample
2024-05-18_89e42e00a254301818f04bcd76fefffb_icedid_xiaobaminer.exe
Resource
win7-20240221-en
General
-
Target
2024-05-18_89e42e00a254301818f04bcd76fefffb_icedid_xiaobaminer.exe
-
Size
7.8MB
-
MD5
89e42e00a254301818f04bcd76fefffb
-
SHA1
3aa475d0ad23f576088f0dad74d78f3f9cc8c419
-
SHA256
5b72a670584e91af70c62db03fb28205b771fac2f072ea501a99014ddccb1b25
-
SHA512
6b6cbff9e4ed3d42abc26d789574bd55c47bdee1ab9d308b5738644d49f04bfbf2003ed0581ae05e50fbaedf910ee152360c755a48f6668e4f3e109e6b53d823
-
SSDEEP
98304:JT6tWQtZ/K0tGOFWVRuLftCTcm6Z6aLapI9:J6tWyZ/K0ttYVAATcm6Z6acI9
Malware Config
Signatures
-
Detect Blackmoon payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/1288-0-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/1288-1-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe family_blackmoon behavioral2/memory/1288-13-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/704-15-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/704-355-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/704-485-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe -
Drops file in Drivers directory 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-05-18_89e42e00a254301818f04bcd76fefffb_icedid_xiaobaminer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 2024-05-18_89e42e00a254301818f04bcd76fefffb_icedid_xiaobaminer.exe -
Executes dropped EXE 1 IoCs
Processes:
ZhuDongFangYu.exepid process 704 ZhuDongFangYu.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
ZhuDongFangYu.exedescription ioc process File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe File created F:\autorun.inf ZhuDongFangYu.exe File opened for modification F:\autorun.inf ZhuDongFangYu.exe File created C:\autorun.inf ZhuDongFangYu.exe File opened for modification C:\autorun.inf ZhuDongFangYu.exe -
Drops file in System32 directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\SysWOW64\Utilman.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WerFault.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\whoami.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\write.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\DWWIN.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\isoburn.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RmClient.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wecutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mmc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\powercfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\winrs.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\stordiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\unlodctr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cttunesvr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SearchIndexer.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\taskkill.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\user.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\choice.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cliconfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\xcopy.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\perfmon.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\regsvr32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Dism.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dxdiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mavinject.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\MuiUnattend.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PING.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\verifiergui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wextract.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmmon32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dpapimig.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ftp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\LaunchTM.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\schtasks.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\autoconv.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\colorcpl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\OposHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wiaacmgr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wowreg32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\netsh.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\hh.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mcbuilder.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sdiagnhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\takeown.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmdkey.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmdl32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\logagent.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\net1.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wlanext.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dpnsvr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\msra.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\winver.exe ZhuDongFangYu.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\ThirdPartyNotices\ThirdPartyNotices.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\notificationCenter.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe ZhuDongFangYu.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\pages\wefgalleryonenoteinsertwinrt.htm ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE ZhuDongFangYu.exe File created C:\Program Files\Windows Mail\wabmig.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\RepairDebug.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe ZhuDongFangYu.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe ZhuDongFangYu.exe -
Drops file in Windows directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7000e6adf00c3d30\f\CloudNotifications.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_d19001beed7624dc\r\CertEnrollCtrl.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\rwinsta.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobedevicepairing-main.html ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.19041.1_none_c9157ddc38b83b1b\aspnet_regsql.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\winresume.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\cmproxyd.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\gpupdate.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.19041.1_none_238f55dfbfb45941\Register-CimProvider.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.1_none_e190f18a08ed1a44\FlashUtil_ActiveX.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\UNPUXLauncher.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\f\fltMC.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\pdferror.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\401.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\403-16.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_3bcd0306a19592e2\r\Robocopy.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\view\oobe-chrome-footer-template.html ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Loading.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\401-5.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\403-6.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.19041.1202_none_24329c73afbd2316\f\DeviceCensus.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\f\wmplayer.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmcreate_31bf3856ad364e35_10.0.19041.1_none_8d387dde0a6c6d14\VMCreate.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.19041.662_none_746c3bfaa509091f\dtdump.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.19041.1_none_d31059e0b2fa6d47\aspnet_regiis.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\403-18.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_46ba1386f4ce2b0b\diskpart.exe ZhuDongFangYu.exe File opened for modification C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.19041.1_none_d3e3ad84b24cfdfe\NisSrv.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\navcancl.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1_none_9613f8b833f2e8f1\ByteCodeGenerator.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.1_none_26e3edd6087852fc\backgroundTaskHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.19041.1_none_0220120c9d66a59c\dcdiag.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.19041.1_none_c367e800917abc7d\odbcconf.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_10.0.19041.1_none_c45aa783f860ee61\WsatConfig.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.19041.84_none_9e56f6c66f3fd630\mfpmp.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.1266_none_c4b179e0b12fe4b9\r\winload.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\retailDemoShutdowns.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\WpcBlockFrame.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.19041.264_none_7a40d01e6ba302b9\mfpmp.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\403-19.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\http_406.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.19041.1_none_765fc5f6e37c509d\ieinstal.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.1202_none_7f995fddf54c000c\r\SppExtComObj.Exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\wkspbroker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\wsmprovhost.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\http_410.htm ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\navcancl.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.1023_none_5c93ef2449c89609\r\securekernel.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.1052_none_0bde546bcaf8e34a\ClipUp.exe ZhuDongFangYu.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config.comments ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\view\default-contentview-template.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\500-17.htm ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.19041.1_none_2aa26221a7a3d549\stordiag.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\UNPUXHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1_none_805682e34c6552d0\wsmprovhost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\SearchIndexer.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\f\EaseOfAccessDialog.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\ooberegion-main.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\f12host.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\CloudExperienceHostBroker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\pdferrorunknownerror.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..oreuap-iotuap-tools_31bf3856ad364e35_10.0.19041.1_none_e15558ebc4b8bd81\iotstartup.exe ZhuDongFangYu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2024-05-18_89e42e00a254301818f04bcd76fefffb_icedid_xiaobaminer.exeZhuDongFangYu.exedescription pid process Token: SeDebugPrivilege 1288 2024-05-18_89e42e00a254301818f04bcd76fefffb_icedid_xiaobaminer.exe Token: SeDebugPrivilege 704 ZhuDongFangYu.exe Token: 33 704 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 704 ZhuDongFangYu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-05-18_89e42e00a254301818f04bcd76fefffb_icedid_xiaobaminer.exeZhuDongFangYu.exepid process 1288 2024-05-18_89e42e00a254301818f04bcd76fefffb_icedid_xiaobaminer.exe 704 ZhuDongFangYu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-05-18_89e42e00a254301818f04bcd76fefffb_icedid_xiaobaminer.exedescription pid process target process PID 1288 wrote to memory of 704 1288 2024-05-18_89e42e00a254301818f04bcd76fefffb_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 1288 wrote to memory of 704 1288 2024-05-18_89e42e00a254301818f04bcd76fefffb_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 1288 wrote to memory of 704 1288 2024-05-18_89e42e00a254301818f04bcd76fefffb_icedid_xiaobaminer.exe ZhuDongFangYu.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-18_89e42e00a254301818f04bcd76fefffb_icedid_xiaobaminer.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-18_89e42e00a254301818f04bcd76fefffb_icedid_xiaobaminer.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:704
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.8MB
MD589e42e00a254301818f04bcd76fefffb
SHA13aa475d0ad23f576088f0dad74d78f3f9cc8c419
SHA2565b72a670584e91af70c62db03fb28205b771fac2f072ea501a99014ddccb1b25
SHA5126b6cbff9e4ed3d42abc26d789574bd55c47bdee1ab9d308b5738644d49f04bfbf2003ed0581ae05e50fbaedf910ee152360c755a48f6668e4f3e109e6b53d823
-
Filesize
81KB
MD5f8a7112bbde0758ba3c66d46a2e2881f
SHA1be29d81c9aae9feb73002c40099a5cc09fd5f54a
SHA256bd148bd94cd9be343d9bc1dc8d131fba21e526a1157672c233b3948bc7d8dec3
SHA512b92ebd8cbe911eb73429bd2114a710d9b16396b1026fb9dc1256e14aac357a8958e072251fe0ba6f1787d8405f98c85920a586fb11a8ff75e723120c98aefd04