Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 07:33
Behavioral task
behavioral1
Sample
2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exe
Resource
win7-20240508-en
General
-
Target
2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exe
-
Size
3.8MB
-
MD5
5eb78d52d3ea9a67f973310ae04c6995
-
SHA1
8858f0fc05f9e3eba239b8fc76d6a4ba46f5b6d0
-
SHA256
d01769f29f26665a6503c66f52aeab5c5ea51144f1946cd05c43b74b9965beb1
-
SHA512
91fad6237752944c8af969353bf0684b5f2fc9cb9855d41012f11ebcfc3d1f8172e3c694e3d1df39292caa741034948fa0dbfb08b94e392ef7d5f4568b96b9a8
-
SSDEEP
49152:7bCknzcErNNQJLxgjI45TMwwapIgThpYqc/7t0i0FZaUm8cikL6:SXPLapIK6JnUm8UO
Malware Config
Signatures
-
Detect Blackmoon payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/2972-0-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral1/memory/2972-1-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe family_blackmoon behavioral1/memory/2972-7-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral1/memory/1848-9-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral1/memory/1848-373-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral1/memory/1848-767-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe -
Drops file in Drivers directory 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe -
Executes dropped EXE 1 IoCs
Processes:
ZhuDongFangYu.exepid process 1848 ZhuDongFangYu.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exepid process 2972 2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\autorun.inf ZhuDongFangYu.exe File opened for modification C:\autorun.inf ZhuDongFangYu.exe File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe File created F:\autorun.inf ZhuDongFangYu.exe File opened for modification F:\autorun.inf ZhuDongFangYu.exe -
Drops file in System32 directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\SysWOW64\cacls.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fixmapi.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mshta.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\OptionalFeatures.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wlanext.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Mystify.scr ZhuDongFangYu.exe File created C:\Windows\SysWOW64\diantz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fsutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\gpresult.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ipconfig.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\odbcconf.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\tzutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\esentutl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\expand.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\reg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sdbinst.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mcbuilder.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mfpmp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rundll32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\more.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmd.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\driverquery.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\notepad.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ntprint.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sdiagnhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\attrib.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RpcPing.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sbunattend.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\msdt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\pcaui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\poqexec.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mode.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\convert.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dplaysvr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\hdwwiz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\makecab.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\upnpcont.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\comp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\drvinst.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\iscsicpl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\label.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\w32tm.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wowreg32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mtstocom.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\user.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\verifier.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\vssadmin.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wecutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\xpsrchvw.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\regedt32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\setup16.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\timeout.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\migwiz\migwiz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\diskcopy.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TapiUnattend.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wusa.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmdl32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Dism.exe ZhuDongFangYu.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\RSSFeeds.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\settings.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\README.HTM ZhuDongFangYu.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\sidebar.exe ZhuDongFangYu.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.htm ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\flyout.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\settings.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\settings.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html ZhuDongFangYu.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\SEAMARBL.HTM ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\cpu.html ZhuDongFangYu.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\clock.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePage.html ZhuDongFangYu.exe File opened for modification C:\Program Files\7-Zip\7z.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplateRTL.html ZhuDongFangYu.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm ZhuDongFangYu.exe File created C:\Program Files\DVD Maker\DVDMaker.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html ZhuDongFangYu.exe -
Drops file in Windows directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\500-19.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Hand Prints.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_6.1.7601.17514_none_4afdc98b09e3cfe8\PkgMgr.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\mode.com ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_6.1.7600.16385_none_31db018394805d6b\TSTheme.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_6.1.7600.16385_none_8094bd7b62d2b435\ImagingDevices.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-runas_31bf3856ad364e35_6.1.7600.16385_none_bbdd3aeb771e694e\runas.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wordpad_31bf3856ad364e35_6.1.7601.17514_none_8be07ea283850f02\wordpad.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_0c66155a4e01171c\calendar.html ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-10.htm ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_6.1.7600.16385_none_f0686b7ca6acde00\wlrmdr.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\settings.html ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-session0viewer_31bf3856ad364e35_6.1.7600.16385_none_3ddbd9a9605f0519\UI0Detect.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_931b5f1fdcdd6496_wowreg32.exe_94fc2d06 ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_6.1.7601.17514_none_affb336d34ccf2f8\setup_wm.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-b..onment-dvd-etfsboot_31bf3856ad364e35_6.1.7600.16385_none_82523ed4cbbd035a\etfsboot.com ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6d48bdce24e57241\settings.html ZhuDongFangYu.exe File created C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\misc.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sonic-sbeserver_31bf3856ad364e35_6.1.7601.17514_none_7b380cb06fd9d81d\SBEServer.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.1.7600.16385_none_81d82fe9c216eb89\pcaui.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\IMCCPHR.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_6.1.7600.16385_none_a6c7190f7292676c\scrcons.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\403.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\401-1.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\406.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_17330d9420bf24e8\expand.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-eventcreate_31bf3856ad364e35_6.1.7600.16385_none_d53926c7a0e7716d\eventcreate.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_6.1.7600.16385_none_25d85b4a3e4a7709\SystemPropertiesDataExecutionPrevention.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.2.9600.16428_none_eab4546b9b62b250\iexpress.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_6.1.7600.16385_none_975df0a6f5a54628\gpupdate.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_6.1.7601.17514_none_e2a1ffe0ca40cff2\recdisc.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mapi_31bf3856ad364e35_6.1.7601.17514_none_097346be305f3966\fixmapi.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_ef38a8d0d05cc2c7\IMJPDCT.EXE ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24\newdev.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_it-it_13dfc4b03a7d762c\RSSFeeds.html ZhuDongFangYu.exe File created C:\Windows\ehome\mcspad.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\aspnetca.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_6.1.7601.17514_none_895a2b74415ea575\DismHost.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehrec_31bf3856ad364e35_6.1.7600.16385_none_a6e882bc6eb8ea53\ehrec.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_caa8f7c0e409a91f\ntoskrnl.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sysprep_31bf3856ad364e35_6.1.7600.16385_none_4b73926c122be805\sysprep.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-12.htm ZhuDongFangYu.exe File created C:\Windows\servicing\TrustedInstaller.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_6.1.7600.16385_none_c405852b31194b0b\certreq.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-fdddo_31bf3856ad364e35_6.1.7600.16385_none_b0de2afe4ca7a1e2\DeviceDisplayObjectProvider.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\500-15.htm ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-deployment_31bf3856ad364e35_6.1.7600.16385_none_57e3e87206ff08ca\setupugc.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_6.1.7600.16385_none_6b683cb78f534561\mmc.exe ZhuDongFangYu.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..inboxgames-shanghai_31bf3856ad364e35_6.1.7600.16385_none_1c98ed5d08db04ce\Mahjong.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_netfx-ngen_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_4c193e6507471ede\ngen.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_wpf-presentationhostexe_31bf3856ad364e35_6.2.7601.17514_none_3a2a6a811d2b5065\PresentationHost.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c9675951dd42e377\slideShow.html ZhuDongFangYu.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_6.1.7601.17514_none_e932cc2c30fc13b0\cmd.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-certutil_31bf3856ad364e35_6.1.7600.16385_none_b55b5e1094b0283d\certutil.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-pdm-configuration_31bf3856ad364e35_11.2.9600.16428_none_d6876629731ce419\PDMSetup.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-notepadwin_31bf3856ad364e35_6.1.7600.16385_none_9ebebe8614be1470\notepad.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_6.1.7600.16385_none_d44c0ef849349ed9\regsvr32.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-diskraid_31bf3856ad364e35_6.1.7601.17514_none_c3afa97fae99bbe4\diskraid.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-4.htm ZhuDongFangYu.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..pwindowmanager-core_31bf3856ad364e35_6.1.7601.17514_none_ebc99983d3d18578\dwm.exe ZhuDongFangYu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exeZhuDongFangYu.exedescription pid process Token: SeDebugPrivilege 2972 2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exe Token: SeDebugPrivilege 1848 ZhuDongFangYu.exe Token: 33 1848 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 1848 ZhuDongFangYu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exeZhuDongFangYu.exepid process 2972 2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exe 1848 ZhuDongFangYu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exedescription pid process target process PID 2972 wrote to memory of 1848 2972 2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 2972 wrote to memory of 1848 2972 2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 2972 wrote to memory of 1848 2972 2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 2972 wrote to memory of 1848 2972 2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exe ZhuDongFangYu.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_5eb78d52d3ea9a67f973310ae04c6995_icedid_xiaobaminer.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.htmlFilesize
16KB
MD5081cb3205f5ff51cc3bfe5f13bb3d790
SHA1026be415f3c52dfa373c69c714d4b170268dd719
SHA256140cb197190dee003e3d9636062cc1fd287adfa3c270d755781f0f67d5b646e8
SHA512ab72fdf924a32a859354e2f50d28a8b974aa6e6aefa5f190fa420e359e4b7f616193385f1493bad1d21515131df23fd58c9b377f0b972dfb154fa2ff5e762a46
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.htmlFilesize
6KB
MD5c4f9cb8b1f01af136fae76c63efcac10
SHA1ddba1b50d4a5b90a3c98b9bedb4fdfbef7757c25
SHA256b840ccb08eb42dd69524c684aa6c660799fa24eece0420aba16994d60a21f43d
SHA512f87a96cf4d29128ac9ad08bb0fab6ed6a89744a59efcae1476155231ed3f3a2bb15badadd090171aa25ce09b97d6da5a62a5c2e785f8d643197a64f34cd7ada7
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.htmlFilesize
12KB
MD533f73419b8fc156a8a5e0eee311a2639
SHA17ebd3842e080ed34f4675eea740c3e90d8db7bc2
SHA256442c6bfe7c011e24f8c0bb1c0584b96cf804eb7198d4aacffa4c5f6769ff4215
SHA5121f9e3a64bfc78cea57f4d9fce2ff4f9adfbe7526ef10e40eaa7cd9b8109cfa124b306f6d3be5e1a777bb604dc2c497623aa9298f580cd7e9a6e3bb9818e819ad
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.htmlFilesize
8KB
MD5ffbe89b376301d5a5e1602502f3a049e
SHA14fd73b0508a04073411bfb0af9f1e77a2009850a
SHA256fd516ab385f8dabba0da1377f5dfdc0dbdefdd224d823313eff24e8fb00c6217
SHA51225807dacb22621f69dfc9b85464e566a11b6f417632c9d2dac92b5112a8495aacc5edb2938e5515a59843fe79f25b5c65a280b41fb9b0c27bfce2b4da48cfa02
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.htmlFilesize
14KB
MD5138687bae4d5ae5ecd9f49d4603846b6
SHA1b9bd64f7c2f3a00ac7ad28d21d0f589e881eb5b5
SHA256aa696a838bb49ef4a6c83890ffa39424a471a84bcbc57ae86867b1f9bba3994f
SHA512c6b0b2a25e95a082695e658eb9086d67e2d517aed8adcb625e2b81a29887b4ae31d26cc99738703516ea9072773e06f8871b8775706aeec705f227a68fb7efa6
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.htmlFilesize
16KB
MD5b8723baac78bf9c17d116fe9b25c81b2
SHA17b04a048a42f9611afde747a57694574de887783
SHA256b8dd69bd1f86b0f1889122b8376ea78d44f0f0689945858f247975f7f72ef86c
SHA5121293a9aa28b83d6912ce041db03c8ebbe3aacceadf35d8cb59827abdaedefaac868ea77452bb34730073ed3b5c9679cf73d969cc3f9bd9be207a7a306db8c46e
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exeFilesize
3.8MB
MD55eb78d52d3ea9a67f973310ae04c6995
SHA18858f0fc05f9e3eba239b8fc76d6a4ba46f5b6d0
SHA256d01769f29f26665a6503c66f52aeab5c5ea51144f1946cd05c43b74b9965beb1
SHA51291fad6237752944c8af969353bf0684b5f2fc9cb9855d41012f11ebcfc3d1f8172e3c694e3d1df39292caa741034948fa0dbfb08b94e392ef7d5f4568b96b9a8
-
C:\vcredist2010_x86.log.htmlFilesize
81KB
MD59a905bf8de385e5429bed83611e673fb
SHA11dacd7dcfa918d6d8a58ff202c07b43a3018bda7
SHA25675fe684e7da66b1ccaae2ee2387906484caa9ca1c11d7df414f64be6f7fa8172
SHA512a8359cd4e569677c5bfd7a38bc0cf89d204ac79504c50579433b9e29e2c4a5f73616559ff2e79a61e83d79d302c5ca2f0adcd05f8d2e69114e7195ad5e478083
-
memory/1848-9-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1848-373-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1848-767-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2972-7-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2972-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2972-1-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB