Analysis
-
max time kernel
142s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 07:49
Behavioral task
behavioral1
Sample
2024-05-24_72f2b49a64a3b9243478af5313774ba4_icedid_xiaobaminer.exe
Resource
win7-20240221-en
General
-
Target
2024-05-24_72f2b49a64a3b9243478af5313774ba4_icedid_xiaobaminer.exe
-
Size
5.1MB
-
MD5
72f2b49a64a3b9243478af5313774ba4
-
SHA1
6f8786f22afaa92882b08c9443c06785c062a7b4
-
SHA256
ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06
-
SHA512
04ba1e457504d7e996a21887380e0244c889aef8ba1ab2ee13d57a2fae5c76daecd64dc5a9c66229e2de13831ad36fd0834c26a66fa7f8f35ac189092ef444e7
-
SSDEEP
49152:7bCknzcErNNQJLxgjI45TMwwapIgThpYqB+Cq99LyHHI+t6O8N+ailEy6dmpzeiU:SXPLapIK6J0oAaldmdmnp
Malware Config
Signatures
-
Detect Blackmoon payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4600-0-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/4600-1-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe family_blackmoon behavioral2/memory/4600-12-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/4116-354-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon behavioral2/memory/4116-493-0x0000000000400000-0x0000000000453000-memory.dmp family_blackmoon -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe -
Drops file in Drivers directory 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-05-24_72f2b49a64a3b9243478af5313774ba4_icedid_xiaobaminer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 2024-05-24_72f2b49a64a3b9243478af5313774ba4_icedid_xiaobaminer.exe -
Executes dropped EXE 1 IoCs
Processes:
ZhuDongFangYu.exepid process 4116 ZhuDongFangYu.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification F:\autorun.inf ZhuDongFangYu.exe File created C:\autorun.inf ZhuDongFangYu.exe File opened for modification C:\autorun.inf ZhuDongFangYu.exe File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe File created F:\autorun.inf ZhuDongFangYu.exe -
Drops file in System32 directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\SysWOW64\mspaint.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\relog.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sfc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\convert.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\help.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mshta.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wevtutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\regedt32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\control.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PresentationHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\netbtugc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\reg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\shutdown.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\msdt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\eventvwr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fontdrvhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\certutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\findstr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\proquota.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sort.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\colorcpl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dcomcnfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\net.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\tasklist.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\choice.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cliconfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\subst.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wscript.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dxdiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\grpconv.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\shrpubw.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cipher.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmmon32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\notepad.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\forfiles.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\LaunchTM.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\MuiUnattend.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\odbcad32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\poqexec.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\comp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\edpnotify.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\timeout.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wowreg32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\systray.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ttdinject.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\winrshost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dpapimig.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sxstrace.exe ZhuDongFangYu.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.29\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Mail\wab.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmprph.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\dotnet\dotnet.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\java.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notetagsUI\index.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\setup_wm.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe ZhuDongFangYu.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe ZhuDongFangYu.exe -
Drops file in Windows directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.746_none_a47144c464d15475\f\WSReset.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.19041.746_none_099c40ad55bc5d6c\AuthHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_a9b815907b71fe1a\f\wowreg32.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\http_400.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVStreamingUX.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.19041.1_none_4406801793afabed\CompMgmtLauncher.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_42ec0e96ce977bdb\r\gpscript.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.153_none_1721bd4ad34c0544\r\MusNotifyIcon.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_a892faef80a943dc\f\MuiUnattend.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1_none_874ce756c022852f\Robocopy.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deploymentcsps_31bf3856ad364e35_10.0.19041.1_none_24012e8e9dd1d9a9\deploymentcsphelper.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.1202_none_fdbbcf53ca14e151\f\wimserv.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\roamingDisambiguation.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\501.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\http_500.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\PhishSiteEdge.htm ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.264_none_9b436d497f039d6d\r\smartscreen.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\msil_servicemodelreg_b03f5f7f11d50a3a_10.0.19041.1_none_0bb55a3e8d066c16\ServiceModelReg.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\dnserror.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\404-2.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\proxyerror.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\f\immersivetpmvscmgrsvr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\backstack-chrome-breadcrumb-template.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\pdferrordisabledforregion.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\404-15.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.19041.746_none_cabafbc5834ab93f\DisplaySwitch.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-locator_31bf3856ad364e35_10.0.19041.1_none_8525a0b08bf57bbb\Locator.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\r\wscript.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\tsdiscon.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_ed4855448241f7e7\r\Magnify.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.1_none_20aa8037cb026fdb\netbtugc.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.19041.746_none_3db5b5ee37a4dee7\f\CompPkgSrv.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.19041.1_none_7da5a59f860f2406\DmNotificationBroker.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.19041.1_none_25afcd12036f5605\RMActivate_ssp.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.1_none_643da99ff70141b5\sxstrace.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\default.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\http_501.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_770f598aef14382e\dfrgui.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_5f22b28b2f384ed0\PING.EXE ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_ec5eb439471de957\r\cleanmgr.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.19041.1_none_ad9c6c9be4203192\Netplwiz.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\http_406.htm ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\unknownprotocol.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\smartscreen.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.1288_none_6c70124c60e2b4ef\r\vmcompute.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\iisrstas.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.19041.572_none_846686e46b73c8e3\f\PnPUnattend.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\SearchFilterHost.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1202_none_9fe20fdb296d6341\edpnotify.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\OfflineTabs.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.207_none_504b6becabbef9fe\autopilotespprogress-main.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\412.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.1_none_47f8a965309a7ee6\CloudNotifications.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.19041.1151_none_e0e8a531e34051a9\f\HelpPane.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\pdferror.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\http_500.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_69061189792bce34\f\cmd.exe ZhuDongFangYu.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\gpresult.exe ZhuDongFangYu.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\RetailDemo\retailDemoSecurity.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\default-contentview-template.html ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\403-14.htm ZhuDongFangYu.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\500-18.htm ZhuDongFangYu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2024-05-24_72f2b49a64a3b9243478af5313774ba4_icedid_xiaobaminer.exeZhuDongFangYu.exedescription pid process Token: SeDebugPrivilege 4600 2024-05-24_72f2b49a64a3b9243478af5313774ba4_icedid_xiaobaminer.exe Token: SeDebugPrivilege 4116 ZhuDongFangYu.exe Token: 33 4116 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 4116 ZhuDongFangYu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-05-24_72f2b49a64a3b9243478af5313774ba4_icedid_xiaobaminer.exeZhuDongFangYu.exepid process 4600 2024-05-24_72f2b49a64a3b9243478af5313774ba4_icedid_xiaobaminer.exe 4116 ZhuDongFangYu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-05-24_72f2b49a64a3b9243478af5313774ba4_icedid_xiaobaminer.exedescription pid process target process PID 4600 wrote to memory of 4116 4600 2024-05-24_72f2b49a64a3b9243478af5313774ba4_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 4600 wrote to memory of 4116 4600 2024-05-24_72f2b49a64a3b9243478af5313774ba4_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 4600 wrote to memory of 4116 4600 2024-05-24_72f2b49a64a3b9243478af5313774ba4_icedid_xiaobaminer.exe ZhuDongFangYu.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_72f2b49a64a3b9243478af5313774ba4_icedid_xiaobaminer.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_72f2b49a64a3b9243478af5313774ba4_icedid_xiaobaminer.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exeFilesize
5.1MB
MD572f2b49a64a3b9243478af5313774ba4
SHA16f8786f22afaa92882b08c9443c06785c062a7b4
SHA256ba86cc2a759cba001c922cad01b57cf5d369b8360c4d871c02b888cb1cfc1a06
SHA51204ba1e457504d7e996a21887380e0244c889aef8ba1ab2ee13d57a2fae5c76daecd64dc5a9c66229e2de13831ad36fd0834c26a66fa7f8f35ac189092ef444e7
-
C:\vcredist2010_x64.log.htmlFilesize
87KB
MD5a985d4eff680798ee99c61e120b7b5d4
SHA1127b33799f22fb8140d95c8efdbd7150f9c34845
SHA2569793875b7679f5cced51c76fc0274f3e6a65e3757a359efe50beba8c9346e1c2
SHA51233e4fff02c04e94021b30a8be0f4470d64f16199f92891a8974f8ac30d64c4a3e5f90bbe41227a5bfc3ed7832a76422e95cd3bf1a419c0724a1d7fc368817c2e
-
memory/4116-354-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4116-493-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4600-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4600-1-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4600-12-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB