Analysis
-
max time kernel
145s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 07:32
Behavioral task
behavioral1
Sample
2024-05-24_5c69cea1526cfd434a0285f72b1b0a6f_icedid_xiaobaminer.exe
Resource
win7-20240419-en
General
-
Target
2024-05-24_5c69cea1526cfd434a0285f72b1b0a6f_icedid_xiaobaminer.exe
-
Size
3.0MB
-
MD5
5c69cea1526cfd434a0285f72b1b0a6f
-
SHA1
b6376b7741b98b0d3a345b00066c7e7d9bf6adb7
-
SHA256
8d3ed905410544bcd46e7665fd25c1f1e9a5c62625844ae86e46ffff8b75bb41
-
SHA512
bba0f44407bd344686a83ef78d5276251e2572f34397c39878aed12caf35d4d802fae3efebf418c08e0c2dbcacf7540c21ddb4ba51a25faa6cba241a8b40994e
-
SSDEEP
49152:7bIqnzcErNNQJ1uvFYgjI45TMwwapIgThpYqcpYq:4bBLapIK6Z6
Malware Config
Signatures
-
Detect Blackmoon payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/1276-0-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/1276-1-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe family_blackmoon behavioral2/memory/1276-11-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/1936-354-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/1936-490-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe -
Drops file in Drivers directory 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-05-24_5c69cea1526cfd434a0285f72b1b0a6f_icedid_xiaobaminer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 2024-05-24_5c69cea1526cfd434a0285f72b1b0a6f_icedid_xiaobaminer.exe -
Executes dropped EXE 1 IoCs
Processes:
ZhuDongFangYu.exepid process 1936 ZhuDongFangYu.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
ZhuDongFangYu.exedescription ioc process File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe File created F:\autorun.inf ZhuDongFangYu.exe File opened for modification F:\autorun.inf ZhuDongFangYu.exe File created C:\autorun.inf ZhuDongFangYu.exe File opened for modification C:\autorun.inf ZhuDongFangYu.exe -
Drops file in System32 directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\SysWOW64\dcomcnfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\help.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\whoami.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dvdplay.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\net1.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Robocopy.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\more.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\credwiz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ddodiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\relog.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sort.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\tar.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\attrib.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cleanmgr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\format.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\bitsadmin.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmstp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\perfmon.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\msfeedssync.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PkgMgr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\appidtel.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\runonce.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\taskkill.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\typeperf.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rrinstaller.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\tcmsetup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Fondue.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\GamePanel.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\icacls.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\pcaui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\proquota.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TpmInit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\F12\IEChooser.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\autofmt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dllhst3g.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fixmapi.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\LaunchTM.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SecEdit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fontview.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\msra.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wextract.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\eventvwr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Netplwiz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\subst.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TSTheme.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\w32tm.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\lodctr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mspaint.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sethc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wowreg32.exe ZhuDongFangYu.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateBroker.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE ZhuDongFangYu.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe ZhuDongFangYu.exe File created C:\Program Files\Internet Explorer\ieinstal.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\7-Zip\7z.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html ZhuDongFangYu.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe ZhuDongFangYu.exe File created C:\Program Files\Internet Explorer\iexplore.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\locallaunch\locallaunch.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\HideMerge.htm ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WebviewOffline.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\WebviewOffline.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html ZhuDongFangYu.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe ZhuDongFangYu.exe -
Drops file in Windows directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\404-7.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\LearnMore.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\403-10.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\http_406.htm ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\ScriptRunner.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\r\winload.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.19041.1_none_3e7b05a1a0865eeb\ktmutil.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.19041.153_none_59d1094dec9b8480\f\Spectrum.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobelightfooterhost.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\500-13.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\SpeechRuntime.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\CustomInstallExec.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.19041.746_none_61e0347e850155a8\r\UserOOBEBroker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1266_none_b5fa73367bbd2f91\r\klist.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.82_none_2358a116979cc599\FlashUtil_ActiveX.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.153_none_70cb6ca43c818606\cmdiag.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_9e094af3987dca57\f\svchost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_b40cbfe2afd2c015\r\wowreg32.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_aa284d65c7bee591\f\upnpcont.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\r\wsmprovhost.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.19041.1_none_53ab1b93e0160a53\RpcPing.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.19041.746_none_77bd4cfbe87238a7\f\SnippingTool.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.19041.1_none_ad9c6c9be4203192\Netplwiz.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\invalidcert.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\http_500.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_1befc89391e44c23\convert.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_4621ad58d5f654dd\r\Robocopy.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\wscript.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1_none_82af78fa7992ecce\uwfmgr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVStreamingUX.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.84_none_29cf9b86db5fb249\Setup.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\f\UpdateNotificationMgr.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\OfflineTabs\OfflineTabs.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.19041.1237_none_9d556cf140e198b4\f\RecoveryDrive.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\finger.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.19041.207_none_59ba79211607f58f\r\WinSAT.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoftwindows-undockeddevkit.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a22e961d4bcae1e\UndockedDevKit.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1_none_906b4c073d1d970c\msconfig.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_a4bfcaa32abfcf0e\f\raserver.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_f5ba41fece31d7fe\SpatialAudioLicenseSrv.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\http_gen.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1_none_e3ab86b70c430b3c\wordpad.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\f\sdchange.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.746_none_2c2bcd67e9d4665c\f\FileHistory.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.19041.1_none_7c2c890be7329496\verclsid.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\PhishSiteEdge.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\msil_inspectvhddialog6.3_31bf3856ad364e35_10.0.19041.1_none_7dca23f8be8c25d6\InspectVhdDialog6.3.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.19041.1_none_822c11b6606ec606\chkdsk.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\f\wmplayer.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\403-14.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\mavinject.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.1151_none_329784a84ed43acd\wslhost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.19041.1_none_08235f0411d49656\net.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\r\SysResetErr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\audiodg.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1_none_c36f57b8a28f2fbc\msoobe.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-calc_31bf3856ad364e35_10.0.19041.1_none_6a03b910ee7a4073\calc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.19041.1_none_efd4c696d660bdad\vbc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_5aba1063745f6e01\r\autofmt.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1_none_6bb2ce5b63f82957\FsIso.exe ZhuDongFangYu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2024-05-24_5c69cea1526cfd434a0285f72b1b0a6f_icedid_xiaobaminer.exeZhuDongFangYu.exedescription pid process Token: SeDebugPrivilege 1276 2024-05-24_5c69cea1526cfd434a0285f72b1b0a6f_icedid_xiaobaminer.exe Token: SeDebugPrivilege 1936 ZhuDongFangYu.exe Token: 33 1936 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 1936 ZhuDongFangYu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-05-24_5c69cea1526cfd434a0285f72b1b0a6f_icedid_xiaobaminer.exeZhuDongFangYu.exepid process 1276 2024-05-24_5c69cea1526cfd434a0285f72b1b0a6f_icedid_xiaobaminer.exe 1936 ZhuDongFangYu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-05-24_5c69cea1526cfd434a0285f72b1b0a6f_icedid_xiaobaminer.exedescription pid process target process PID 1276 wrote to memory of 1936 1276 2024-05-24_5c69cea1526cfd434a0285f72b1b0a6f_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 1276 wrote to memory of 1936 1276 2024-05-24_5c69cea1526cfd434a0285f72b1b0a6f_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 1276 wrote to memory of 1936 1276 2024-05-24_5c69cea1526cfd434a0285f72b1b0a6f_icedid_xiaobaminer.exe ZhuDongFangYu.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5c69cea1526cfd434a0285f72b1b0a6f_icedid_xiaobaminer.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_5c69cea1526cfd434a0285f72b1b0a6f_icedid_xiaobaminer.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exeFilesize
3.0MB
MD55c69cea1526cfd434a0285f72b1b0a6f
SHA1b6376b7741b98b0d3a345b00066c7e7d9bf6adb7
SHA2568d3ed905410544bcd46e7665fd25c1f1e9a5c62625844ae86e46ffff8b75bb41
SHA512bba0f44407bd344686a83ef78d5276251e2572f34397c39878aed12caf35d4d802fae3efebf418c08e0c2dbcacf7540c21ddb4ba51a25faa6cba241a8b40994e
-
C:\vcredist2010_x86.log.htmlFilesize
82KB
MD581c35fe848c0383ffea47697999d08b5
SHA1f8fbda7a7e4c1b5c6857cd7bacee2c6ac6e1431d
SHA2564fde901666cd1657b931d5f3e6b28cfc668544c8c7a759bd5729733bb0c79147
SHA512b067b7664a297e11ec94e0776a889d34f47057662a470e7a3d907e7158fa2d0ab476e4dd21c390fadd22efc27be9add81441deddb596e4005e809ca8514ab913
-
memory/1276-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1276-1-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1276-11-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1936-354-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1936-490-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB