Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 06:52
Behavioral task
behavioral1
Sample
2024-05-27_719a4b5326510f0a17f4444cf197a6f9_icedid_xiaobaminer.exe
Resource
win7-20240508-en
General
-
Target
2024-05-27_719a4b5326510f0a17f4444cf197a6f9_icedid_xiaobaminer.exe
-
Size
5.9MB
-
MD5
719a4b5326510f0a17f4444cf197a6f9
-
SHA1
a4bf1970f060e02e355a20b3b6304b48e0218db4
-
SHA256
43994a794899cdde0085bc7fac42572202ec4f7605b886b790d88fb0b2177d9d
-
SHA512
120e0f8e17480d6e26c24a4fdd055cf3fa002751a115bddd467b55e47161fc0cb18130fdf38669bcbd17bb9ecf8677851d9a3dc0d753f4967de78a927ff6019c
-
SSDEEP
49152:728NnzcErpEmdY8b0TN3NCLTgpYqB+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2en9:3bg8cCY6J0oAaldmdmnpq6aLapI9
Malware Config
Signatures
-
Detect Blackmoon payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/2176-1-0x0000000000400000-0x0000000000455000-memory.dmp family_blackmoon \Windows\360\360Safe\deepscan\ZhuDongFangYu.exe family_blackmoon behavioral1/memory/2176-5-0x0000000002AD0000-0x0000000002B25000-memory.dmp family_blackmoon behavioral1/memory/2176-9-0x0000000000400000-0x0000000000455000-memory.dmp family_blackmoon behavioral1/memory/2972-10-0x0000000000400000-0x0000000000455000-memory.dmp family_blackmoon behavioral1/memory/2972-11-0x0000000000400000-0x0000000000455000-memory.dmp family_blackmoon behavioral1/memory/2972-375-0x0000000000400000-0x0000000000455000-memory.dmp family_blackmoon behavioral1/memory/2972-756-0x0000000000400000-0x0000000000455000-memory.dmp family_blackmoon -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe -
Drops file in Drivers directory 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe -
Executes dropped EXE 1 IoCs
Processes:
ZhuDongFangYu.exepid process 2972 ZhuDongFangYu.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-05-27_719a4b5326510f0a17f4444cf197a6f9_icedid_xiaobaminer.exepid process 2176 2024-05-27_719a4b5326510f0a17f4444cf197a6f9_icedid_xiaobaminer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
ZhuDongFangYu.exedescription ioc process File created F:\autorun.inf ZhuDongFangYu.exe File opened for modification F:\autorun.inf ZhuDongFangYu.exe File created C:\autorun.inf ZhuDongFangYu.exe File opened for modification C:\autorun.inf ZhuDongFangYu.exe File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe -
Drops file in System32 directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\SysWOW64\nslookup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ntoskrnl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\resmon.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sxstrace.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dvdplay.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dxdiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\extrac32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\help.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\setx.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\typeperf.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\netiougc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ntkrnlpa.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sethc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\userinit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Utilman.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\regedit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\net1.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ocsetup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sfc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\taskeng.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\format.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ddodiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ROUTE.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\secinit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cliconfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\whoami.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wecutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\xpsrchvw.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\more.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\colorcpl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\lodctr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mmc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\PATHPING.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Robocopy.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dcomcnfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ntprint.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\raserver.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\recover.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\syskey.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fontview.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\notepad.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TapiUnattend.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\charmap.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\comp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\regini.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SearchIndexer.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\shutdown.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wininit.exe ZhuDongFangYu.exe File created C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_neutral_e54666f6a3e5af91\fsquirt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPMGR.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fltMC.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\hdwwiz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\LocationNotifications.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\OptionalFeatures.exe ZhuDongFangYu.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBrowserUpgrade.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUDGESCH.HTM ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OSPP.HTM ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\slideShow.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\MCABOUT.HTM ZhuDongFangYu.exe File created C:\Program Files\DVD Maker\DVDMaker.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\sidebar.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsImageTemplate.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{7ADE9966-696F-4996-9E1A-1D7786573DA1}\chrome_installer.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsImageTemplate.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\WMPDMC.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\currency.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsVersion1Warning.htm ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmprph.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\settings.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.htm ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.HTM ZhuDongFangYu.exe File created C:\Program Files\Internet Explorer\iexplore.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\settings.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmplayer.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\flyout.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\settings.html ZhuDongFangYu.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\slideShow.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\slideShow.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\flyout.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html ZhuDongFangYu.exe -
Drops file in Windows directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\winsxs\x86_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_658ca9e7eb14c76c\settings.html ZhuDongFangYu.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\MSBuild.ni.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mapi_31bf3856ad364e35_6.1.7601.17514_none_097346be305f3966\fixmapi.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.1.7601.17514_none_a505d556c9de886a_rstrui.exe_dfa7225b ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_355dd017d9254149\settings.html ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-choice_31bf3856ad364e35_6.1.7601.17514_none_218cf07ba262766c\choice.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_6.1.7600.16385_none_07c100a06d2b74c6\rekeywiz.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_wpf-presentationhostexe_31bf3856ad364e35_6.2.7601.17514_none_3a2a6a811d2b5065\PresentationHost.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a5f3b7a6a481da29\picturePuzzle.html ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-anytime-upgrade_31bf3856ad364e35_6.1.7600.16385_none_fb591b6cf023ade3\WindowsAnytimeUpgrade.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-sysinfo_31bf3856ad364e35_6.1.7600.16385_none_ef2b073e59e262f6\systeminfo.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-verclsid_31bf3856ad364e35_6.1.7600.16385_none_bbbd275974c7e191\verclsid.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\403-18.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-sxs_31bf3856ad364e35_6.1.7601.17514_none_b0540607b5e5d445\sxstrace.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a9893e83c110fe46\cpu.html ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-6.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\401.htm ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-diskpart_31bf3856ad364e35_6.1.7601.17514_none_c6fe6ac9ac8c7105\diskpart.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-setupcl_31bf3856ad364e35_6.1.7601.17514_none_b6d50b4301e77815\setupcl.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-installer-executable_31bf3856ad364e35_6.1.7601.17514_none_4b88deb7e45bfbb0\msiexec.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_netfx-ieexec_b03f5f7f11d50a3a_6.1.7600.16385_none_7dfc94f7357c56d2\IEExec.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..pwindowmanager-core_31bf3856ad364e35_6.1.7601.17514_none_ebc99983d3d18578_dwm.exe_04cf416e ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-cttunesvr_31bf3856ad364e35_6.1.7600.16385_none_efd12d677fabca7b\cttunesvr.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-restartmanager_31bf3856ad364e35_6.1.7600.16385_none_dc2a59723dcfa2c7\RmClient.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_6.1.7601.17514_none_d9bafd47cdf9833b\WinSAT.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_wcf-smsvchost_b03f5f7f11d50a3a_6.1.7600.16385_none_c7f13af70ac77b22\SMSvcHost.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\500-19.htm ZhuDongFangYu.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_6.1.7600.16385_none_9cef76e6ecab612f\SystemPropertiesHardware.exe ZhuDongFangYu.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\ComSvcConfig.ni.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..tomizationsnonwinpe_31bf3856ad364e35_6.1.7601.17514_none_29f4eed2a5d64c25\PnPUnattend.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\404-7.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\403.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-cipher_31bf3856ad364e35_6.1.7600.16385_none_090b7101bec9a9e2\cipher.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-computerdefaults_31bf3856ad364e35_6.1.7600.16385_none_064cf7cf249d0026\ComputerDefaults.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-pdm-configuration_31bf3856ad364e35_11.2.9600.16428_none_d6876629731ce419\PDMSetup.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-13.htm ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpCmdRun.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_6.1.7600.16385_none_26e76f2ac1492952\wmprph.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mystify_31bf3856ad364e35_6.1.7601.17514_none_4e37a08175fccf3e\Mystify.scr ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_5cbb962a4f0d58c1\comp.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\PkgMgr.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\wow64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_d5b4f96cdbb9a8b1\IMJPDSVR.EXE ZhuDongFangYu.exe File created C:\Windows\winsxs\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_6.1.7600.16385_none_963d3becc3a475f1\raserver.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_brmfcmf.inf_31bf3856ad364e35_6.1.7600.16385_none_6f8740b92fea8e01\BrmfRsmg.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_6.1.7600.16385_none_8be8919a8f43b3f6\raserver.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\502.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5646c597a746df57\slideShow.html ZhuDongFangYu.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\WsatConfig.ni.exe ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe ZhuDongFangYu.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config.comments ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c9675951dd42e377\slideShow.html ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\doskey.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\401-3.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_6e8a5c3d2bac37e9\ntkrnlpa.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\403.htm ZhuDongFangYu.exe File created C:\Windows\ehome\ehrec.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_8.0.7600.16385_none_d009281f9a108e04\mshta.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-security-spp_31bf3856ad364e35_6.1.7601.17514_none_78875ce737927d27_sppsvc.exe_fc6922a9 ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24\newdev.exe ZhuDongFangYu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2024-05-27_719a4b5326510f0a17f4444cf197a6f9_icedid_xiaobaminer.exeZhuDongFangYu.exedescription pid process Token: SeDebugPrivilege 2176 2024-05-27_719a4b5326510f0a17f4444cf197a6f9_icedid_xiaobaminer.exe Token: SeDebugPrivilege 2972 ZhuDongFangYu.exe Token: 33 2972 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 2972 ZhuDongFangYu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-05-27_719a4b5326510f0a17f4444cf197a6f9_icedid_xiaobaminer.exeZhuDongFangYu.exepid process 2176 2024-05-27_719a4b5326510f0a17f4444cf197a6f9_icedid_xiaobaminer.exe 2972 ZhuDongFangYu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-05-27_719a4b5326510f0a17f4444cf197a6f9_icedid_xiaobaminer.exedescription pid process target process PID 2176 wrote to memory of 2972 2176 2024-05-27_719a4b5326510f0a17f4444cf197a6f9_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 2176 wrote to memory of 2972 2176 2024-05-27_719a4b5326510f0a17f4444cf197a6f9_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 2176 wrote to memory of 2972 2176 2024-05-27_719a4b5326510f0a17f4444cf197a6f9_icedid_xiaobaminer.exe ZhuDongFangYu.exe PID 2176 wrote to memory of 2972 2176 2024-05-27_719a4b5326510f0a17f4444cf197a6f9_icedid_xiaobaminer.exe ZhuDongFangYu.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_719a4b5326510f0a17f4444cf197a6f9_icedid_xiaobaminer.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_719a4b5326510f0a17f4444cf197a6f9_icedid_xiaobaminer.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.htmlFilesize
16KB
MD517f3bbed916ce900652433f2593ff684
SHA185d4fbf534aa8acd759a489d31e06ac27677f3a7
SHA256aa21cb6b8fd8ee6e90ecc5b858dbcbecd3a97efa1f58145a26e619c2ab457bb5
SHA51281a01663f9d577882d82744d063af5fd570ee2d98cd5f6995f3f5aedaa99b45b215ef0e081056001026f45fe79ce811bef5979ce8973df8527b1920ad2215bdf
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.htmlFilesize
6KB
MD524bed74a2a49536d75ebfd9c87d105eb
SHA1ec830db2834d33dd61437ccf330ca2ad6b73e377
SHA2563cc5fa1f9ed7884a08539190a1670bbe64b0e64d1d585d4c1befcf7f91960682
SHA512a29b8c9f0a3f354e36c805b3956f637a9024ba3df8085c20f148ee4e550603191725e40d0c784192022b637227b06d831cc83a3790cc372e94431d5685545265
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.htmlFilesize
12KB
MD533f73419b8fc156a8a5e0eee311a2639
SHA17ebd3842e080ed34f4675eea740c3e90d8db7bc2
SHA256442c6bfe7c011e24f8c0bb1c0584b96cf804eb7198d4aacffa4c5f6769ff4215
SHA5121f9e3a64bfc78cea57f4d9fce2ff4f9adfbe7526ef10e40eaa7cd9b8109cfa124b306f6d3be5e1a777bb604dc2c497623aa9298f580cd7e9a6e3bb9818e819ad
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.htmlFilesize
8KB
MD5ffbe89b376301d5a5e1602502f3a049e
SHA14fd73b0508a04073411bfb0af9f1e77a2009850a
SHA256fd516ab385f8dabba0da1377f5dfdc0dbdefdd224d823313eff24e8fb00c6217
SHA51225807dacb22621f69dfc9b85464e566a11b6f417632c9d2dac92b5112a8495aacc5edb2938e5515a59843fe79f25b5c65a280b41fb9b0c27bfce2b4da48cfa02
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.htmlFilesize
14KB
MD5138687bae4d5ae5ecd9f49d4603846b6
SHA1b9bd64f7c2f3a00ac7ad28d21d0f589e881eb5b5
SHA256aa696a838bb49ef4a6c83890ffa39424a471a84bcbc57ae86867b1f9bba3994f
SHA512c6b0b2a25e95a082695e658eb9086d67e2d517aed8adcb625e2b81a29887b4ae31d26cc99738703516ea9072773e06f8871b8775706aeec705f227a68fb7efa6
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.htmlFilesize
16KB
MD5b8723baac78bf9c17d116fe9b25c81b2
SHA17b04a048a42f9611afde747a57694574de887783
SHA256b8dd69bd1f86b0f1889122b8376ea78d44f0f0689945858f247975f7f72ef86c
SHA5121293a9aa28b83d6912ce041db03c8ebbe3aacceadf35d8cb59827abdaedefaac868ea77452bb34730073ed3b5c9679cf73d969cc3f9bd9be207a7a306db8c46e
-
C:\vcredist2010_x86.log.htmlFilesize
81KB
MD59a905bf8de385e5429bed83611e673fb
SHA11dacd7dcfa918d6d8a58ff202c07b43a3018bda7
SHA25675fe684e7da66b1ccaae2ee2387906484caa9ca1c11d7df414f64be6f7fa8172
SHA512a8359cd4e569677c5bfd7a38bc0cf89d204ac79504c50579433b9e29e2c4a5f73616559ff2e79a61e83d79d302c5ca2f0adcd05f8d2e69114e7195ad5e478083
-
\Windows\360\360Safe\deepscan\ZhuDongFangYu.exeFilesize
5.9MB
MD5719a4b5326510f0a17f4444cf197a6f9
SHA1a4bf1970f060e02e355a20b3b6304b48e0218db4
SHA25643994a794899cdde0085bc7fac42572202ec4f7605b886b790d88fb0b2177d9d
SHA512120e0f8e17480d6e26c24a4fdd055cf3fa002751a115bddd467b55e47161fc0cb18130fdf38669bcbd17bb9ecf8677851d9a3dc0d753f4967de78a927ff6019c
-
memory/2176-9-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2176-1-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2176-5-0x0000000002AD0000-0x0000000002B25000-memory.dmpFilesize
340KB
-
memory/2972-375-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2972-11-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2972-10-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2972-756-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB